TrueMend on ASP.NET Core — Ombi

Ombi is a real, production ASP.NET Core web app — the framework-specific detector surface either survives contact with it or it doesn't. No ASP.NET-aware competitor tool is wired into this harness yet, so there's no head-to-head number here, just TrueMend judged blind against real source, the same discipline as every other campaign on this site.

A stale number, caught by an audit

The first number for this framework, from 2026-07-04, was 28.9% wrong-match — failing. A same-day fix (3fcd71b) addressed it, but no reverify ever confirmed the fix actually held. A framework-gap audit on 2026-07-25 caught this directly: a fresh 237-finding sample against the current specs (the detector surface had grown from 627 to 759 raw findings since the original pass) measured 19.4% wrong-match — still failing. The 2026-07-04 number had gone stale without anyone re-checking it.

Six real bugs, root-caused against actual source

Reading the wrong findings against Ombi's own code turned up six systemic detector bugs, not one-off mistakes:

1. aspnet_no_authorize_controller (6/6 wrong) — the negative pattern for [Authorize] had no scope direction, defaulting to a forward-only window from the class declaration. Real C# always declares attributes above the class, so the check never looked backward at all. Fixed with negated_scope_direction: before.
2. aspnet_no_model_validation (5/5 wrong) — [ApiController] auto-validates ModelState for every action in the class, but the 15-line negative-pattern window often couldn't reach a class-level [ApiController] from an action declared 20-30+ lines down. Widened to a whole-file check.
3. ef-core-transaction-async-flow (4/4 wrong) — only matched the using (var tx = ...) block form, not the C# 8 using var tx = await ...BeginTransactionAsync(); declaration form. Every hit was this exact correctly-scoped idiom.
4. csharp-mock-without-verify (2/2 wrong) — .Setup( isn't unique to Moq; production code called a NotificationMessageCurlys.Setup(...) helper. Gated on file_content_requires: Moq.
5. ef-core-queryable-leak-public-api (2/2 wrong) — accepted private as a "leaking" access modifier; a private method can't leak across a boundary it's never exposed across.
6. slop-single-letter-variable (2/2 wrong) — matched a lambda arrow (g => g.Key) as a bare assignment, since =(?!=) didn't exclude =>.

All six were verified empirically, not just by recomputing old verdicts: a post-fix re-run (759 → 583 findings) confirmed every targeted false-positive site now produces zero findings, while a genuine true positive in the same category (LidarrController, which really has no [Authorize] anywhere) still fires.

Result — and what the number actually is

Fixes alone don't clear the bar: removing the 21 now-impossible false positives the six regex fixes target drops wrong-match from 19.4% to 11.6% — recompute A, still above 10%. Three more detectors (aspnet_ef_no_async, aspnet_ef_n_plus_one, csharp-ef-tracking-missing-asnotracking) had failed two independent real corpora with no line-scan-expressible fix — the actual defect is tracking dataflow/materialization state, which regex can't do. Withdrawing them — recompute B — removes their entire category (18 findings gone, 16 wrong, but also 2 genuine true positives lost) and is what pushes the number to 4.5%, under the bar.

These are reported separately on purpose: recompute A is a real precision gain, recompute B is a coverage cut that happens to also improve the number. Presenting them as one curve would misrepresent a withdrawal as a fix.

Still open

4.5% is a recompute, not a fresh campaign — the gold-standard confirmation is a from-scratch blind sample against current specs, not yet run. The three withdrawn detectors are a genuine, disclosed coverage loss — candidates for a future rebuild with real dataflow tracking, not a permanent removal. Several smaller residual categories remain un-root-caused (csharp-https-missing, csharp-ioptions-vs-snapshot, aspnet_no_exception_handler, and five others, one finding each) — too small individually to move the bar, but not yet zero.