PSRafScan Security
Learn how PSRafScan handles script source and reports, what static analysis covers, and how to report a PSRafScan vulnerability privately.
How scans handle scripts
PSRafScan reads the script, uses PowerShell's native parser, evaluates static rules, and formats findings. It does not intentionally invoke the script being scanned.
Static analysis covers defined patterns. Test scripts normally in an environment that matches their dependencies, permissions, data, and side effects.
Handling reports
Reports can contain local paths and matched source text. Store them with the same care as the script, remove sensitive details before sharing, and use private channels when the report includes confidential code or vulnerability information.
Report a vulnerability
Use the repository's private GitHub Security Advisory form. Include the affected version, concise reproduction steps, and expected versus observed behavior without unrelated secrets or data.