No static blocker found.
Readiness guidance, not a release decision. A clear advisory scan still does not authorise a deployment — that takes a run of the exact revision through the signed pipeline.
Four stages, 17 gates, and three verdicts — and one honest limit on what a static scan is allowed to conclude.
A GitHub repository or a local folder. No spec is required and none is written for you — this lane is deliberately spec-free, which is exactly why its output is advisory.
source: github.com/<org>/<repo> | ./local-folder spec: none required cost: 3 hosted scans / month on free; $50/mo unlocks unlimited + CI
Readiness guidance, not a release decision. A clear advisory scan still does not authorise a deployment — that takes a run of the exact revision through the signed pipeline.
The report names the gate, the finding, the file where known, and the fastest path back to a fresh scan. No aggregate score is used to bury it.
Unreadable, empty, or unsupported input keeps this verdict on purpose. A tool that returns green on input it could not read is worse than no tool.
This lane has no approved spec, no executable contract, and no runtime evidence — so it is not entitled to say a release is safe, and the check it posts is built so it cannot. The authoritative SHIP verdict comes from running the exact revision through the signed pipeline, which is a different thing you can also buy, and not what a free scan pretends to be.