# Fixture f2 — category denominator bug (expect: FAIL via R4)

Mirrors the real 10-of-11 bug: claims 10 of 11 categories produce a finding
but only names 2 empty categories, so 10 + 2 != 11.

- Category level: **10 of 11 in-scope categories produce at least one
  finding** — A1, A2, A3, A8, A9, A10, ReDoS, SSRF, A5-ish, A6-ish. The two
  that come home empty: A5 security-misconfiguration, A6 sensitive-data.