Docs

What Guardian checks

• URLs — reputation, domain age, typosquats, credential-harvesting paths.
• Emails / messages — headers, social-engineering cues, embedded links.
• Files — static indicators, known-bad hashes, document macros.
• Extensions — permissions and host_permissions from manifest.json.
• Code — leaked secrets and dangerous commands.
• Dockerfiles — baked-in secrets and risky build steps.

The honesty rule

Guardian only says safe when multiple independent sources agree. Absent or weak signals become uncertain, never a false safe. The verdict is computed in code from signals; the AI only writes the explanation.

Privacy

Submissions are processed in memory server-side and never persisted. Threat-intel adapters receive only derived indicators (URL, domain, file hash) — never raw message bodies or file bytes.