One rule shapes the whole system
No single part ever holds your raw file and a way to reach the internet at the same time.
Three zones that don’t overlap
The component that can see your untrusted file can’t phone home, and the component that can reach the network never sees your file.
Fetcher
network · target onlyResolves and downloads a URL you submitted, with guards against being tricked into reaching internal addresses. It sees links, never the analysis.
Analyzer
network · noneOpens and reads your archive inside a sealed container — read-only, unprivileged, resource-capped, no network at all. Bytes go in; a list of findings comes out. Nothing else crosses the wall.
Triage
network · model API onlyAn optional layer that reads short excerpts to add context. It can only raise a concern — never hide or downgrade one — and never sees a whole file.
Principles that don’t bend
Read, not run
Static analysis only. The analyzer runs with the network switched off — not filtered, absent.
Rules decide the verdict
Deterministic rules set the outcome. The AI layer may annotate, never overrule — repo content is assumed hostile.
Hashes, not source
We keep a content fingerprint and the findings. No column anywhere holds your source; short evidence snippets are the only exception.
Same content, same result
Identical content always produces the same result — which is what makes the cache below trustworthy.