Scanners inspect one entry at a time and return a ScanOutcome with a risk score, rationale, and optional match spans. The pipeline adds each scanner’s configured severity and action to form a finding. Only positive BLOCK findings are eligible for numerical decisions; other findings remain visible for review.
Every scanner accepts severity, action, and content_types, although their defaults differ. content_types: null accepts every entry type. In a simple gate, a known-type mismatch is skipped and recorded; ContentType.UNKNOWN is eligible for all scanners. In a cascade, a known-type mismatch from a required scanner is an unsupported_content operational fault: fail raises it, block returns an unsafe operational verdict, remaining scanners in that stage do not run, and later stages are not_reached. An UNKNOWN entry type reaches scanners and follows the same score-only stage decisions as other eligible inputs.
| Reference | Primary use | Default action |
|---|---|---|
Detect protected marker tokens. |
|
|
Find hidden Unicode instructions. |
|
|
Evaluate typed evidence through a configured external HTTP service. |
|
|
Match suspicious patterns and code-oriented keywords. |
|
|
Detect regex-based personal-data patterns. |
|
|
Detect English NLP entities. |
|
|
Detect pattern-based injection attempts. |
|
|
Classify injection with an optional local model. |
|
|
Detect credentials and high-entropy values. |
|
|
Apply suspicious-URL heuristics. |
|
|
Require URLs to match approved patterns. |
|
|
Flag URLs that match blocked patterns. |
|
|
Detect HTML and script injection vectors. |
|
Run preprocessors before scanners when text may use encoding or whitespace to hide its content. See Configuration for scanner records and Gates for verdict calculation.