User guide

TrueTag reviews a repository, uploaded archive, or live URL across six lenses — security, privacy, accessibility, AI risk, legal readiness, and deployment configuration — and returns scoped, confidence-scored findings with exact remediation.

It identifies common launch risks within a disclosed scope. It does not certify that an application is secure, accessible, or legally compliant, and it does not replace penetration testing, professional accessibility testing, or legal advice.

“No findings” means no configured rule matched — it is not proof of safety. See the public rule catalog for every check that can fire.

Three sources, all read-only — TrueTag never executes your code:

GitHub App — Install the TrueTag GitHub App on selected repositories (Settings → integrations, step-up MFA required). Scans use short-lived, just-in-time installation tokens pinned to an immutable commit SHA.

Archive upload — Upload a ZIP. It is stored encrypted for at most 24 hours, extracted with strict path/size/symlink/zip-bomb controls, scanned, and the working copy is deleted immediately afterward.

Live URL — Provide a public URL. Probes are DNS-pinned, SSRF-guarded, GET/HEAD only, and never perform destructive testing.

Start a scan from the project page. Open Findings to triage. Each finding shows: rule id + version, category, severity, an independent confidence, redacted evidence, exact location, remediation steps, standards mappings (CWE/OWASP/GHSA/WCAG), and a paste-ready fix prompt for Claude Code, Cursor, Lovable, Bolt, Replit, Windsurf, Codex, or a generic assistant.

Severity and confidence are separate dimensions. Only rules from stable families can mark a finding as launch-blocking; heuristic rules are advisory.

Triage actions: mark in progress, dismiss with a reason, or accept the risk (with an approver and expiry; critical risks require step-up MFA). Export PDF, HTML, JSON, or a CycloneDX SBOM from Reports. Share links can expire, require a passcode, and are watermarked.

Customer code is never used to train models. Detected secrets are redacted before storage and are never logged, reported, or sent to a model provider.

Optional LLM explanations receive only the deterministic finding summary — never your raw code or artifacts.