Security Analysis Methodology

The security engine uses deterministic static-analysis rules. It recognizes supported permission, tool, credential, prompt, command, network, browser, approval, OAuth, memory and log indicators. Findings include evidence, severity and confidence. Heuristic matches are not presented as confirmed vulnerabilities, and absence of a finding is not proof of safety.

Risk scoring

Confirmed and potential findings contribute deterministic weighted points: Critical 25, High 12, Medium 6 and Low 2, capped at 100. Duplicate rule IDs are counted once. Final labels also consider the highest-severity findings. Informational observations do not increase the score.

What is not assessed

The scanner does not execute agent code, fetch URLs, inspect a live browser session, prove runtime authorization, test infrastructure remotely or certify compliance.