Benchmarks

7 fixtures, 8 metrics (coldScanMs/warmScanMs/incrementalMs/peakRssMb/filesPerSec/packMs/graphMs/cacheHitRatio), median-of-3, 1.5× thresholds.

node benchmarks/run.mjs --classes small --out /tmp/out
node benchmarks/check-thresholds.mjs

Public evidence: ~20 OSS repos (TypeScript/Go/Rust/Python) pinned SHAs, offline analysis only, aggregate counts (no raw secrets), deterministic.