A scan is a review, not a guarantee
Produra inspects supported source patterns and saves evidence for review. This hosted beta provides ZIP source scans, saved reports, comparisons and editor review packets. It does not offer guided AI review, GitHub import, retained-source repairs or application verification. Unsupported frameworks, dynamic behavior and deployment settings can leave gaps. No findings does not mean no vulnerabilities.
Different evidence, different meaning
A source finding is a code observation that needs review. A source comparison records changes in comparable inspected evidence; it does not establish that a bug was fixed or that application behavior is safe. The hosted beta does not produce runtime verification results or certify an application. Read each report’s coverage and untested scope.
How project code is handled
Uploads are private in Supabase and processed by the hosted source scanner on Render. The scanner checks archive paths and size limits, verifies accepted source identity and uses bounded static parsing. It does not run uploaded applications, dependency scripts, build commands or tests. These protections reduce risk; separate tasks and processing limits do not establish immunity to malicious input or runtime vulnerabilities.
Before applying a fix
Use the saved evidence and editor review packet to inspect the original files. Confirm intended permissions and behavior, preserve a backup, review third-party license obligations and test changes in your own appropriate environment. Produra does not edit, merge or deploy your project from this hosted beta.
Sharing and control
Starting a scan shares your ZIP with the hosted processors described in our Privacy notice. Guided AI review is off. Copying evidence to an editor can involve that editor’s model provider and permission settings. Your workspace shows the source scan allowance available to you. Scheduled maintenance handles eligible source and report cleanup; failures can delay deletion.
Responsible disclosure
A public security reporting channel, incident-response ownership and response targets remain pending. During this limited beta, contact the operator who provided access and share only minimal, non-sensitive reproduction details. This page does not authorize unsolicited testing.