What a run actually does
Four stages, 17 gates, and three verdicts — and one honest limit on what a static scan is allowed to conclude.
Point at a repository
A GitHub repository or a local folder. No spec is required and none is written for you — this lane is deliberately spec-free, which is exactly why its output is advisory.
source: github.com/<org>/<repo> | ./local-folderspec: none requiredcost: 3 hosted scans / month on free; $50/mo unlocks unlimited + CIThe three verdicts
No static blocker found.
Readiness guidance, not a release decision. A clear advisory scan still does not authorise a deployment — that takes a run of the exact revision through the signed pipeline.
One or more gates failed.
The report names the gate, the finding, the file where known, and the fastest path back to a fresh scan. No aggregate score is used to bury it.
The scan could not earn a verdict.
Unreadable, empty, or unsupported input keeps this verdict on purpose. A tool that returns green on input it could not read is worse than no tool.
Why there is no green check here
This lane has no approved spec, no executable contract, and no runtime evidence — so it is not entitled to say a release is safe, and the check it posts is built so it cannot. The authoritative SHIP verdict comes from running the exact revision through the signed pipeline, which is a different thing you can also buy, and not what a free scan pretends to be. Run a scan or walk a blocked pull request end to end.