Frequently Asked Questions

Common questions about the scanner capabilities and limitations.

What does the scanner catch?

The underlying static analysis engine parses repositories and raw text for explicit malicious patterns. It catches:
• Prompt Injection: Hidden markdown overrides, DAN patterns, and zero-width obfuscation.
• Exfiltration: Code that attempts to read `.aws/credentials`, SSH keys, or environment variables and transmit them over the network.
• Destructive Actions: Unsafe shell pipes (`curl | sh`), force pushes, and filesystem destruction (`rm -rf`).

What does it NOT catch?

This is a static analysis tool, not a dynamic sandbox. It cannot catch:
• Novel Runtime Behavior: Malware that downloads its payload dynamically at runtime.
• Deep Supply Chain Attacks: A safe repository that installs a compromised package via `npm` or `pip` (unless the package name itself is a known malicious typosquat).

Does it execute the code to test it?

No. The service strictly fetches the code archives and performs deterministic static analysis. The target code is never executed on our infrastructure, guaranteeing safety against zero-day VM escapes.