VSAT: Estimating the Completeness of Multi-Lens LLM Security Audits of Web Applications via Capture-Recapture

Reproduction artefacts for the paper "VSAT: Estimating the Completeness of Multi-Lens LLM Security Audits of Web Applications via Capture-Recapture" (submitted to Computers & Security). VSAT runs several deliberately diverse LLM audit lenses over one codebase, treats each as a capture occasion, and reports an incidence-based Chao2 completeness estimate C_hat with its 95% confidence interval and deduplication sensitivity, together with a structural coverage term over an OWASP ASVS ledger. C_hat is reported as an estimate with stated sensitivity, not as a calibrated bound, and the saturation signal is a decision-support indicator, not a stopping rule. The package contains the merged incidence matrices of the main study and of all 26 injection-study runs, computed metrics with confidence intervals, the estimator and analysis scripts, a self-contained recompute.py that regenerates every estimator-derived table without network access, the ASVS ledgers that determine the structural coverage term, run provenance (which corpus each study audited), the injection answer keys and matcher, and the current manuscript PDF. v3.1 (2026-09-24): single-pass and union counts placed in the same merged unit; ASVS ledgers added; manuscript PDF replaced by the revised version; superseded Japanese PDF removed. v3 (2026-09-24): canonical Chao2 with the (T-1)/T factor and 95% log-normal confidence intervals; per-run incidence matrices; provenance record; recompute.py.