Proof

Measured, not promised.

Developer tools ship a lot of adjectives. We publish numbers instead, measured on public repos with a reproducible harness, and when a claim doesn't survive measurement we delete it from this page. Here is what survived.

Measured, not promised

Every number below was measured on public open-source repos with a reproducible harness. When a claim doesn't survive measurement, we delete it.

3.63×

Bug-fix concentration. Real bug fixes landed inside the smaller high-risk surface Semfora flags at 3.63 times the rate an even spread would give. Measured on 1,773 resolvable bug cases.

30.5%

Fixes inside the flagged surface. 541 of 1,773 real bug fixes fell inside a flagged surface covering just 8.4% of the matched line mass. The broader high-risk band alone held 41.6% of fixes in 14.5% of the code.

410

Repositories studied. Public open-source repositories across 8 languages. Every case has a real fix commit and changed-line ground truth; no synthetic bugs.

137

Cases metered with live agents. We metered what AI agents actually spend to work against real code: 1,370 completed runs across five models. Token spend tracked the size and centrality of the change more than anything else we tested. The trend is loose (rank correlation tops out near 0.21) but consistent across models.

Grammars. TypeScript to Terraform to TLA+. Counted from the engine's own language table: 23 languages, the JSX and TSX variants, Markdown, and the config formats that wire a system together.

128 KB

Names and numbers only. The hard cap on what one analysis can store: function and module names, scores, and counts. No field in the schema can carry your source.

How the numbers were made

A full methodology write-up is coming. Until it ships, this is the shape of the harness, stated plainly enough to be checked.

Real bugs, not synthetic ones

The study set is 1,773 resolvable bug cases from 410 public open-source repositories across 8 languages. Each case has a real fix commit and changed-line ground truth. Synthetic bug suites reward the tool that generated them; we skip them.

Measured before the fix, on the code as it stood

For every case we draw the high-risk surface on the matched pre-fix state of the repository and then check where the fix actually landed. A hit means the fixed line, or its enclosing function, was already inside the surface.

The concentration test

The surface where high structural risk meets high change activity covered 8.4% of the matched line mass and held 541 of the 1,773 fixes: 30.5%, a 3.63× concentration over an even spread. The broader high-risk band alone held 41.6% of fixes in 14.5% of the code, a 2.87× concentration.

What didn't survive

Earlier versions of this page claimed a 92nd-percentile complexity result and 100% top-quartile coverage on 183 bug sites. We found two bugs in our own harness (tie handling and a population mismatch), both flattering, and retracted the numbers. The corrected methodology produced the concentration results above.

What we don't claim: Semfora does not predict bugs, does not attribute them to AI, and does not name the exact function a future bug will land in. It measures where structural risk and change activity are concentrating right now, and the study above says that smaller surface holds a disproportionate share of later fixes. That is a claim about where review attention pays off, not about the future of any single function.

Run it on your repo What the map contains