Security coverage and access
Know what an address, repository or database access can establish.
Different access, different evidence
A website address exposes only what an external visitor can reach. Repository access adds code and configuration. Authorized database access can add supported read-only checks; it is not a universal audit of backups or every provider setting.
Limits matter
This reference describes check methods, not results for your platform. Compatibility, scope and access determine actual execution. Intrusive or destructive attacks are not simulated; consult your scan report for completed, unavailable and not-run checks.
Match evidence to the access supplied
A URL allows public-perimeter observations. Repository access allows source and configuration review. Supported authorized database access allows read-only catalog checks. None of these automatically supplies another: a repository does not grant a database session, and a website address does not reveal every internal API.
- Review the target, branch and explicitly supplied live URL.
- Check the selected families and any required access.
- Read the report’s execution states rather than the catalogue’s possible methods.
Understand unavailable and not-run checks
Unavailable can mean incompatible technology or missing permission. Not selected means you excluded the family. Interrupted means the work stopped before intended coverage finished. These states should guide the next action; none should be counted as a successful security test.
Example: selecting Data & access without database access does not prove RLS isolation. Reading a SQL policy is configuration evidence; an owner-approved two-account exercise is a different behavioral test.
What an automated scan cannot certify
Business authorization, complete backup restoration, human process, legal compliance and destructive attack resistance can require access or exercises outside automated scope. Use independent specialist review when the stakes require it. A clean scan means no finding in the reported checks and context, not a guarantee of total safety.
Sources and further reading
These publications describe related practices and standards. They do not certify your platform or imply that Hackaiz executes every documented method.