Capabilities
Choose the surface you need to understand. Coverage is described by target and maturity, rather than a promise to inspect everything.
Inspect source and configuration posture, manifests, permissions, transport settings, dependencies, secrets indicators, and release configuration. Findings carry evidence and remediation context; rule coverage has explicit limits.
Review repository structure, Info.plist, ATS, entitlements, source indicators, and dependency manifests. This is source and configuration analysis, not a certification of the running application.
Inspect packaged metadata, discover strings-based indicators, and review supported source-to-artifact parity. Deep DEX or Mach-O reverse engineering and signing trust validation are outside the current scope.
Evaluate policy thresholds, retain baseline and suppression context, and export canonical JSON or SARIF. Teams can inspect the disposition behind a release decision.
Instrument supported bytecode, collect native and framework evidence, and apply policy-controlled responses. Periodic detection and rewritten call sites do not contain arbitrary injected code. Public distribution is pending.