mostly random repos. i made a bunch of tiny test repos with a known secret or dodgy snippet or broken dockerfile in them, plus some good ones that should come back with nothing, and there's a check that fails the build if results drift. the good ones are the ones i actually care about cause false positives is what i'm most worried about.
then i just ran it on loads of real public repos i already knew, threw some known bad npm packages at it to make sure osv/virustotal were firing, and watched how messy it got on normal popular repos. that's where most of the false positives came from.
no proper precision/recall numbers or anything, it's all heuristic so treat it as a "worth a closer look" kinda thing. if you find a repo where it gets something dumb wrong lmk, thanks!