Chapter 1

Public URL scope

A public scan observes responses available from the submitted target. It can inspect reachable pages, response headers, public assets and browser visible behavior within strict limits.

01
Confirm the canonical target
Open the exact public host and path you intend to release. Follow redirects and record the final destination before using the evidence.
02
List the reachable surfaces
Review the primary document, reachable public pages, loaded assets, response headers and browser visible behavior. These are the surfaces a public scan can observe.
03
Record the observation boundary
Keep the normalized target, scan time and public mode with the report. A later release, private route or different host is outside this evidence boundary.

Public evidence boundary

Every item describes evidence available without signing in. It does not describe hidden application state.

Example

Observed
Primary document response
Publicly reachable pages and assets
Response headers
Browser visible behavior

Check before continuing

Public response evidence
Reachable pages and assets
No proof about hidden systems

Chapter 2

Repository and backend scope

A repository connection is separate, explicit and read only. It can add bounded configuration and source derived evidence. Customer code is never executed in the control plane.

01
Connect the intended revision
Select the organization, repository and exact branch or revision that produced the release. A different revision cannot support conclusions about the deployed application.
02
Review the access boundary
Confirm that the provider permission is read only and limited to the intended repository. Remove organization wide or unused access before the snapshot begins.
03
Authorize backend checks separately
Read the stated target, method and limits for every backend check. Start it only when the authorization covers that exact action and environment.

Three separate evidence sources

Access to one source never grants access to another. Each source keeps its own scope and authorization.

Example

Public URL        automatic public evidence
Repository        explicit read only snapshot
Backend checks    separate authorized scope

Check before continuing

Connect the intended revision
Review provider permissions
Disconnect unused access

Chapter 3

Unknown remains unknown

A URL cannot prove database policy correctness, historical secret absence or authenticated workflow safety. Those areas require their own authorized evidence and often qualified manual review.

01
Find every unknown area
Read the report coverage and identify conclusions that the current evidence cannot support. Keep them visible instead of treating missing evidence as a pass.
02
Choose the missing evidence
Decide whether a repository snapshot, an explicitly authorized backend check or a manual review could answer the question. Do not expand scope silently.
03
Escalate sensitive flows
Use qualified manual review for authentication, authorization, payments, sensitive data flows and destructive scenarios. Record that review as a separate decision source.

Unsupported conclusions from a URL

Unknown states are useful. They show exactly where another evidence source or reviewer is required.

Example

Database policy correctness    Unknown
Historic secret absence        Unknown
Authenticated role checks      Unknown
Private business logic         Unknown

Check before continuing

Missing coverage is never passed
Active checks need separate authorization
Stop when scope is unclear

Chapter 1

Public URL scope

A public scan observes responses available from the submitted target. It can inspect reachable pages, response headers, public assets and browser visible behavior within strict limits.

01
Confirm the canonical target
Open the exact public host and path you intend to release. Follow redirects and record the final destination before using the evidence.
02
List the reachable surfaces
Review the primary document, reachable public pages, loaded assets, response headers and browser visible behavior. These are the surfaces a public scan can observe.
03
Record the observation boundary
Keep the normalized target, scan time and public mode with the report. A later release, private route or different host is outside this evidence boundary.

Public evidence boundary

Every item describes evidence available without signing in. It does not describe hidden application state.

Example

Observed
Primary document response
Publicly reachable pages and assets
Response headers
Browser visible behavior

Check before continuing

Public response evidence
Reachable pages and assets
No proof about hidden systems

Chapter 2

Repository and backend scope

A repository connection is separate, explicit and read only. It can add bounded configuration and source derived evidence. Customer code is never executed in the control plane.

01
Connect the intended revision
Select the organization, repository and exact branch or revision that produced the release. A different revision cannot support conclusions about the deployed application.
02
Review the access boundary
Confirm that the provider permission is read only and limited to the intended repository. Remove organization wide or unused access before the snapshot begins.
03
Authorize backend checks separately
Read the stated target, method and limits for every backend check. Start it only when the authorization covers that exact action and environment.

Three separate evidence sources

Access to one source never grants access to another. Each source keeps its own scope and authorization.

Example

Public URL        automatic public evidence
Repository        explicit read only snapshot
Backend checks    separate authorized scope

Check before continuing

Connect the intended revision
Review provider permissions
Disconnect unused access

Chapter 3

Unknown remains unknown

A URL cannot prove database policy correctness, historical secret absence or authenticated workflow safety. Those areas require their own authorized evidence and often qualified manual review.

01
Find every unknown area
Read the report coverage and identify conclusions that the current evidence cannot support. Keep them visible instead of treating missing evidence as a pass.
02
Choose the missing evidence
Decide whether a repository snapshot, an explicitly authorized backend check or a manual review could answer the question. Do not expand scope silently.
03
Escalate sensitive flows
Use qualified manual review for authentication, authorization, payments, sensitive data flows and destructive scenarios. Record that review as a separate decision source.

Unsupported conclusions from a URL

Unknown states are useful. They show exactly where another evidence source or reviewer is required.

Example

Database policy correctness    Unknown
Historic secret absence        Unknown
Authenticated role checks      Unknown
Private business logic         Unknown

Check before continuing

Missing coverage is never passed
Active checks need separate authorization
Stop when scope is unclear

Scan scope

What you will do in this guide.

Public URL scope

Confirm the canonical target

List the reachable surfaces

Record the observation boundary

Check before continuing

Repository and backend scope

Connect the intended revision

Review the access boundary

Authorize backend checks separately

Check before continuing

Unknown remains unknown

Find every unknown area

Choose the missing evidence

Escalate sensitive flows

Check before continuing

Collect evidence from a real URL.

Preparing the page

Scan scope

What you will do in this guide.

Public URL scope

Confirm the canonical target

List the reachable surfaces

Record the observation boundary

Check before continuing

Repository and backend scope

Connect the intended revision

Review the access boundary

Authorize backend checks separately

Check before continuing

Unknown remains unknown

Find every unknown area

Choose the missing evidence

Escalate sensitive flows

Check before continuing

Collect evidence from a real URL.

What you will do in this guide.

Confirm the canonical target

List the reachable surfaces

Record the observation boundary

Check before continuing

Connect the intended revision

Review the access boundary

Authorize backend checks separately

Check before continuing

Find every unknown area

Choose the missing evidence

Escalate sensitive flows

Check before continuing

Useful next guides.

Collect evidence from a real URL.

Preparing the page

What you will do in this guide.

Confirm the canonical target

List the reachable surfaces

Record the observation boundary

Check before continuing

Connect the intended revision

Review the access boundary

Authorize backend checks separately

Check before continuing

Find every unknown area

Choose the missing evidence

Escalate sensitive flows

Check before continuing

Useful next guides.

Collect evidence from a real URL.