Accuracy and false positives

Before release, offramp was run over 190 public repositories built on Lovable and Emergent. A sample of each kind of finding was read by hand, every false positive found was fixed, and the audit was run again before any number was counted. The method and the per-check precision are in the pull request that did it. Results are only ever published in aggregate; no repository is named.

What we found is written up in We audited 190 apps built with Lovable and Emergent.

Report a wrong finding

A false positive is a bug. If offramp reports something that is not true of your app, open an issue with the finding's id from the report. You do not need to share your code. A short description of what the file actually contains is usually enough.

Precision over coverage

offramp would rather miss a problem than invent one, and rather say "could not assess" than give a partial answer. A new check is added only after it has been run over the same corpus and a hand-checked sample of its findings holds up.