How to interpret a report
Findings identify evidence for review. They do not prove malicious intent. Confidence describes how closely document evidence matches a detector; it is not a probability that a document is malicious.
A clean scan does not guarantee that a document is safe.
What is inspected
Word
Visible and hidden runs and styles, formatting contrast and size, comments and revisions, headers and footers, notes, text boxes, shape alternate text, core and custom properties, relationships, links, and embedded objects.
Excel
Sheet visibility, hidden rows and columns, cell formatting, comments, formulas and keywords, defined names, links and external relationships, drawings, protection, and embedded objects.
Text rendering modes, opacity, color and vector backgrounds, size and position, overlapping spans, OCR comparison, annotations, links, attachments, metadata, and JavaScript markers.
PDF evidence regions
When a PDF detector supplies reliable structured coordinates, the report can place an evidence region over the temporary raster preview. Exact regions come directly from document structure or detector traces. Approximate regions are detector-supported surrounding areas and use a dashed pattern. Page-only findings link to the relevant page without inventing a rectangle. Document-only findings have no page association.
Coordinates are validated and projected on the server from unrotated crop-box PDF points. Crop offsets and page rotation are taken from the same bounded renderer contract that created the preview. The browser receives normalized positions and does not reconstruct PDF coordinates from finding text.
Plain text document scans
Uploaded text scans check selected Unicode controls, zero-width and bidirectional characters, mixed-script homoglyph risks, readable Base64 or hexadecimal strings, and keyword positions.
Inspect Text workspace
The browser workspace checks characters listed in the versioned Unicode registry, currently zero-width joining and spacing characters plus embedding, override, and isolate controls. It records browser-native UTF-16 offsets and code-point-based line and column positions. Cleanup removes only occurrences the user selects; it does not normalize or otherwise rewrite text.
Limitations
- Password-protected and encrypted content may not be inspectable.
- OCR can miss text or misrecognize handwriting, unusual fonts, and low-quality images.
- Background matching is strongest for vector PDF backgrounds and may miss complex raster imagery.
- Macros and executable behavior are identified structurally but are not executed.
- Unsupported formats, corrupted structures, proprietary extensions, remote content, and dynamically loaded content may be omitted.
- Homoglyph and encoded-text detection is heuristic and requires context.
- Inspect Text reports only characters supported by its displayed registry version. Unlisted unusual characters, visual confusables, grapheme behavior, and normalization differences may remain.
- The browser workspace accepts up to 1 MB per inspection. Its Phase 1 release budget is 20 seconds for a one-megabyte inspection on the constrained mobile test profile; typical short text is substantially faster.
- Line and column values in Inspect Text count Unicode code points, not user-perceived grapheme clusters.
- The scanner never determines intent; a knowledgeable reviewer must verify findings in the source file.
- Evidence regions explain where detector evidence appears; they are not accusations, redactions, text-selection layers, or proof that content was intentionally concealed.
- Rasterization and rounding limit visual precision. Exact controlled regions are tested within the greater of two preview pixels or 0.25% of the corresponding preview dimension.
Privacy and execution boundary
Documents submitted to the document scanner are uploaded over HTTPS, written only to an isolated temporary workspace, and removed immediately after the scan, including when inspection fails.
Text pasted or selected in the Inspect Text workspace is processed in the browser and is not submitted to the scanning server. Clipboard and download actions use browser APIs. Leaving or refreshing the page discards the inspection session.
Macros, PDF JavaScript, links, embedded files, and embedded objects are identified as data but are never executed or opened. Filenames, keywords, excerpts, and document contents are not written to application logs by default.
No account is required and persistent server-side history is disabled. A signed browser session limits access to its own temporary reports. Reports expire automatically; export anything you need before leaving.
Temporary PDF page previews are optional and are created only after explicit consent for a selected PDF. The scanner rasterizes only a bounded set of relevant pages. The uploaded PDF is still deleted immediately; only separate raster images and a metadata-only manifest remain with the temporary report, for no longer than 15 minutes. Deleting the report also deletes its previews.
Finding-map geometry is small JSON-safe metadata stored only inside that same temporary report. It remains owner-scoped, expires with the report, and is deleted with the preview images. The map creates no additional image, public asset, annotation history, or retained copy of the PDF.
Raster previews are visual references, not copies of the original PDF. They cannot establish whether invisible text, metadata, attachments, annotations, scripts, or other structural content exists. Important evidence must be verified in the unchanged original document.