My Scanner Missed 93% of the Bugs — and That Was the Right First Result

Building an AI-powered vulnerability scanner, the author starts with a brutal F1 score of 0.13 — then methodically climbs to perfect recall (1.00) through disciplined, one-variable-at-a-time fixes: expanding source patterns, adding receiver-text sinks, and building a taint bridge for split() operations. The real lesson isn't the final score — it's that missing coverage fails silently, and only measurement against ground truth reveals your blind spots.