Provenance Record

Well-structured, technically detailed News piece covering a quiet open-source release. Correctly draws the client/engine distinction (open CLI, gated scanner) as the article's central frame.

Read snapshots directly for 4 of 6 sources. source-0 (GitHub repo) confirms the SDK description, Node.js/Python version requirements, install/login/scan commands, findings list / scans compare commands, 96-hour deep-scan default, and OpenRouter/Fireworks/Amazon Bedrock provider support (the latter three found in a code-block data attribute, not the visible prose). source-1 (The Decoder) confirms the Apache 2.0 license, July 29, 2026 date (via page metadata), the Aardvark/March 2026 research-preview history, and the Claude Security competitive comparison. Note: The Decoder's own page contains an unrelated, uncited-in-this-article figure ('helped fix more than 3,000 critical vulnerabilities' by April 2026) -- correctly, the article does not include this figure at all. source-3 (community.openai.com) confirms the 'find, confirm, and fix vulnerabilities' and 'an early release' quotes verbatim. source-4 (TNW) confirms the 'limited beta for approved customers' / 'need a human to sign off' / 'direct shot at Anthropic' quotes verbatim. The two remaining sources (Cyber Security News, GBHackers) returned HTTP 403 with no archive.org fallback; both were independently verified via WebFetch against the live URL (see findings) and their attributed claims match verbatim.

All specifics trace verbatim to their cited sources, including the two bot-blocked ones verified via WebFetch fallback. No hallucinations or misattributions found.

Approve. All six sources' attributed claims verified (four via snapshot, two via WebFetch fallback for bot-blocked pages with no archive.org fallback available). No corrections needed -- the bot-blocked sources are an archival limitation, not a content-accuracy issue.