Anything not named in the signed permission is refused.
Two scanners read the full code history. A key proven live is rated High.
Shows the version that fixes each one.
Rules for your language and framework.
Security headers and the content security policy.
Every host the app can reach and what it stores in the browser.
So a fix cannot break the live app.
Crafted inputs run offline through the app's own parsing.
Read-only checks on the accounts that publish your app.
Each unproven item is confirmed or cleared with a reason.
Each finding has its proof and its fix. The report also lists what passed and what was not covered.
Your code is never uploaded to a scanning service.