01 · How it runs

Three passes. Each one waits for permission.

Antibody always reads what a visitor can already see. It calls the API only after you prove the site is yours, and it reads the repo only after GitHub is connected.

1. 01 · Any URL

   Visitor

   Fetches the page and the same-origin scripts. DNSSEC and DMARC are asked of a public resolver, not of the site.

   10 checks

2. 02 · You prove ownership

   Live

   Calls the API with no login. Proof is Connect Vercel, or the allowlist. Probes do not follow redirects.

   6 checks

3. 03 · GitHub is connected

   Code

   Reads the repo for the same holes in source: missing auth, missing limits, injection, and committed keys.

   6 checks

What actually runs

Live and code are separate. Connecting GitHub does not turn on the API probes, and proving ownership does not read the repo.

Next: the 22 checks