Known Gaps

The runner writes deterministic per-model findings.jsonl files and a top-level run findings.jsonl after report compilation.

lib/scoring.js implements vulnerability priority scoring. Web real-runs also persist scorecards derived from actual Hunt/Validate findings and token-cost evidence.

The web real-run path executes bounded passive recon plus AI Gateway Hunt/Validate work. The original CLI still supports supervised prompt-package operation.

validateScope rejects mismatched base URLs, disallowed hosts, private/link-local/metadata hosts outside lab mode, and non-http(s) targets before web dry-runs, real-runs, and reruns proceed.

The original CLI remains a supervised local operator workflow. It validates config and warns on trust boundaries, while active network controls stay in web/API scope validation and approved sandbox/job policy.

Docs, Sheets, and Files publishing can use the server-side PLATPHORM_API_KEY only as a downstream credential. Browser-triggered delivery still needs explicit operator auth and downstream confirmation before it claims success.

PLATPHORM_API_KEY is configured server-side. It enables protected downstream sends from the deployment without exposing the raw key to the browser.

Real run creation is gated by PLATPHORM_API_KEY, responsible-use acceptance, scope validation, and typed AUTHORIZED confirmation. With AI Gateway credentials present, the run performs bounded passive recon, model Hunt/Validate work, finding persistence, and scorecard derivation.