REDZOHU GOVERNANCE SCANNER — PROJECT GUIDE

PURPOSE
A personal learning and portfolio project built to explore governance
engineering, user experience, policy automation and product development.
It is not a commercial service or a certified compliance product.

WHAT IT DOES
The local application accepts a ZIP or a supported public Git repository.
The operator declares deployment regions, sector and risk classification.
A curated registry selects applicable controls. Conftest/OPA evaluate
policies, Semgrep finds configured source patterns, and small scripts
check artifacts such as documentation and secrets-manager SDK usage.
The code being assessed is not intentionally executed by the scanner.

Manual-review items remain visible. Exceptions require a reason, owner
and expiry and are shown as accepted risk rather than silently ignored.
Reports group checks by jurisdiction and save a JSON record with a
SHA-256 self-hash. A self-hash detects some changes but is not a digital
signature, an independent audit or proof against deliberate rewriting.

HOW TO USE THE PUBLIC DEMO
1. Choose a source to explore the interface. No source contents are sent.
2. Select applicability options and review the summary.
3. Open the sample findings. These come from a bundled fixture, not from
   your chosen source, and do not change with form selections.
4. Explore sample history or download the example evidence JSON.
The demo has no live scanning backend and is not a processing service.

HOW TO USE THE LOCAL APPLICATION
Install the dependencies and pinned policy engines following README.md.
Run python3 webui/app.py, then open http://127.0.0.1:5050.
The same perform_scan implementation supports the web, CLI and CI paths.
Local reports remain in ui-scan-runs unless SCANNER_RUNS_DIR is configured.
Source staging directories are removed after the request finishes; reports
can retain source descriptions, references and sensitive findings.

WHAT RESULTS DO NOT MEAN
PASS applies only to a configured check on that input. It is not proof
of full compliance, safety, privacy or absence of vulnerabilities.
Coverage is partial. Rules and legal references can be incomplete or
outdated, and static analysis can produce false positives and negatives.
Risk classification is supplied by the operator, not a legal conclusion
made by the tool. Qualified review remains necessary where applicable.

DISCLAIMERS AND RESPONSIBLE USE
No legal advice, compliance certification, regulatory approval,
independent assurance or production-readiness guarantee is provided.
Do not rely on this project alone for consequential decisions.
Inspect only code you own or have permission to review. Do not enter
secrets, confidential material or personal data into the public demo.
The project is experimental and is not an enterprise-complete product.
It uses established open-source engines; no affiliation or endorsement
by their maintainers or by a regulator is implied.

DEPLOYMENT STATUS
The public release is a static frontend demo. No EC2 or paid backend
resources are required. Docker files for the local application's future
deployment are preparation only and have not been validated in a running
container. A shared access token is not multi-tenant identity or SSO.
See docs/WEBUI.md for engineering notes and validation scope.