Guardian questions and answers

It reviews a mobile project on your machine for security risk, release-compliance gaps and missing release evidence, then turns that into a release decision you can explain to someone else.

A local Python analysis engine and a command-line interface. Project detection, scanning, the release check and reports in five formats are all part of the CLI. The macOS application is completing distribution verification and is not downloadable.

Flutter, native iOS and native Android. Which checks apply depends on your project structure and configuration, and Guardian reports the ones that did not run rather than skipping them silently.

Confirm the CLI responds, point it at a project directory, run detection, then run a release check and generate an HTML report. The whole sequence is four commands.

No. A scan reads a directory that is already on your machine and writes its output there too. There is no upload step, and no account is involved.

Yes for local analysis — the scan command’s own help states that scans never use the network. Anything that depends on external data, such as advisory information, is only as current as the data on your machine.

No. Normal scanning needs no database connection at all, and Guardian should never ask you for production credentials or production data.

No. Signing certificates, provisioning profiles and signing keys stay in your environment and are outside any sharing contract, present or planned.

The CLI ships a binary-analysis command group, so artefact analysis exists as a surface, but its per-check behaviour has not been verified for publication. Any artefact you analyse stays on your machine.

Read it first. A report can contain file paths and project structure. Share the specific findings a reviewer needs rather than forwarding the whole file, and apply your own retention policy to what you keep.

Source analysis reads the project as written. Binary analysis inspects the artefact you are about to ship. Dynamic analysis observes the application while it runs. Guardian’s verified surface today is source and configuration analysis.

No. The command group exists, but it has not been fully tested and its prerequisites are not documented. Treat any output as exploratory, and do not build a release gate on it.

Text, JSON, SARIF, GitLab and HTML. Text for the terminal, HTML for people, JSON for your own tooling, SARIF and GitLab for code-scanning systems that already understand them.

A baseline is a saved set of findings you have already accepted. Comparing against it separates what is new in this change from the backlog that already existed, so a team can adopt Guardian without fixing everything first.

Used with a baseline, it makes the scan fail on findings that were not in the baseline, rather than on the existing backlog. It is the flag that makes a gate adoptable on an established codebase.

It reflects the analyzers that ran, the evidence available and the policy you configured — nothing more. Incomplete coverage is reported as incomplete and never counted as a pass.

Each documented check lists the situations where it can be wrong, so you can judge a finding in context. A baseline is the supported way to carry accepted findings forward today.

No. It also does not replace platform review, human security review, QA execution, or legal and regulatory advice. It makes the routine, repeatable checks cheap so that expert time goes to the parts that need it.

Yes — inside your own runner, as the same CLI your pipeline invokes. Nothing is sent to a Guardian service. Templates are provided for shell, GitHub Actions, GitLab CI, Bitrise and Jenkins.

Not yet. Its distribution build is completing signing, notarization and Gatekeeper verification, and we publish it once those pass rather than shipping something you have to click past a warning to open.

They are separate products, with separate repositories, deployments and databases. A future optional integration could pass approved, sanitized findings — never source, builds, secrets or raw reports.

Yes. Guardian is independently useful, and nothing about it requires understanding or using another product.

The release status page carries the current state of the CLI, the macOS distribution and the documentation, along with the known high-level limitations.