Four fields in every finding
- Observation: the header, DNS answer, local pattern or admin answer actually seen.
- Risk: why that condition can matter in a realistic misuse path.
- Remediation: the smallest manual next step with testing and rollback.
- Limit: what this check cannot see or prove.
Public mode boundaries
No exploit attempts, brute force, credential attacks, login, hidden-path guessing, private data access or automatic permission changes. Website checks follow only a small number of explicit redirects and block local, private and reserved addresses.
Research basis
The product selection is derived from the supplied self-service cybersecurity database: marketplace distribution, finding-before-paywall, repeatable configuration drift and founder-manageable liability. The research signals demand; it does not prove future revenue.
Scoring
Scores are deterministic triage weights, not CVSS, certification or probability of breach. A passing result can coexist with vulnerabilities outside the tool's narrow scope.