Validation & trust
Credibility from evidence, not from badges.
There are no customer logos, review scores or usage statistics on this page, because none are held with documented permission. What is published instead can be checked: a test record you can reproduce, a documented method, real sample evidence and an explicit list of limits.
It does not invent customer proof. It does not publish a test count that cannot be reproduced. A larger internal validation register is maintained in the private repository; its contents and results are not published here, and no figure from it is claimed on this site.
1 · Test record
The public sandbox suite, test by test.
Five tests, all reproducible from the public repository, covering the boundaries that matter most: the five-domain allowlist, out-of-scope rejection, mandatory consent, hash-chain integrity and command-line enforcement.
Ran 5 tests in 0.031s — OK
Executed 30 October 2026, 14:01 UTC · CPython 3.11.2 on Linux
The log line below is the literal tail of that run. The blocked-target message is expected output from the negative test, not an error.
- Scope of the recordThe five tests in tests/test_sandbox.py plus the recorded assessment output. Nothing else is presented as validated.
- What the tests protectThe restriction is the product. These tests fail if the allowlist widens, if consent becomes optional, or if the hash chain stops chaining.
- What they do not proveThat every control in the private engine behaves correctly, or that any third-party infrastructure was tested. Those claims are not made.
- Roadmap, stated as roadmapExpanding the published suite into a larger regression register is planned work, not completed work.
| Test | Objective | Expected result | Status | Notes |
|---|---|---|---|---|
| T-01 test_exactly_five_public_sandbox_domains_allowed | Prove the allowlist is exactly the five approved public testing domains and that normalisation (scheme, port, path) cannot widen it. | ALLOWED_SANDBOX_DOMAINS equals the five approved names; normalize_sandbox_target('https://<domain>:443/path') returns the bare domain. | Pass | Covers [[:port]] and path stripping. A sixth name cannot be introduced without failing this test. |
| T-02 test_non_sandbox_domains_and_ips_are_blocked | Confirm every out-of-scope target raises SandboxRestrictionError before any network call. | google.com, github.com, sub.example.com, 192.168.1.1, 8.8.8.8, localhost and an empty string all raise SandboxRestrictionError. | Pass | Subdomain look-alikes and raw IPs are covered, not just unrelated domains. |
| T-03 test_scan_requires_explicit_user_consent | Confirm a consent receipt cannot be recorded when the policy was not accepted or no operator identity was supplied. | Both calls raise ConsentRequiredError and no ledger file is written. | Pass | Consent is a precondition of the receipt itself, not a field inside a report. |
| T-04 test_consent_proof_hash_chain_and_sandbox_report | Verify the SHA-256 hash chain links consecutive receipts and that a report embeds the receipt it was authorised by. | Second receipt's prev_receipt_hash equals the first receipt's receipt_sha256; verify_consent_log returns (True, 2); report consent_id matches the receipt. | Pass | This is the tamper-evidence claim in the privacy policy, tested rather than asserted. |
| T-05 test_cli_enforces_sandbox_and_consent | Confirm the command-line surface cannot bypass the runtime restriction. | Blocked domain returns exit code 2; approved domain with consent returns exit code 0. | Pass | The restriction lives in the runtime, so the CLI inherits it rather than implementing its own check. |
2 · Technical methodology
The method is documented, not implied.
Measurement, statuses, scoring weights, grade bands, evidence handling and the boundary of the method are published in full on the methodology page.
What is observed
Public DNS records, mail authentication policy, TLS negotiation, HTTP response headers and protocol-level reachability of defined high-risk ports. Nothing authenticated.
MethodologyHow it is scored
Weighted over conclusive controls: pass full credit, warning partial, fail none, inconclusive excluded. Category weights and grade bands are published.
ScoringThe control catalog
All 22 controls documented with what each evaluates, why it matters, an example of its evidence, and whether the public sandbox actually runs it.
Catalog3 · Sample evidence
A result you can inspect line by line.
The recorded assessment of example.com is published in full: score, grade, eight findings, the evidence behind each one and the metadata of the run.
86 / 100
Evidence, verbatim
Three lines from the recorded run. Copy one and re-run the equivalent query from outside your network.
The recorded run also showed two warnings: missing HSTS and missing Content-Security-Policy. They are published as warnings, not omitted.
4 · Privacy and safety
What the site and the tool each do with data.
This website is static. The sandbox runs on your machine. Neither sells data, and consent is recorded locally before any run.
The website
- No analytics, no advertising pixels, no tracking cookies
- No account, no login, no newsletter list
- Enquiry form fields are used to reply to that enquiry only
- The demo loads static stored data; it never contacts a target
The sandbox
- Five approved domains, enforced before any network request
- Consent receipt written locally, chained by SHA-256
- Read-only checks; no login, no payload, no exploitation
- Reports stay on the machine that produced them
Authorisation is not optional. The full engine is for domains you own or have written permission to assess. The MIT licence on the published code governs the software; it does not grant permission to test third-party infrastructure.
5 · Product limitations
What it cannot establish, written down.
A security product that only describes its strengths is not giving you a usable picture. The limitations page states the boundary of the evidence in plain language.
Structural limits
- No visibility behind authentication or inside the network
- No proof that a weakness is exploitable
- No ability to detect compromise, past or present
- No coverage of people, process or physical security
Honest status of the project
- No published customer base, and none claimed
- No revenue claims, no usage statistics
- Public sandbox is a demonstration edition, not a service
- Assessment capacity is arranged directly and reviewed manually
Reproduce the record, then judge the product.
The test suite and the recorded assessment are both public. That is the point.