Security · Comparison
Supercov vs Kolega DevSec Max
Kolega finds 91% of labelled vulnerabilities; Supercov finds 43% in 10 seconds. Measured on 72 RealVuln repositories, with results by language.
The difference
Kolega DevSec Max is Kolega’s AI security scanner, and Kolega also builds RealVuln, the benchmark used here. It finds more than any other scanner in the test. Supercov is an open-source command that runs twelve fixed checks per file in seconds.
Results
72 deliberately vulnerable repositories, 2,016 labelled vulnerabilities.
| Supercov 2.0.1 | Kolega DevSec Max 0.1.0 | |
|---|---|---|
| F1 | 0.42 | 0.69 |
| Finds | 43% | 91% |
| Right | 42% | 56% |
| Median time | 10 s | not recorded |
| Cost per repository | 5¢ | not recorded |
| False alarms on decoys | 26 | 23 |
RealVuln does not record Kolega’s time or cost.
By language
| F1 | Supercov | Kolega DevSec Max |
|---|---|---|
| Python, 32 repositories | 0.54 | 0.82 |
| TypeScript, 27 | 0.36 | 0.61 |
| JavaScript, 13 | 0.34 | 0.65 |
Choose Kolega when
- missing a vulnerability costs more than reviewing extra findings: it finds 91%, twice Supercov’s share.
Choose Supercov when
- you want an open-source command your coding agent can run itself;
- you need results in seconds, on every change;
- you want to see exactly which check fired on which line, and rerun it.
See Accuracy, speed and cost for how this was measured.
Evidence: every scanner's results (JSON) · Supercov's reports, timings and scoring script (ZIP). Measured September 25, 2026 on 72 RealVuln repositories.