Docs / Scanning

Validation

Discovered credentials are checked read-only against live provider APIs. Results are stored with evidence and drive the decision engine — so the queue starts with confirmed-active exposures.

Providers

Provider	Read-only check
GitHub	GET /user
AWS	STS GetCallerIdentity
Stripe	read-only charges list
Azure	AD token endpoint

Categories & outcomes

Validation categories: FULL · PARTIAL · STRUCTURAL · CONTEXT. SSH keys and certificates receive structural (format-only) validation; database URIs get partial checks.

LIVE_VALIDDEAD_INVALIDPARTIAL_CONFIDENCEUNVERIFIED

Correlation engine

Multi-component secrets are assembled before validation — an AWS access key ID found in one file is paired with its secret access key found elsewhere, so validation tests the real credential, not a fragment.

Triggering

POST /agent/findings/{id}/validate
# or run the full agent loop:
POST /agent/run/new

Validator credentials (e.g. AWS) are optional dependencies — without them, findings resolve as UNVERIFIED rather than failing. The validator registry is pluggable; new providers register against the same interface.

Source: tools/ (validators) · domains/validation/ · PRODUCT_ANALYSIS §5.1

← Findings & workflow Privacy scanning →