Static-analysis false-positive rate

What it means

A static-analysis false-positive rate estimates how often alerts are judged irrelevant, incorrect, or out of scope after review. The numerator and denominator must be defined, including whether duplicates, ignored alerts, and unresolved findings count. Measuring this rate helps teams tune rules without equating silence with quality.

Example

A checker reports 100 findings in a month. Reviewers classify 22 as non-actionable after examining the code and rule context, producing a reported false-positive rate of 22 percent under that workflow.

Limitations

Classification is subjective and can be biased by limited review time. A finding marked false positive may represent a real risk that the rule cannot prove. Track missed defects and suppression behavior alongside the rate.

How to use the signal

Label findings consistently and sample closed alerts, since a fast dismissal process can make noise appear lower without improving precision.

Weave can connect noisy rule periods with review duration and developer friction. The rule engine supplies findings, while Weave helps identify whether noise changes the surrounding engineering workflow.