Readable in one sitting. No code, no jargon.
What you own
The inventory: what exists, where it runs, what it depends on, and what is in someone else’s account rather than yours.
Claimed versus real
What your documentation claims, checked against what the code actually does — with the file and the line.
Risks, ranked by cost
Ordered by what they would cost the business rather than by technical severity, each with a plain fix.
Where effort should go
And it is dated — so it can be run again in six months and compared, rather than argued about from memory.
Three depths: Sweep (broad, fast, start here) · Deep (priority subsystems) · Continuous, which is Recon rather than a report.
A complete report, on the page, on a codebase of ours.
Open it and read it end to end, with the uncomfortable findings left in. It turns a cold offer into something inspectable before anyone pays — and the honesty is the marketing.
Four commitments, and they are the whole of it.
Read-only access.Scoped to the repositories in question, and revocable by you at any point.
Code never executed.The read is static. Nothing of yours runs on our machines.
Source never kept.The report is the artifact. Your source does not persist with us after it.
Secrets filtered first.Credentials are stripped before anything is analysed — and we tell you which ones we found.
The read finds it. Self-governed build stops it coming back.
Where the product itself lives: productlens.report