No package execution
Static analysis extracts and inspects published artifacts without launching extension entrypoints, lifecycle scripts, or embedded binaries.
Trust requires explicit boundaries.
The product processes intelligence about privileged developer tooling. Its own architecture, disclosure process, and claims must withstand the same scrutiny.
Exact identity
Reports retain registry source, version, artifact SHA-256, ruleset, provider coverage, and limitations.
Evidence boundaries
Severity, evidence class, analysis coverage, and benchmark limits remain visible so a result is never presented as a guarantee.
Vulnerability disclosure
Found a security issue?
Do not include secrets or exploit users. Contact the GUARDRAILS team through your established support channel with reproduction details, affected component, and impact.