Visible to the public Software Assurance Metrics and Tool Evaluation