Public record

Evidence & transparency

Himanshu Saxena · dated 13 September 2026, updated 18 September 2026 · stig.hsaxena.com/evidence.html

Anyone can clone the repository, open this site, and check the statements below. Dates are the day this page was written. If a later commit changes a fact, the git history is the correction.

What is objectively true

2026-09-13 The public site is static GitHub Pages The files live in this repository’s docs/ folder and are served at https://stig.hsaxena.com (CNAME stig.hsaxena.com). The page does not scan the visitor’s machine and never will. There is no live-chat widget and no remote host check.
2026-09-13 MIT licence, no account, no API key LICENSE is MIT (Copyright 2026 H. Saxena). The hosted page is HTML, CSS and JavaScript. The downloaded scanner is this project’s Python. Neither asks for an account or an API key.
2026-09-18 Named approval is the normal scan; an override exists and is labeled Shipped checks stay unreviewed until someone reads the exact command and types their name. Approval freezes a SHA-256 digest of the command, the comparison, and the expected value. If those bytes change later, the check is treated as drifted and will not run. The hosted website never scans. On the local page, a normal scan runs only named-approved checks; the program never approves a check for you. The command line can force an unreviewed run with --include-unreviewed (the local page has a matching optional checkbox). That does not approve the check. Those results are labeled untrusted in JSON, Markdown and PDF, and are not a normal approved scan or accreditation evidence.
2026-09-13 Platforms Scanner profiles exist for macOS, Linux and Windows. This website builds a zip for a desk Mac (Apple macOS 26 Tahoe V1R3, 160 rules) or a Windows 11 PC (V2R9, 257 rules). Linux and servers stay on the command line. Source: github.com/himanshusaxenagithub/stig-ai-pipeline.
2026-09-18 Two scoped rule counts, not one ambiguous total 1,440 rules are explained across seven STIGs in annotations/ (Windows 11 V2R9 257, Windows Server 2019 V3R8 282, RHEL 9 V2R9 445, Ubuntu 24.04 LTS V1R6 194, macOS 26 V1R3 160, SQL Server 2022 Instance V1R4 79 and Database V1R3 23). 1,338 rules ship as check packs for five packaged platforms (the five OS guides: 257 + 282 + 445 + 194 + 160). SQL Server is explained but has no check pack. Do not treat 1,440 and 1,338 as the same number.
2026-09-18 All four modules ship as working code stigprep, stigscan, stigassess and stigharden are in this repository with unit tests. Assess drafts POA&M wording; a named person approves and is the only one who can close. Harden drafts remediation scripts; apply is a dry-run unless --apply-for-real is passed with --by and --i-have-reviewed, and that flag is refused in CI. This page does not claim a BitLocker / Credential Guard check-candidate rewrite or a new Windows live scan; those remain follow-up work.
2026-09-14 The page reports gaps and drafts; it never changes the system The local program finds configuration gaps and writes JSON, Markdown and a PDF. A static safety gate refuses writes, network clients, privilege escalation and destructive verbs in any check. After a scan the page can draft Plan of Action and Milestones entries (stigassess) and remediation scripts (stigharden). Drafts are files a named person reads; the page cannot approve, close or apply any of them: every draft is human-gated. Applying a drafted fix exists only on the command line, is a dry-run unless --apply-for-real is passed together with --by and --i-have-reviewed, and is refused in CI.
2026-09-14 The double-click program is the same Python, not a binary STIG Checker.command (Mac) and STIG Checker.bat (Windows) start the local page from the unzipped folder. If the computer has no Python, the launcher offers to download a private copy (python-build-standalone on a Mac, python.org's embeddable build on Windows) into the user's own application folder; nothing is installed system-wide and no administrator password is needed. Nothing is compiled or packed: the folder holds the same .py files that are in the repository, so a reviewer can read exactly what runs.
2026-09-18 Automated tests python3 -m unittest discover -s tests runs 306 tests on the date above (parsers, the approval digest, the safety gate, the Windows extractor, the site data export, the browser zip, the launchers, and the local page's HTTP routes). Separately, the double-click path — website download, unzip, launcher, page, approval, scan, PDF, Quit — was run end to end ten times in a real browser before v0.7.6 shipped; the three defects that found are listed in CHANGELOG.md under v0.7.6.
2026-09-13 Where to look next Start page demo: index.html#demo. Longer labeled walk-through, when that file is on this site: demo.html. Essays: hsaxena.com/writing (ten notes, plain English; not on this product site). Optional public notes: used.html. Moderated reviews: reviews.html.

A first CAT I pass (the real path)

You do not need invented results to see how the tool works. These are the steps on the live start page. Nothing downloads until you ask. Nothing runs until you type your name on your own computer.

Open stig.hsaxena.com (or index.html).
Under Demo — try a simple first scan, pick MacBook · CAT I demo or Windows PC · CAT I demo. The rules list opens with the CAT I filter on.
Review the short list. Click Select CAT I for demo. The shipped Apple macOS 26 (Tahoe) V1R3 pack lists 13 high-severity (CAT I) rules; the Windows 11 V2R9 pack lists 27. Those counts come from the JSON this repository publishes, not from a live scan of your machine.
Choose Download a scanner for this selection, then download the zip. Delete any previous unzipped scanner folder first.
On that computer: Windows → STIG Checker.bat. Mac → right-click STIG Checker.command → Open. The local page binds to 127.0.0.1.
Read each command. Type your name to approve the ones you accept. Then run the approved checks. Coverage is stated first — rules that were not judged are not counted as pass or fail.

If demo.html is present, it is a longer illustrated story of the same path. Figures there that are marked sample data are invented for the narrative. They are not a scan of a real organisation.

What we do not claim

This project is not a Department of Defense or DISA product. Those organisations have not endorsed it. STIGs are public checklists DISA publishes; using the identifiers does not imply a relationship.
GitHub stars, forks, watchers or traffic are not evidence of organisational adoption.
The start page may show one approximate public GoatCounter site visitors total — people who opened pages on this website. That is not DoD adoption, and not a count of people who downloaded or ran the scanner. We do not publish customer logos. Moderated reviews appear only after manual approval; email addresses are never published. Optional notes can still go through Used this?. This page invents none.
Sample or example-run figures labeled as sample data are not real clinic, school or company results.
Selecting CAT I, or finishing a first scan, is not a claim that a system is “STIG compliant,” accredited, or safe.
The tool finds configuration gaps. That is not a claim about hacking, exploits, or active attacks.

How a reviewer can check

Licence: LICENSE
Source: himanshusaxenagithub/stig-ai-pipeline
Site files: docs/index.html, docs/site.js, this page
Approval model: docs/REVIEW_WORKFLOW.md and stigscan/pack.py
Shipped CAT I counts: docs/data/checkpacks/macos-26-v1r3.json and windows-11-v2r9.json ("severity": "high")
Tests for this site: tests/test_site.py; launchers: tests/test_start_scripts.py; everything: python3 -m unittest discover -s tests
Drafting after a scan: stigassess/, stigharden/, and their tests; the CLI-only apply gate is stigharden/apply.py

Official STIG packages come from DISA (public.cyber.mil/stigs/downloads or dl.dod.cyber.mil). This site ships catalogue metadata because browsers cannot fetch that host (CORS). The local scanner still downloads the official zip when you ask it to, and refuses a file that does not match the pinned release / rule count (and SHA-256 when one is recorded).