Never claim something is safe
We report what was found, not what wasn't. A checker that says "safe" is making a promise it cannot keep. When nothing known-bad turns up we say precisely that, and say it is not the same claim.
That framing is wrong, and it is useful to the people running it. Someone who feels stupid does not report it, does not warn their family, and does not call their bank inside the narrow window where the money can still be recalled. We build for the hours before that.
Organised fraud is industrial. It is run at scale by people who are good at it, and increasingly it is run with the same models the rest of the software industry is excited about — faster, cheaper, and in the voice of someone you know.
What an ordinary person has to defend themselves with is poor. Bank warnings are generic. Carrier filters are invisible. The advice is mostly "be careful", which is not a capability. A person should be able to ask a direct question about a specific message and get a direct, explained answer — and should be able to ask it for free, at midnight, without an account.
Four commitments that hold across every product, not just the first one.
We report what was found, not what wasn't. A checker that says "safe" is making a promise it cannot keep. When nothing known-bad turns up we say precisely that, and say it is not the same claim.
The core of what we build works anonymously and free. Monetisation sits strictly outside the emergency.
The default reader is not technical, may be seventy-eight, and may be frightened. That sets reading level, type size, and tone from the start — a specification, not an accessibility pass bolted on at the end.
Behaviour is measured in shadow before it reaches anyone. Decisions are appended to a ledger that is never rewritten, including the ones that record a mistake.
docs/decisions.md · observation windows · execution_purpose derivation
A session once probed a system without credentials, received nothing back, and reported that the system could not be secured. It could. The probe had only proved something about the probe.
That is on the permanent record, in the same ledger as everything else: an unauthenticated view of a system is evidence about the view, not about the system. A record that only contains the flattering entries is not a record.