Where this comes from.

What we keep

For every context we store the address it lives at, a SHA-256 of the content, and the list of entitlement types it contains. A new hash is a new version, which is how a file that was clean last month and is not clean today becomes visible.

We also store one command per class: the single line the classifier read to reach that verdict. A verdict nobody can check is a verdict nobody should believe, so the line travels with it. That is a quotation, not a copy. We do not keep the file.

How the index stays current

We index continuously. New files as the sources publish them, files we already hold re-read so that a change becomes visible, and the rest worked through in order.

Every request is authenticated and within the published rate limits. We do not scrape anonymously, do not read the HTML site, and do not touch private repositories.

How scanning works

Three scanners run on our own infrastructure, on demand, on whatever is in your space: the Pheo OATS resolver, our own command rules, and NVIDIA SkillSpector, which is Apache 2.0 and runs with its network and model features off so a private file never leaves the service scanning it.

One more column is a published result we import and never re-run: ClawScan, which is OpenClaw's own verdict on its own registry. It is free to read and it ships inside their public corpus, but it cannot be reproduced outside their pipeline, so it is labelled and dated wherever it appears and shows a dash for anything you bring yourself, because that scanner has never seen it. The live list is here.

There is no VirusTotal column. We hold no contract with them, their terms do not permit republishing their verdicts, and a result none of us can re-run is a result nobody can check. Everything we run is free software on our own machines, so a scan costs us compute and nothing else.

Formats your own tools already read

Scan results come back as SARIF 2.1.0 if you ask for them that way: POST /v1/scan?format=sarif. That is the OASIS standard GitHub Code Scanning and most security dashboards ingest directly, so findings land as alerts in the tool you already own rather than in a viewer we invented. Severities carry the security-severity field GitHub reads, and every finding carries a fingerprint, so the same problem found next week is the same alert rather than a new one.

API keys look like pheo_sk_live_… on purpose: the fixed, distinctive prefix is what lets secret scanners spot one that has been pasted into a repository. Keys are sent as Authorization: Bearer, we store a SHA-256 and never the key itself, and a key an agent carries cannot approve its own held actions. The full request and response shapes are at /v1/openapi.json, generated from the running service as OpenAPI, so they cannot drift from what it actually does.

If you want something removed

Mail rohit@pheo.ai with the address and we will take it out of the index. We hold metadata about public files, so there is nothing to delete beyond the record that the file exists and what it can do.