Know the scope.

We request supported public pages, response headers, DNS records and TLS information. A fresh browser session observes JavaScript, cookies and tracking requests before interaction. We do not sign in, submit forms or exploit findings in this review.

Each scan has request and time limits. Bot challenges, network failures and exhausted limits can leave checks unverified. If a security check cannot finish, the security assessment is provisional. Its observed score remains separate from a final grade.

Privacy and Trust show their own unverified counts. Zero findings does not mean those checks passed. A public review cannot assess private application logic, authorization, stored data or infrastructure behind the public interface.

The configured application profile compares expected access to declared GET/JSON resources across synthetic roles and tenants. It requires verified domain control, explicit consent and fresh, short-lived test sessions. Resources must be declared safe to read; the HTTP method alone does not establish that.

The result covers those resources, sessions, environment and any recorded commit/deployment binding. Expired or unavailable sessions cannot establish an authorization result. Missing evidence is kept visible, and revoked authorization prevents the affected review from continuing as an authorized run.

This profile performs no write operations or automated login. It is not a universal DAST engine, business-logic review or penetration test. A code review and an application retest remain separate observations even when they reference the same commit.