Guides
Short, practical guides on the questions people actually ask before trusting an unfamiliar repository: is it safe, is it maintained, and what is it really doing? Written to be useful whether or not you use the scanner.
What to check before you install, run, or depend on a public repository: install-time scripts, the dependency surface, maintenance, licence, and the security signals that actually mean something.
A reading order that gets you to a working mental model in about ten minutes: README, manifest, folder structure, entry point, and tests, without reading the whole codebase.
Prompts that get useful answers about an unfamiliar repository, in the order to ask them, and how to spot when an assistant is inventing the answer rather than reading the code.
More guides are planned, including how to tell whether a project is still maintained and which AI prompts get useful answers about an unfamiliar codebase.