What it checks
- What the file really is — read from its own bytes, not its name. A PNG called
.jpgis reported as a PNG. - Images — dimensions, megapixels against our processing limit, transparency, and whether the file is animated.
- PDFs — version, encryption, a missing end-of-file marker (the classic truncation), page count, and whether the pages carry a real text layer or are scans that need OCR.
- Data files — CSV delimiter and column count, whether JSON actually parses, and a UTF-8 byte-order mark.
Why every finding shows its evidence
Each statement in the report names the thing that produced it — a byte range, an inspection field, a PDF page. That is a deliberate constraint, not decoration: our contract validator refuses to display a finding that has no evidence reference, so the report cannot drift into confident narration. If the validator rejects a report, you get an explicit "report withheld" message instead of a plausible guess.
Where the AI is
Today: nowhere, and the page says so. The diagnosis is deterministic parsing, which is why it works offline, costs nothing and never uploads your file. The contracts, the evidence rules and the validator are already in place so an explanation layer can be added later without becoming the source of truth — the reasoning is written down in our AI methodology.
What it will not tell you
It makes no security claim: we read structure, not behaviour, so nothing here means a file is safe to open. We sample headers, PDF structure and the first pages rather than every byte, and we can only report what a file's own bytes say — not whether some other program will accept it.