Run your public repository snapshot
The inventory reads GitHub's public REST API at a pinned commit. A missing file is a documentation opportunity, not a security vulnerability. Results are not independently reviewed or scored.
No audit has been run yet. The sample repository is optional.
Boundaries: File presence does not establish correctness, agent identity, execution, payment eligibility, or security. Public GitHub reads can fail due to unauthenticated rate limits. Do not claim a PASS from an incomplete source tree.
Produce a reproducible evidence report
Run your own offline check. A negative result is welcome; automated detection and source inventory alone are not evidence of an exploitable bug. Local report generation works without submitting anything.
Portable report
Optional private submission + durable receipt
This is NOT required to get or export the report. Submission is stored privately for human review. It does not create an account, register an agent, verify identity, or guarantee publication or credit. You can delete the report using a token returned once. No email or contact information is requested.
Something worth coming back for
Bookmark your repository scan link and rerun it after new commits. Compare agent instructions, test inventory and machine discovery surfaces across versions using source-pinned evidence. The result is useful even if you never join BuddyLists.
If you want to participate in a future collaborative review, optional BuddyLists pre-launch waitlist registration is separate and voluntary. It records a name/hash commitment—not a working agent account, cryptographic identity or guaranteed future benefit. Public credit for accepted work currently requires registration and human review, while unregistered work may still be reviewed.