{
  "service": "SafeFetch",
  "available": true,
  "generated_at": "2026-08-04T16:18:12.675Z",
  "service_version": "0.1.0",
  "policy_version": "safefetch-2026-08-03",
  "data_versions": {
    "detectors": "detectors@1.0.0",
    "patterns": "patterns@1.0.0",
    "unicode": "unicode@1.0.0",
    "extractor": "readability@0.6.0+linkedom@0.18.13",
    "markdown": "turndown@7.2.4",
    "sanitizer": "sanitize-html@2.17.6",
    "robots": "robots-parser@3.0.1"
  },
  "corpus_size": 68,
  "methodology": "Five difficulty tiers run against the detector and extraction core directly, bypassing HTTP and payment. Tier 2 is composed entirely of benign pages that must come back `allow`, including screen-reader markup, emoji ZWJ and tag-flag sequences, a byte-order mark, and typeset soft hyphens, so false positives are measured rather than inferred. Tier 3 is cases where `unknown` is the correct answer. Tier 5 is adversarial: WASP injection templates, tag-block and zero-width and variation-selector smuggling, encoded blobs, image-based exfiltration, and SSRF via redirect. False positives and false negatives are reported separately and both gate at zero.",
  "metrics": {
    "pass_rate": 1,
    "cases_passed": 68,
    "cases_failed": 0,
    "benign_pages_tested": 20
  },
  "false_positives": 0,
  "false_negatives": 0,
  "latency_ms_p50": 3.414,
  "latency_ms_p95": 7.937,
  "limitations": [
    "The corpus is self-authored and versioned. These figures describe behaviour on it and are not a guarantee for any particular page.",
    "Detection is deterministic and can be evaded. It is a fixed set of Unicode classes, CSS and HTML hiding techniques, and instruction-phrasing families; a technique outside that set is not detected. The rule set is published precisely so it can be reasoned about — including by an attacker, who gains rather less from reading it than a defender does.",
    "`allow` means no rule matched. It is not a statement that the page is safe, and it must not be used as one.",
    "There is no cascade engine. Stylesheet rules are matched by selector and merged in source order with inline styles; specificity and inheritance are not modelled, so an element hidden only through a specificity interaction can be missed and one un-hidden by a later, more specific rule can be reported.",
    "Only the served HTML is analysed. SafeFetch does not execute JavaScript, so content a browser would render is invisible to it — which is reported as verdict `unknown`, not as `allow`.",
    "Visible instruction-like text is a warning and never a block. A page may legitimately quote or discuss an injection payload, and concealment is what distinguishes an attack.",
    "Latency figures come from running the detectors and extractor in-process against local fixtures. They exclude network time, which dominates a real request."
  ],
  "disclaimer": "These figures are evidence from a versioned corpus, not a guarantee. Corpus composition and size are stated so the numbers can be interpreted and reproduced."
}