Trust, measured

Don't take our word for it
— read the measurements.

A published precision/recall table, a fleet-wide time-to-safe split, a plain-language account of what "not checked" means, and the honest boundary of what we do not protect. Every number here is measured, not asserted.

Measured detection accuracy

We run a fixture lab of hand-built, ground-truth-labeled scenarios against our own detection logic on every change, and publish the result. A committed floor value fails the build if a module's measured precision or recall ever regresses.

Measured precision and recall per scanner module, from the committed fixture-lab benchmark artifact
ModuleFixture casesTrue positivesFalse positivesFalse negativesPrecisionRecall
Sensitive Paths13700100%100%
Exposed Keys13800100%100%
Subdomain Takeover11500100%100%
Email security171100100%100%
Honest scope: these numbers measure whether our detection logic correctly classifies a fixed set of hand-built, real-world-shaped scenarios — not how the scanner performs against every possible live website. It's lab-bench classification accuracy, never claimed as an end-to-end or live-network guarantee.

Time to safe, fleet-wide

Two different guarantees, always shown separately — never blended into one self-congratulating number. This is a fleet-wide aggregate across every organisation we protect; we never publish, or even compute for this page, any single customer's own number.

Median time to protected (at edge)

Fleet stats published as we reach statistical significance — 0 of 25 findings measured so far

Median time to fixed (at origin)

Fleet stats published as we reach statistical significance — 0 of 25 findings measured so far

What "not checked" means

Every scan we run publishes a coverage manifest — "X of Y checks ran" — instead of letting a skipped check silently read as a pass. A check can land in one of a few honest states:

Checked, clean
The check ran and found nothing to flag.
Checked, found (and fixed or flagged)
The check ran, found a real issue, and either fixed it automatically or handed you the exact next step.
Checked, evidence attached
Where we can, we keep proof — a captured response, a screenshot — instead of asking you to trust a green result blindly.
Not checked
A data source isn't connected, the check needs a higher plan, or it's temporarily unavailable. We show this out loud instead of letting a skipped check read as "passed".
Not applicable
The check doesn't apply to your stack — e.g. a WordPress-specific check on a site that isn't running WordPress.
Inconclusive
We probed, but the signal wasn't clear enough to call it either way — flagged as inconclusive rather than forced into a false "clean" or a false alarm.

We show "not checked" out loud because a false sense of coverage is more dangerous than an honest gap — you can act on a gap you know about.