What the scanner does

Applicable submitted product artifacts are read privately and inspected without executing uploaded PHP or JavaScript. Deterministic checks cover archive readability, unsafe paths, expansion limits, executable/binary payloads, nested archives and suspicious static indicators such as shell execution, encoded payload chains, remote loading and credential theft. Evidence records scanner version, scan time, artifact SHA-256 and sanitized findings.

Understanding results

CLEAR means no configured indicator was found; it is not a guarantee of safety. FLAGGED means findings need human assessment and is not automatic rejection. FAILED means the scan could not complete safely. NOT_RUN means no completed scan evidence is available. Approval is blocked for NOT_RUN or FAILED. CLEAR and FLAGGED remain subject to human review; AI pre-screening is advisory and does not replace that decision.

Author action

Review the specific feedback, document legitimate uses of sensitive functionality and submit corrections through the existing release/review workflow. Do not conceal functionality to evade checks. New artifact content needs evidence for that artifact; an old scan does not certify a replacement. Report suspected unsafe content privately without publishing exploit packages, secrets or purchase codes.