Regulation (EU) 2024/2847

Triage findings, then sign off

A machine can tell you a vulnerable function is reachable from your entry point. It cannot tell you whether you are affected, and it must never be recorded as though it had. That judgement is a person's, and the record keeps the two apart on purpose: a hypothesis is what the analysis concluded, a claim is what somebody put their name to.

This page shows the findings in a record you give it and drafts the command that signs one. It cannot sign anything itself. A claim has to land in your append-only store with a date and a name, and a web page able to mint one would make the whole distinction decorative. Nothing you drop here is uploaded.