Verification levels
From raw signal to defensible finding
Signals are normalized and deduplicated, then validated. High-impact candidates are routed for appropriate human review. Evidence, impact, remediation, confidence, status and methodology references travel with the finding.
Public checks versus authorized testing
A free check inspects bounded public HTTP, TLS and frontend signals. It does not log in, brute-force, inject payloads or fuzz endpoints. An active job requires domain verification, accepted Rules of Engagement, an active scope, an unexpired window and an eligible paid plan. The worker checks again before execution.
A transparent score
The public surface score is the percentage of assessed checks that passed, with equal weight per assessed check. Not assessed is excluded, never treated as pass. The report shows both counts and limitations; a score of 100 is not a claim of complete security.
A release verdict, not a safety badge
GO, CONDITIONAL GO and NO-GO apply to the specific scope, build and date. Required human approvals and coverage must be present. Retesting a human-verified finding retains the appropriate human verification requirement.
Primary references
Updated October 31, 2026, with this methodology implementation. Reference mapping is not certification or a claim of exhaustive standard coverage.