Documentation

Everything ARC AI Security Scanner checks, how it scores, and what it does with your data. If a finding surprised you, the rule behind it is on this page.

How the score is calculated

This is a defensive configuration review score based only on the text you submitted. It reflects whether documented controls are present in the description. It does not test your running system, and a high score is explicitly not evidence that your application is secure.

Each dimension starts at 100. Findings deduct a fixed penalty by severity: critical −30, high −18, medium −9, low −4, info −0. Dimension scores are combined as a weighted average. Bands: 80+ strong, 60–79 adequate, 40–59 at risk, below 40 critical.

Dimension	Weight	What it measures
Instruction Boundary	3	Starts at 100. Deducts where retrieved or user-supplied content enters the same channel as system instructions with no delimiter, no untrusted-data labeling, and no output constraint.
Tool Permissions	3	Starts at 100. Deducts for each tool the model can invoke that performs a write, a spend, an external send, or a state change with no approval gate.
Retrieval Exposure	3	Starts at 100. Deducts where the retrieval corpus is not access-filtered per requesting user, where documents carry no provenance, and where retrieved text is treated as trusted.
Secrets & Config Hygiene	2	Starts at 100. Deducts for credentials in prompts, client-exposed provider keys, shared environment secrets across stages, and long-lived static tokens.
Logging & Monitoring	2	Starts at 100. Deducts where model calls, tool invocations, and refusals are not logged, and where logs capture raw sensitive input.
Egress & SSRF	1	Starts at 100. Deducts where the system fetches user-supplied URLs, has no outbound allowlist, or lets model output determine a network destination.

What the score is not

Proof that your application is secure
A penetration test, red-team exercise, or runtime assessment
A certification or attestation of any kind
Verification that the controls you described are correctly implemented
A complete list of your vulnerabilities

Rule catalog (v0.2.0)

19 deterministic rules. No network, no model, no randomness — the same input always produces the same findings. Rule ids are permanent; a rule whose meaning changes gets a new id.

boundary

SEC-BOUNDARY-001secure
Retrieved content shares a channel with system instructions
Wrap untrusted content in an explicit envelope, label it as data, and constrain the output schema. Treat the wrapper as necessary but not sufficient — pair it with removing tool authority.
SEC-BOUNDARY-002secure
No output constraint on model responses
Require structured output validated against a schema, and treat validation failure as an error rather than something to repair.
SEC-BOUNDARY-003secure
No untrusted-data labeling or delimiter language
Introduce a delimiter and an untrusted-data label around every retrieved or user-supplied block. Do not rely on prose instructions alone.
SEC-BOUNDARY-004secure
Output rendered as HTML without sanitization
Never insert model output into the DOM as HTML. Render as text, or sanitize with a vetted HTML sanitizer and a strict allowlist of tags.

toolperm

SEC-TOOLPERM-001secure
Model can invoke a state-changing tool with no approval
Remove the capability, or gate it behind human approval. A model that can only read cannot be used to act on an attacker's behalf.
SEC-TOOLPERM-002secure
Model can execute arbitrary queries or code
Replace with parameterized, enumerated operations. If execution is genuinely required, run it in an isolated sandbox with a least-privilege credential and no network.
SEC-TOOLPERM-003secure
MCP or tools exposed without an allowlist
Publish an explicit tool allowlist per agent. Do not expose every MCP tool by default; deny by default and add only what the purpose requires.

rag

SEC-RAG-001secure
Retrieval corpus is not filtered per requesting user
Filter at retrieval by the requesting user's actual entitlements. Post-hoc filtering of model output is not a control — by then the content has already been read.
SEC-RAG-002secure
Retrieved documents carry no provenance
Carry document identity and version through retrieval into the response. Provenance is the difference between an answer and a citation.
SEC-RAG-003secure
Retrieved text treated as trusted instructions
Treat retrieved text as untrusted data, never as instructions. Put it in a labeled envelope and instruct the model that it must not follow directives found inside.
SEC-RAG-004secure
User uploads mixed into the retrieval corpus without quarantine
Quarantine and review uploads before indexing. Separate tenant corpora and apply the same ACL filter at retrieval that your product enforces elsewhere.

secrets

SEC-SECRETS-001secure
Provider credential exposed to the browser
Move the call server-side. Rotate the key immediately — assume it is already compromised.
SEC-SECRETS-002secure
Credentials present in prompt or configuration text
Move to a secret manager and reference at call time. Rotate anything that has been in a prompt.
SEC-SECRETS-003secure
Long-lived static tokens or secrets shared across environments
Use short-lived, environment-scoped credentials with rotation. Never reuse production secrets in staging or local development.

observability

SEC-OBSERVABILITY-001secure
Model and tool calls are not logged
Log call metadata, tool invocations and refusals durably, with input redacted. Refusals in particular are your earliest signal that something is probing the system.
SEC-OBSERVABILITY-002secure
Logs capture raw sensitive input or PII
Redact secrets and PII before logging. Prefer hashes and metadata over raw prompts; retain only what incident response actually needs.
SEC-OBSERVABILITY-003secure
No alerting or review of refusals and anomalies
Alert on refusal spikes, novel tool sequences, and egress anomalies. Assign an owner who reviews those signals on a defined cadence.

egress

SEC-EGRESS-001secure
System fetches user-supplied URLs
Use an outbound allowlist, resolve and validate the address before connecting, block private ranges and link-local addresses, and do not follow redirects blindly.
SEC-EGRESS-002secure
Model output determines network destination without allowlist
Never let model output choose a network destination. Map intents to a fixed allowlist of hosts, or require a human to confirm the target.

API

Everything the web UI does is available over HTTP. No key, no account. Please keep it to a few requests a minute — the rate limiter will tell you if you do not.

POST /api/assess
Content-Type: application/json

{
  "text": "your description here (40–40,000 characters)",
  "context": { "industry": "logistics" },
  "useModel": false
}

→ 200 AssessmentResult   (findings, evidence, score, recommendations, blueprint, limitations)
→ 400 { "error": "..." }   input failed validation
→ 429 { "error": "..." }   rate limited

GET /api/rules    the catalog above, as JSON
GET /api/health   { status, version, rulePackVersion, ruleCount }

Data policy

The text you submit is processed in the request and discarded when the response is sent. It is not written to a database, not used for training, and not sent to a model provider unless you explicitly opt in to the optional narrative pass. Errors are logged with the content redacted.

Email is collected only if you ask for a copy of a report. Assessment never requires it. The full policy is in docs/05-data-policy.md.

Everything else

The complete build package — product brief, PRD, architecture, threat model, evaluation plan, runbook — is in the repository. The roadmap is public and the issue tracker is open.