1. Define and verify the scope
The owner selects a GitHub repository or declares a domain. Repository access is limited to the choices made in GitHub. Before any active check of a domain, proof of ownership or authorization is required.
2. Observe before exploring
The diagnostic starts with the least intrusive sources: public configuration, TLS, DNS, email, dependencies, secrets and static analysis. These results then guide the deeper authorized checks.
3. Qualify and explain findings
Each finding separates the observation, the possible consequence, the severity and the proposed fix. When a result depends on an assumption, that assumption must remain visible. Findings are grouped so that a single issue does not appear as several independent alerts.
4. Report without giving a false guarantee
The report states the date, the scope and the checks performed. An analysis is a partial snapshot: it is neither a regulatory certification nor a guarantee that no vulnerability exists. Untested areas remain identified as such.