Turn a security question into a focused investigation.
A hypothesis scan turns a bounded security claim into a focused threat-scan configuration for an authorized repository. Winfunc follows the relevant code and permission paths, records the scan against the submitted question, and returns the resulting evidence without widening into an open-ended audit.
- acme
- /billing-api
- /Hypothesis scans
Can one tenant read another tenant's invoices?
- GET /invoicesscoped by tenantIdroutes/invoices.ts:9
- GET /invoices/:id/pdftenant guard in middlewareroutes/pdf.ts:12
- POST /invoices/searchfilter includes tenantIdroutes/search.ts:20
Security work should end in a decision, not another queue.
Some of the most important risks begin as a question about a business rule, permission boundary, or security guarantee—not as a scanner signature.
- Security question
- evidence trace
- supported conclusion
From scope to an engineering decision.
State the guarantee or concern, provide the relevant repository and application context, identify roles and sensitive flows, and define any environment where scoped testing is permitted.
- Scope01
Translate the question into the code paths and guarantees to inspect
- Investigate02
Trace relevant data, state, roles, and permission checks
- Investigate03
Gather supporting and contradicting evidence
- Review04
Return findings and evidence against the original question with limitations
What your team gets.
- 01A relevant code-path trace
- 02Evidence for and against the question
- 03A conclusion tied to the submitted security question
- The original hypothesis and the scope used to assess it
- A trace of the relevant code paths and security assumptions
- Evidence for and against the hypothesis
- A result tied back to the original question and repository revision
- Limitations, open questions, and recommended next steps
Let developers and security teams direct deep analysis at an application-specific concern without widening every question into a full audit.
Measure it
Track investigation turnaround, findings returned per question, engineering time spent gathering context, and questions that require follow-up evidence.
Scope and limits
A hypothesis scan is bounded by the authorized repository, server-owned branch, submitted question, and available evidence. The absence of a reported finding does not prove the security claim is universally true or false.
Explore connected capabilities
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.