Skip to main content

Assessment deliverables

Code-audit and white-box assessments provide three complementary client deliverables:

  • Artifacts shows proof of work: source files and code regions reviewed, the application surface mapped, each review area, the threat scenarios that guided coverage, and the count of published findings. Full file and connection inventories remain available on demand.
  • Documentation describes the assessed system. System Overview summarizes source coverage and why each part of the system shape matters; Application Architecture maps components and key connections; Security Review summarizes the review focus and threat coverage by application area.
  • Report is the shareable PDF. Its coverage section uses the same source-review and review-area totals shown in Artifacts.

File review status is evidence-based. A file is reviewed only when every source region has a terminal analysis receipt. Excluded, incomplete, partial, and unreviewed files remain distinct so coverage is not overstated.

These surfaces intentionally omit internal identifiers, content hashes, provenance stamps, workflow metadata, prompts, intermediate reasoning, and unconfirmed candidates. Threat scenarios explain what guided coverage; they are not vulnerability claims. Confirmed vulnerabilities appear only in Findings and in the report's findings section.

Review-area records state what source and behavior the audit examined without exposing candidate links, agent metadata, or internal storage identities. Architecture relationships include only customer-readable connections between live concepts.

Each rendered row receives a non-reversible presentation identifier for stable display. Invalidated concepts and relationships with missing endpoints are excluded.

Application Architecture records observed structure, not a security verdict. Security Review labels scenarios as coverage prompts and directs readers to Findings for validated issues. Older assessments retain their empty Artifacts and Documentation states when their stored Project predates this design; this avoids presenting retired data as current evidence.