Know what
was actually checked.

A real observation for every finding.

Shipvra Scan requests your public URL and a bounded set of same-origin resources. It validates the resolved network address, pins each connection to a validated IP, checks TLS during connection, and follows validated redirects. Rules inspect response headers, HTML, and public configuration signatures. A versioned axe-core pass checks supported semantic HTML and ARIA rules in a disposable worker. Target scripts and external resource loading remain disabled. Raw response bodies and cookie values are not retained as evidence.

The score follows the evidence.

Each category starts at 100. A finding subtracts a rounded penalty: severity × confidence × rule weight / 10. Severity penalties are 22 for critical, 12 for high, 5 for medium, 2 for low, and 0 for informational findings. Confidence multipliers are 1.0, 0.9, 0.65, and 0.35 for confirmed, high, medium, and low.

Overall category weights are Security 28%, Reliability 18%, Performance 14%, Accessibility 12%, SEO 10%, Privacy 8%, and Production Configuration 10%. Scores cannot go below zero. Incomplete assessments withhold the score. A high score is not permission to skip the untested boundaries.

Confidence is not severity.

Severity describes potential impact. Confidence describes the strength of the observation. A missing header can be confirmed directly. An authorization pattern in source code usually requires tracing imported code, database policies, and runtime behavior before a defect can be confirmed.

Ship Contracts and source evidence

Repository inspection reads bounded source files at an immutable commit. It identifies supported framework, authorization, policy, payment, and configuration patterns. Source evidence does not establish exploitability. Repair priorities reflect impact, and unestablished dependencies remain open for engineering review.

A proposed Ship Contract makes launch requirements addressable: business journeys, authentication, authorization, billing, database state, email and deployment behavior where relevant providers are detected. Source discovery does not confirm business intent. These outcomes remain NOT TESTED until appropriate checks execute in an identified environment; contract confirmation and execution are not yet available.

Proof Runs and deployment evidence

Public Proof Runs compare recorded rule outcomes between compatible scans. Source repair validation is unavailable while the isolated runner is hardened. Private deployment evidence records associate a scan and inspected commit with GitHub deployment and check metadata. They preserve remaining findings and tested scope, but do not establish a Verified Build or a complete Verification Receipt. Required-check policies, check publisher authority and legacy commit statuses are not evaluated.

A future application Verification Receipt must identify the commit and environment, store executed evidence and satisfy required Ship Contract assertions and critical journeys. Local and preview results cannot establish production behavior. An opened PR or successful deployment event is not that evidence. Continuous verification remains unavailable.

What remains outside this public scan

Static HTML checks do not execute application JavaScript, measure Core Web Vitals, or prove WCAG compliance. Review authenticated workflows, keyboard behavior, visual contrast, tenant isolation, database permissions, payment processing, monitoring, backups, and incident recovery separately.

Scans do not brute-force credentials, bypass authentication or CAPTCHA, exploit findings, initiate transactions, load-test targets, or modify customer data. A missing finding is not proof that a problem does not exist.