Compare numeric columns between two datasets on five order statistics: minimum, lower quartile, median, upper quartile and maximum. Quantiles are read off exactly sorted values, so a large or high-precision amount is never collapsed. Values that are not exactly comparable numbers are excluded and the exclusion is reported, because a silently narrowed sample makes every figure below it wrong.

Audit an OAuth client registration. Reports a wildcard redirect URI, where any matching host receives authorization codes; a plaintext redirect outside loopback; a registered URI that carries its own redirect parameter, so a code can be forwarded off the client's origin while still matching; the implicit and password grants; a public client registering a grant that needs a secret; and a client secret committed into the registration document itself. No secret value is ever reported.

Check that an on-call rota covers a period with no gap. Coverage is the union of the shifts in a rotation, so a gap is reported only where no shift covers the moment at all, which no per-shift check can find. Also reports one person on two rotations at once, where a page to both reaches one person so the second rotation is not a second responder; a shift longer than a stated maximum; too little rest between shifts; and a time with no UTC offset, which leaves a gap at every handover.

See how the declared authentication surface changed between two OpenAPI documents. Reports schemes added, removed or altered, scopes gained or lost, and the two cases a scheme comparison alone misses: an operation that now requires authentication where it required none, and an operation that no longer requires any. Reports what the documents say, not what the implementation enforces.

Decide whether an API change breaks your clients, operation by operation. Compares parameters, request bodies, responses and security across two OpenAPI documents, and classifies each change by who it breaks: the clients that call the API or the clients that read its responses. A newly required parameter breaks callers; a widened response enum breaks readers. A change it cannot classify is never counted as safe.

Find out what an API change breaks for one named client, rather than for everyone. You declare the operations it calls and, optionally, the response fields it reads and the parameters it sends. Changes outside that usage are counted and set aside. A breaking change on an operation this client never calls is somebody else’s problem, and blocking a migration on it is the mistake this product exists to prevent.

See which operations were added, removed, deprecated or renamed between two OpenAPI documents. Flags a removal that was never preceded by a deprecation, an operationId change that renames the method in every generated client, and a duplicated operationId that no generator can resolve.

Audit a real request against the OpenAPI document it should satisfy. Matches the operation the way a router would, checks every path, query and header parameter against its declared schema, validates the body against the declared media type, and reports whether the credential the declared security scheme expects is present. You supply the request, so this works against an API nothing external can reach.

See which parameters and request bodies changed obligation between two OpenAPI documents. Separates tightening, where an existing caller now fails, from loosening, where a handler may now receive nothing it previously could not. A path parameter is treated as required whatever the document says, so moving one between optional and required is not reported as a change.

Audit a real response against what the OpenAPI document promises for that operation. Resolves the declared status exactly, by range such as 2XX, or through default, checks declared response headers are present, and validates the body against the declared schema for its media type. Catches an implementation that has drifted from its own published contract.

Audit one OpenAPI document for whether a client or documentation generator can actually work from it. Reports operations with no operationId or description, duplicated operationIds that no generator can resolve, parameters with no schema or no location, responses with no description, and security requirements naming a scheme the document never defines.

See how declared response statuses changed per operation, and which operations are missing the statuses you require. Reports statuses added and removed, operations declaring no 2xx response at all, and responses with no description. Useful when a client has exhaustive error handling that a silently added status will fall through.

Audit a package manifest for what it leaves unpinned and undeclared. Reports a wildcard or latest specifier that accepts the next breaking release, a git or file specifier whose contents can change without the manifest changing, a version that is not an exact semantic version, missing engines, a dependency declared in both a runtime and a development group, and empty scripts.

Fetch a reviewed public page and return SHA-256 hashes of both the raw HTML and the visible text, with byte and character counts. Two hashes because they answer different questions: the HTML hash moves when anything at all changes, the text hash moves only when the content a reader would notice does.

Fetch a reviewed public page and return every JSON-LD structured-data block it declares, parsed. No script is executed. A block that is malformed is reported as a named warning rather than being silently dropped, so a caller can tell an empty page from a broken one.

Fetch a reviewed public page and return its links with resolved absolute URLs and anchor text, the canonical URL, the declared meta robots directive, and how many links leave the host. Relative hrefs are resolved against the page, so a caller never has to guess a base.

Fetch a reviewed public page and return its readable content as Markdown, with headings and list structure preserved. Script, style and template content is removed, and nav and aside elements plus anything marked role="navigation" are excluded from the text. Returns the licence and creator, because this content is reusable only on those terms. Truncation at any bound is reported, never silent.

Fetch a reviewed public page and return its title, every meta and Open Graph tag, and the canonical URL. No JavaScript is executed and no script content is read. Returns the licence and creator for the content alongside it, so reuse terms travel with the result.

Fetch a reviewed public page and return its HTML tables as arrays of rows and cells. Bounded to ten tables, fifty rows each and twenty cells per row, and every bound that is reached is named in the warnings so a truncated table is never mistaken for a short one.

Audit a pagination contract for the ways it loses or repeats rows. The central finding is the one almost every paginated API has at first: a sort on a non-unique field with no unique tiebreaker, so rows that compare equal have no defined order and a caller walking the pages can get one row twice and never get its neighbour, with nothing failing. Also reports offset pagination over a mutable sort, an unbounded page size, contradictory bounds, and a cursor contract that also takes an offset.

Check that payment allocations are arithmetically consistent with the invoices and payments they refer to. An over-allocated invoice and an over-allocated payment are reported separately because they are different events: money applied beyond what was owed, and money applied that was never received. Also reports an unallocated remainder, an allocation to a cancelled invoice, and a cross-currency allocation, which converts at a rate the data does not state.

Report personal-data shapes in structured logs, by field and class and never by value. A payment card is confirmed by the Luhn check and an account number by its own mod-97 checksum, so a match is a plausible real value rather than any digit run, which keeps an order number from being reported as a card. A date of birth needs a field named for one as well as a date. Each match reports its field, how many lines carry it and how many distinct values there are.

Audit one .proto source for what protobuf rejects and what it will cost later. Reports an absent syntax line, which silently means proto2; a required field, which can never be removed; an enum with no zero value, so an unset field has nothing to read as; a zero value named after a real state; a duplicate number; a number inside the implementation-reserved range; a non-permitted map key; and a repeated field above the one-byte tag boundary while low numbers are free.

Decide whether two .proto sources are compatible, treating the field number as the identity it is. Reports a number freed without a reserved entry, which arms a future field to reinterpret old bytes; a number taken from a reserved range; a wire type change, which stops old messages decoding; a same-wire-type change that alters the decoded value, such as signed to unsigned; a rename, which is wire-safe and breaks generated code; cardinality and oneof moves; and enum number changes.

Check that every reference in a child dataset resolves to a parent. Containment is one-directional, which is the difference from a reconciliation: a parent key nothing references is normal and is reported as a count, while a child key with no parent is a broken reference reported with every row carrying it. Also catches a duplicated parent key, which makes any reference to it ambiguous.

Audit a resource inventory against a tagging contract. The finding that spans the inventory: two tag keys differing only in case, which cloud APIs treat as different keys so every grouping and cost report splits silently across them. Also reports a required tag absent, an empty value that satisfies a presence check and carries no information, a value with surrounding whitespace that groups separately, a value outside a permitted set, and a value a declared pattern does not accept.

Check that a revenue recognition schedule sums to its contract value exactly and covers its term with no gap or overlap. A cent either way means that amount is either never recognised or recognised without having been contracted, and both are reported with the exact figure. Periods are treated as inclusive day ranges, so the day after one ends is the day the next must begin, and a gap and an overlap are separate findings because they are opposite errors.

Check the address, reverse name and forward address triple that receivers actually evaluate. Reports an address with no reverse name, which many receivers refuse before the message body is sent; a reverse name that resolves to a different address, so forward confirmation fails, which is worse than having none because it looks configured; a provider-generated name; and a HELO that does not match the reverse name.

Compare two software inventories and report what entered, left and moved. Reads CycloneDX components and SPDX packages, matching by package URL where both sides carry one because a bare name matches the wrong component across ecosystems. Reports version moves with breaking risk, a declared licence that changed, and a new component declaring no licence. A licence change is reported as a change in a declared field, not as a licensing conclusion.

Report credential-shaped values in supplied configuration, by shape class and position, never by value. Recognises a PEM private key block, a JSON Web Token whose header actually decodes, documented key prefixes, a URL carrying a password, and a long run with the character mix of a generated key rather than of text. Also reports a field named like a credential whose value matches no listed shape. The shape classes are published in every response.

Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.

Audit one supplied sitemap or sitemap index. Reports entries with no loc, locations that are not absolute URLs, locations on an unexpected host, duplicated locations with the entries they occupy, fragments, unescaped ampersands that make the document invalid XML, double-escaped ampersands that name a URL which does not exist, and lastmod values that either are not W3C datetimes or match the shape without being real dates. No URL is fetched.

Judge whether a service level objective can actually be observed, before any measurement exists. The central check: at the expected event volume, one failure may already exceed the whole budget, so the objective is met with zero failures and breached by one and measures nothing in between. Also reports a budget of fewer than ten events, where chance dominates service quality, and a burn-rate alert whose own window is longer than the time that burn takes to exhaust the budget.

Check that a versioned dimension is temporally coherent, per key. Reports intervals that overlap, so a point-in-time lookup returns two rows; gaps, so it returns none; more than one live version; an interval ending before it starts; and a current flag that disagrees with its own interval. Intervals are treated as half-open, so a row ending exactly where the next begins is contiguous rather than overlapping.

Hold spans to an attribute convention the caller states, including per span kind. The finding that matters most: a span name embedding an identifier. The name is the aggregation key, so a name per call means every call is its own operation and no latency distribution exists for it; identifiers belong in attributes. Also reports a required attribute absent, an attribute the contract forbids, reported by key and never by value, and an unrecognised span kind.

Compute the exact SPF lookup cost across a supplied include tree. The budget of ten resolving mechanisms is shared across the whole evaluation rather than per record, which is why a record with three includes can cost fourteen lookups and no single record looks wrong. Reports the total against the limit, the headroom left, a cycle in the include chain, and every include whose record was not supplied so the total is a floor.

Audit an SPF record. Reports two or more records on one name, which is a permanent error so most receivers treat the domain as having no SPF at all; a lookup count at or beyond the limit of ten resolving mechanisms, beyond which the evaluation is a permanent error; a record ending in +all, which authorises every host on the internet; a record ending neutral with no all or redirect; a term after all, which is never evaluated; and an unrecognised term, which is itself a permanent error.

Compare two SQL schema snapshots and report what would break a client written against the first. Separates reader breakage from writer breakage, because the same change breaks different people: a dropped column breaks whoever selects it, a new NOT NULL column with no default breaks every existing insert. Also reports narrowed and widened types, lost defaults, nullability flips, collation changes and added or removed uniqueness.

Read migration statements and report what each one touches and what it costs. Names the statements that rewrite a table, the ones that scan every row while holding a lock, the ones that discard data irreversibly, and the renames that break every client still deployed with the old name the instant they commit. Reports tables and columns touched so a reviewer can see the reach of a migration without reading every statement.

Audit the JSON-LD a supplied page declares against a contract the caller states. Entities inside @graph and nested inside other entities are flattened first, because reading only the top level misses every entity a real page declares that way. Reports required types absent, required properties missing per entity, unmentioned types when unknown types are forbidden, entities with no @type, and blocks with no @context. Only JSON-LD is read, and that is stated rather than treated as conformant.

Audit your own delimited data against a contract you declare, and get one pass/fail plus the exact row and clause of every breach. Checks types, required values, enums, numeric bounds, lengths, patterns, uniqueness, composite primary keys, null-rate ceilings, header drift and encoding damage in one pass. A pass means the audit was complete and nothing broke, so a file beyond the bounds reports incomplete rather than passing. Nothing is fetched: you supply the rows.

Check tax amounts against a rate schedule the caller supplies. When a declared amount disagrees, the other inclusivity formula is tried too: if that one gives the declared figure, the finding says the policy and the data disagree rather than that the arithmetic is wrong, which is a different correction. Also reports a code absent from the schedule, a line rate disagreeing with it, and an amount too precise for the currency. Not tax advice.

Audit telemetry attributes against a contract, and against the thing a schema cannot see: cardinality. Reports missing required attributes, undeclared attributes, an attribute appearing as two types across the batch, and an attribute whose distinct values exceed your limit - because in a metrics backend each distinct value is a separate series, and that is how an index or a bill explodes.

Read a Terraform plan and report what applying it destroys. Names each resource to be destroyed or replaced, and for a replacement the attribute the plan says forced it, which is what a caller changes to avoid it. Separates a destroy of a resource type that holds data, where re-applying does not bring it back, from a destroy of something stateless. The type patterns treated as holding data are published in the response and the caller can add to them.

Summarise a Terraform plan and name everything it would destroy. A replacement is expressed as a create and a delete together, so reading only the first action would report a destroy and recreate as a plain create; replacements are classified as such. Counts changes by action and by resource type, and reports a destroy or replacement of any resource type or address you declare protected.

Read a Terraform plan expected to be empty and report why it is not. Drift and planned changes are reported separately, because Terraform records them separately and they answer different questions: one is what somebody changed outside the configuration, the other is what applying would do about it. Where before and after attributes are both present, the fields that actually moved are named rather than reporting the resource as generically drifted.

Hold a Terraform plan to a contract the caller states: resource types forbidden or permitted, tags every resource must carry, actions that must not appear, a ceiling on destructive changes, and attribute values that must not be used. Tags are read from tags, tags_all or labels, because providers differ and reading only one would report a tagged resource as untagged. Which rules ran is published, so a contract that checked nothing is visible rather than reading as a pass.

Check whether a set of spans forms coherent traces. Reports a parent that is not in the data, so the trace renders as fragments rather than one tree; a trace with no root or several; a cyclic parent chain, which makes any walk loop; a span that ends before it starts; and a child whose times fall outside its parent, which is clock skew between hosts rather than a code defect and which every latency figure derived from the trace inherits.

Report text reuse conflicts between a base locale and its translations, in both directions. One source string translated several ways makes the interface say the same thing in different words in different places. Several source strings translated identically removes a distinction the product makes in one language and not the other. Neither is visible key by key, which is why this is a property of a pair of files. Comparison folds case and trims whitespace by default.

Derive account balances from journal entries and compare them with a declared trial balance. Reports an account whose balances differ, with the exact difference; an account carrying a reported balance that nothing in the journal supports; an account with journal movement that appears in no reported figure; and a trial balance whose own debit and credit columns do not foot. Both a debit and credit pair and a single signed balance column are accepted, because exports are written both ways.