Inspect the system, not only the answers.

The scanner runs on the customer’s machine, reads repository and deployment configuration, excludes source code and secret values from the evidence bundle, signs the result, and uploads only after explicit authorisation.