Inspect the method. Understand the limits.
The current product is a local-first diagnostic. This page describes operating boundaries and must not be read as an independent security audit, certification or guarantee.
Local analysis, not hosted monitoring.
The browser diagnostic processes selected files in the browser tab. The CLI and GitHub Action run in the user's local or CI environment. The public website does not provide hosted client workspaces, managed secrets or continuous production monitoring.
Use only data you are authorized to process.
- Prefer synthetic data or explicitly authorized, minimized records.
- Remove secrets and unnecessary personal data before analysis.
- Review every finding in application context.
- Pin GitHub Actions to a reviewed commit SHA for production use.
- Use the tool alongside application tests, idempotency controls, monitoring, reconciliation and human review.
No implied security guarantees.
Outcome Check does not currently provide hosted accounts, role-based access, a hosted evidence store, continuous monitoring, alerting, automatic remediation, independent penetration-test results or formal security/compliance certification. A duplicate-effect finding does not itself prove financial loss; a clean report does not prove that all invariants were modeled correctly.
Agree handling before transferring files.
Before any evaluation involving confidential or personal data, the parties should agree on permitted data, transfer method, access, retention, deliverables and deletion. Appropriate legal and security review may be necessary depending on the data and jurisdiction.