Methodology

Subject and coverage

A scan is one HTTP subject: a URL or a host. HTML, headers, and cookies of that resource; DNS and TLS of that hostname.

Three piles: compiled (this subject); named, not compiled (Location hops, CT hosts, sitemap paths); not done (mode, plan, network).

An offsite hop is a hostname fact, reason redirect_external_offsite: not a second dossier, not malware. A bot wall is kind occluded. A Next header on the wall does not promote the kind to spa_or_app.

Outcomes

The badge does not say whether the check ran. Ok, Attention, Critical: outcome of an executed check. Not run (*_skipped_tier, not_requested, blocked_by_bot_wall) is outside this scan. Unavailable is signalType technical_failure or status failed: network, timeout, provider down. Not an incident.

Critical in the UI goes through displayOutcome. It stays critical if the layer is fact or signalType is confirmed_risk. Otherwise it drops to Attention.

Modes

Three modes, always written on the report. Mode is not a billing plan.

passive (guest): DNS, TLS, redirects, headers, reachable content. No CT, sitemap, takeover, JS secrets, LeakIX, Web Risk, Deep.

hybrid (account): full plan without Playwright. deep (Pro): Chromium, three UA profiles, screenshots, scripts after load. Deep is a way of seeing, not a pentest in the browser.

Layers

fact: observable without interpretation (exposed file, expired cert, cloaking, confirmed feeds, confirmed takeover). hypothesis: a signal to review (runtime, SEO spam, LeakIX, embeds). hygiene: headers, SPF/DMARC, CAA, DNSSEC, cookie flags. Treating hygiene as malware is noise.

signalType travels alongside: confirmed_risk, suspicious_signal, technical_failure, informational. A builder (Wix, Framer) explains a signal; it does not clear it.

Portrait

OriginKind: managed_site, custom_origin, spa_or_app, api_like, occluded, not_web, refused. Unknown is a type: a visible origin with no declared stack.

If the input is a URL with a path, the subject is that page; DNS/TLS stay with the host. architecture (nextjs, nuxt, …) is a silhouette. No IoT or software that does not speak HTTP. No Java or Python without a signal.

Around

The constellation names neighbours. It does not walk the graph. Click a named node = new subject, zero fan-out.

Redirects: HTTP chain up to 8 Location hops; the destination stays named. CT: cap 8 in the list, 12 in the graph, star edges from the compiled node. Sitemap: cap 30 URLs, cap 4 documents; pages are not fetched. Guest sees only the hops of their own chain.

Threat intel

Google Web Risk (MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE) and OpenPhish reduce to clean / watch / confirmed. A single confirmed stays watch. Two confirmed, or confirmed + watch, become confirmed.

LeakIX is hypothesis, not a verdict on its own. Consensus is a reason code. provider_unavailable is Unavailable, not Critical.

Runtime (Deep)

After load: eval / Function / atob, dynamic import() (threshold 20), inline scripts (threshold 30). The finding stays; the sentence carries the counts. eval: containment. Inline spike: verify origins, even on a CMS.

Late redirects are hypotheses on the starting page. If the challenge does not resolve, Deep stops on the wall (deep_flow_blocked_by_bot_wall). Not a bypass.

Reason codes

Every check exposes a stable English reason: runtime_injected_script_detected, ct_skipped_tier, redirect_external_offsite. Contract for triage and golden tests. Human copy may change; the code does not, unless on purpose.

Technical view: check id, status, priority, signalType, URL, host. There is no generated summary of the dossier.

Trust

Trust 0–100 is a summary. The verdict is the line: facts, hypotheses, hygiene, coverage, what this scan did not do.

The number on the dossier is the lowest of the areas this compile executed. An area that did not run has no score and stays out of the minimum. An area with no confirmed risk says none was found. It does not say the area is safe.

A residue mark on a watched subject does not move the number. TLS chain, DNSSEC, the second resolver, and payment cues are rows inside their areas, not a second verdict.

A 90 on / does not speak for /wp-admin.

Watch

Watch is compile, repeated — not a SIEM. Pulse: DNS A/NS, cert expiry, content hash. Digest: hybrid. An alert names a fact already compiled (risk delta, hash drift, takeover, GitHub leak), not an attack discovered.

Production cron: Pro, once a day (08:00 UTC), with a cap on hybrid digests per tick.

Export

Markdown and JSON: mode, coverage, limitation, reason, portrait. Never file bodies or plaintext secrets.

A /r/{token} link exists only after Copy link: expiry, noindex, private by default. Not a feed for agents.

A machine compile is POST /api/v1/compile with a personal key: the full plan, a named profile (dns, tls, http, content, threat), or a check list. Deep is Pro and async.

Out of scope

No Nuclei, port scan, login on the target, secret dumps, crawl, fan-out on named neighbours, fingerprint correlation across different registrable domains, “it is Microsoft so it is fine” allowlist, automatic Deep on a wall.

Not run and Unavailable are not proof of an attack.