Methodology
The conclusion should never be stronger than the evidence.
SafeForProd separates observation, authorized validation, and expert judgment. Reports and editorial guidance use the same rule: show the source, state the scope, and keep uncertainty visible.
Published 2026-07-20 · Material revisions are recorded below
Testing follows the access level
Free passive scan
Retrieves the submitted page and its referenced public assets, then inspects public response headers, source exposure, browser-visible configuration, and page-load signals. It does not explore unreferenced paths or call discovered services.
Authorized source scan
This planned product begins only after account creation, written authorization, source intake, and domain verification. It will combine source analysis with bounded, non-destructive runtime checks inside the recorded scope.
Human security review
A senior security engineer reviews the agreed high-risk code and workflows, validates material findings, explains tradeoffs, and signs a report limited to the written scope.
Result state is not severity
Severity describes potential impact. Confidence describes confidence in the assessment. Result state describes what the evidence establishes.
- Confirmed
- Reproducible evidence inside the approved scope establishes that the condition exists.
- Needs verification
- A credible signal exists, but current access or scope cannot establish the security outcome.
- Informational
- Useful context or hardening guidance without a demonstrated vulnerability.
- Not tested
- The control was outside scope or was not exercised. This is not a passing result.
Credential classification is provider-aware
A value in public JavaScript is not automatically a leaked secret. Some identifiers and keys are designed to be publishable. SafeForProd considers provider documentation, key class, public location, and available evidence before assigning a result state.
The free scan never uses a discovered credential to test access. If role or validity cannot be established from public evidence, the report says Needs verification and describes a safe owner-side check.
Editorial process
- Technical claims are checked against primary vendor documentation, standards, or reproducible examples.
- Hypothetical examples are labeled. Customer stories, scan counts, and first-person anecdotes are not invented.
- Every guide explains what the free scan can observe, what requires authorization, and what remains outside scope.
- Public pages and reports are reviewed by a human before publication. Nothing auto-publishes.
- Material corrections update the page date and revision history rather than silently rewriting the claim.
Corrections and questions
Send a reproducible correction or methodology question to hello@safeforprod.com. Include the page URL, the disputed claim, and a primary source when possible.