How a profile is built, how much each claim is worth, and what passive collection cannot see. The full reference is the project README; each section below links to its part of it.
No port scanning, no vulnerability scanning, no credential validation, no authenticated access and no contact with any profiled company's systems. The sources are public by design:
The one exception is the optional hosted Wappalyzer lookup, which asks a third party to fetch a company's public web pages. It is off by default and named rather than hidden inside the word passive.
Every claim carries an Admiralty grade: source reliability A to F and
information credibility 1 to 6, so a reader sees how far to lean on a claim before
reading it: A2 for a DNS record, B3 for a job posting. A claim with no source is rejected when it is constructed,
not caught at review.
Assessments use the ICD 203 estimative ladder and nothing else, and a validator rejects any report that reaches for other probability language. Where collection failed, the report says so instead of reporting an absence of findings, and a checked negative is recorded as a finding of its own.
When a vendor has an incident, each company that depends on it gets a dependency score: how much it would matter, if the company runs what was hit, that it depends on that vendor. It ranks what to confirm first. It is not a measured exposure, which is why the pages call it a dependency score and say a company depends on a vendor rather than that it is exposed.
dependency score = criticality(category) × edge confidence × evidence weight × event certaintyAll four factors are printed beside every score, so the number can be defended.
A sole source, one named partner holding a layer of a company's supply chain, is a fact about concentration and not a severity, so the pages mark it in ink rather than a severity colour. Where the research could not tell, the table says "not disclosed", never no.
The index joins at vendor granularity. A CVE affects a product and a version. Public DNS proves a company has a relationship with a vendor; it cannot say which of that vendor's products the company runs. That is why the blast radius page says a company depends on a vendor, not that it is exposed, and why every score is a priority for confirmation rather than a confirmed exposure.
An analysis of competing hypotheses runs first, ranked by fewest weighted inconsistencies rather than most support. When the leading hypothesis is not a targeted one, every actor's score is demoted and the page says so. Actors named in a source about something the company depends on are listed with that evidence; the rest are the sector's baseline.
Never authenticate to collect, never circumvent a technical control, prefer the documented API, honour robots.txt, identify every request, rate limit below the published cap, and never touch a target's systems.