[{"data":1,"prerenderedAt":747},["ShallowReactive",2],{"navigation_docs":3,"-docs-guide-profiles":160,"-docs-guide-profiles-surround":742},[4,8,45,115,125],{"title":5,"path":6,"stem":7},"TheSpider Documentation","\u002Fdocs","docs\u002Findex",{"title":9,"icon":10,"path":11,"stem":12,"children":13,"page":44},"Getting Started","i-lucide-rocket","\u002Fdocs\u002Fgetting-started","docs\u002F1.getting-started",[14,19,24,29,34,39],{"title":15,"path":16,"stem":17,"icon":18},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002F1.getting-started\u002F1.introduction","i-lucide-house",{"title":20,"path":21,"stem":22,"icon":23},"AI Setup Wizard","\u002Fdocs\u002Fgetting-started\u002Fai-setup","docs\u002F1.getting-started\u002F2.ai-setup","i-lucide-sparkles",{"title":25,"path":26,"stem":27,"icon":28},"Install the agent","\u002Fdocs\u002Fgetting-started\u002Finstallation","docs\u002F1.getting-started\u002F3.installation","i-lucide-download",{"title":30,"path":31,"stem":32,"icon":33},"Cloud quickstart","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F1.getting-started\u002F4.quickstart","i-lucide-zap",{"title":35,"path":36,"stem":37,"icon":38},"Connect over MCP","\u002Fdocs\u002Fgetting-started\u002Fmcp","docs\u002F1.getting-started\u002F5.mcp","i-lucide-plug",{"title":40,"path":41,"stem":42,"icon":43},"Pricing","\u002Fdocs\u002Fgetting-started\u002Fpricing","docs\u002F1.getting-started\u002F6.pricing","i-lucide-badge-dollar-sign",false,{"title":46,"icon":47,"path":48,"stem":49,"children":50,"page":44},"Guide","i-lucide-book-open","\u002Fdocs\u002Fguide","docs\u002F2.guide",[51,56,61,66,71,76,81,86,91,96,101,106,111],{"title":52,"path":53,"stem":54,"icon":55},"Configuration","\u002Fdocs\u002Fguide\u002Fconfiguration","docs\u002F2.guide\u002F01.configuration","i-lucide-settings",{"title":57,"path":58,"stem":59,"icon":60},"The agent","\u002Fdocs\u002Fguide\u002Fagent","docs\u002F2.guide\u002F02.agent","i-lucide-terminal",{"title":62,"path":63,"stem":64,"icon":65},"Campaigns","\u002Fdocs\u002Fguide\u002Fcampaigns","docs\u002F2.guide\u002F03.campaigns","i-lucide-layers",{"title":67,"path":68,"stem":69,"icon":70},"Campaign cadence","\u002Fdocs\u002Fguide\u002Faudit-workflows","docs\u002F2.guide\u002F04.audit-workflows","i-lucide-git-compare-arrows",{"title":72,"path":73,"stem":74,"icon":75},"Triage","\u002Fdocs\u002Fguide\u002Ftriage","docs\u002F2.guide\u002F05.triage","i-lucide-list-checks",{"title":77,"path":78,"stem":79,"icon":80},"PR gate","\u002Fdocs\u002Fguide\u002Fpr-gate","docs\u002F2.guide\u002F06.pr-gate","i-lucide-git-pull-request",{"title":82,"path":83,"stem":84,"icon":85},"Data handling & privacy","\u002Fdocs\u002Fguide\u002Fdata-handling","docs\u002F2.guide\u002F07.data-handling","i-lucide-shield-check",{"title":87,"path":88,"stem":89,"icon":90},"Author an audit methodology","\u002Fdocs\u002Fguide\u002Fmethodology","docs\u002F2.guide\u002F08.methodology","i-lucide-panels-top-left",{"title":92,"path":93,"stem":94,"icon":95},"Configure a custom model runner","\u002Fdocs\u002Fguide\u002Fcustom-runner","docs\u002F2.guide\u002F09.custom-runner","i-lucide-terminal-square",{"title":97,"path":98,"stem":99,"icon":100},"Runner troubleshooting","\u002Fdocs\u002Fguide\u002Ftroubleshooting","docs\u002F2.guide\u002F10.troubleshooting","i-lucide-wrench",{"title":102,"path":103,"stem":104,"icon":105},"Host an external execution agent","\u002Fdocs\u002Fguide\u002Fexternal-agent","docs\u002F2.guide\u002F11.external-agent","i-lucide-plug-zap",{"title":107,"path":108,"stem":109,"icon":110},"Refine","\u002Fdocs\u002Fguide\u002Frefine","docs\u002F2.guide\u002F12.refine","i-lucide-repeat",{"title":112,"path":113,"stem":114,"icon":65},"Audit profiles","\u002Fdocs\u002Fguide\u002Fprofiles","docs\u002F2.guide\u002F13.profiles",{"title":116,"icon":117,"path":118,"stem":119,"children":120,"page":44},"Deploy","i-lucide-server","\u002Fdocs\u002Fdeploy","docs\u002F3.deploy",[121],{"title":122,"path":123,"stem":124,"icon":117},"On-prem overview","\u002Fdocs\u002Fdeploy\u002Fonprem","docs\u002F3.deploy\u002F2.onprem",{"title":126,"icon":127,"path":128,"stem":129,"children":130,"page":44},"Reference","i-lucide-code","\u002Fdocs\u002Freference","docs\u002F4.reference",[131,136,141,146,150,155],{"title":132,"path":133,"stem":134,"icon":135},"API reference","\u002Fdocs\u002Freference\u002Fapi","docs\u002F4.reference\u002F1.api","i-lucide-code-xml",{"title":137,"path":138,"stem":139,"icon":140},"Concepts and glossary","\u002Fdocs\u002Freference\u002Fconcepts","docs\u002F4.reference\u002F2.concepts","i-lucide-book-marked",{"title":142,"path":143,"stem":144,"icon":145},"Runner contract","\u002Fdocs\u002Freference\u002Frunner-contract","docs\u002F4.reference\u002F3.runner-contract","i-lucide-file-json-2",{"title":147,"path":148,"stem":149,"icon":28},"Findings export","\u002Fdocs\u002Freference\u002Ffindings-export","docs\u002F4.reference\u002F4.findings-export",{"title":151,"path":152,"stem":153,"icon":154},"Agent CLI contracts","\u002Fdocs\u002Freference\u002Fagent-cli-json","docs\u002F4.reference\u002F5.agent-cli-json","i-lucide-braces",{"title":156,"path":157,"stem":158,"icon":159},"Agent downloads","\u002Fdocs\u002Freference\u002Fdownloads","docs\u002F4.reference\u002F6.downloads","i-lucide-hard-drive-download",{"id":161,"title":112,"body":162,"description":735,"extension":736,"links":737,"meta":738,"navigation":739,"path":113,"seo":740,"stem":114,"__hash__":741},"docs\u002Fdocs\u002F2.guide\u002F13.profiles.md",{"type":163,"value":164,"toc":722},"minimark",[165,169,298,311,334,338,341,344,366,376,379,393,396,400,414,417,420,427,460,474,481,484,498,502,511,546,550,553,575,578,587,598,601,633,637,644,647,650,654,676,682,698,718],[166,167,168],"p",{},"Every project has four audit profiles. Each one has its own methodology, campaigns and model\nenablement. Findings, dedupe and triage stay project-wide.",[170,171,172,194],"table",{},[173,174,175],"thead",{},[176,177,178,182,185,188,191],"tr",{},[179,180,181],"th",{},"Profile",[179,183,184],{},"Finds",[179,186,187],{},"Never reports",[179,189,190],{},"CLI flag",[179,192,193],{},"Lifecycle labels",[195,196,197,221,242,272],"tbody",{},[176,198,199,206,209,212,218],{},[200,201,202],"td",{},[203,204,205],"strong",{},"Security",[200,207,208],{},"Exploitable weaknesses: authentication, authorization, injection, SSRF, path traversal, secrets, insecure config, supply chain",[200,210,211],{},"Findings without concrete file:line evidence",[200,213,214],{},[215,216,217],"code",{},"--profile security",[200,219,220],{},"Fixed · False positive · Still vulnerable",[176,222,223,228,231,234,239],{},[200,224,225],{},[203,226,227],{},"Bugs",[200,229,230],{},"Correctness defects with a realistic failing path: logic, state, concurrency, error handling, boundaries, regressions",[200,232,233],{},"Style preferences, speculative issues",[200,235,236],{},[215,237,238],{},"--profile bugs",[200,240,241],{},"Resolved · Invalid · Still reproducible",[176,243,244,250,253,256,261],{},[200,245,246,249],{},[203,247,248],{},"Hygiene"," (beta)",[200,251,252],{},"Cruft with evidence it is obsolete: dead and unused code, stale TODOs, permanent flags, finished compatibility shims, leftover scaffolding, unused dependencies and orphaned config",[200,254,255],{},"Coverage gaps and missing tests, security issues, correctness bugs, style, refactoring live code, applied migrations, generated or vendored code, lockfile entries, CI jobs and build stages",[200,257,258],{},[215,259,260],{},"--profile hygiene",[200,262,263,264,267,268,271],{},"Cleaned up · Not cruft · Still present · ",[203,265,266],{},"Kept on purpose"," (",[215,269,270],{},"wont_fix",")",[176,273,274,279,282,285,290],{},[200,275,276,249],{},[203,277,278],{},"Pipeline",[200,280,281],{},"Avoidable CI, build and test cost: jobs that run on changes that cannot affect them, serial work, uncancelled superseded runs, duplicate jobs, caches that cannot hit, image builds that defeat their own cache, repeated setup, fixed waits, overlapping suites",[200,283,284],{},"Security issues (CI security included), correctness bugs, flaky or missing tests, coverage gaps, invented durations",[200,286,287],{},[215,288,289],{},"--profile pipeline",[200,291,292,293,267,296,271],{},"Resolved · Invalid · Still present · ",[203,294,295],{},"Kept as is",[215,297,270],{},[166,299,300,301,304,305,310],{},"Hygiene and Pipeline need ",[203,302,303],{},"thespider-agent 0.7.0 or later",". See ",[306,307,309],"a",{"href":308},"#agent-versions","Agent versions",".",[312,313,314,317,318,321,322,325,326,329,330,333],"note",{},[203,315,316],{},"Hygiene and Pipeline are in beta."," They are new and still being validated on real-world\nprojects, so their findings may be noisier than Security and Bugs, and their methodology may still\nbe tuned. The dashboard and ",[215,319,320],{},"thespider-agent setup"," mark them ",[203,323,324],{},"Beta",". Triage a wrong finding as\n",[203,327,328],{},"Not cruft"," or ",[203,331,332],{},"Invalid"," rather than leaving it open.",[335,336,248],"h2",{"id":337},"hygiene",[166,339,340],{},"Hygiene is in beta.",[166,342,343],{},"Every hygiene finding carries two extra report fields:",[345,346,347,357],"ul",{},[348,349,350,267,353,356],"li",{},[203,351,352],{},"Usage evidence",[215,354,355],{},"usage_evidence","): how non-use or staleness was established. That means the\nsearches the model ran, what they found, and the dynamic and external uses it ruled out.",[348,358,359,267,362,365],{},[203,360,361],{},"Removal risk",[215,363,364],{},"removal_risk","): what could break, and who outside the checkout could depend on it.",[166,367,368,371,372,375],{},[215,369,370],{},"recommendation"," is the removal plan: everything that goes with the item (code, tests, config, docs,\ndependencies). ",[215,373,374],{},"impact"," is what keeping it costs.",[166,377,378],{},"An absence of local references is not enough. Public APIs, exported packages, plugin entry points and\nanything configured from outside the repository are never treated as unused just because the\nrepository does not call them. A passed date alone does not make a TODO stale.",[166,380,381,382,385,386,389,390,392],{},"The Hygiene methodology instructs models never to rate a finding ",[215,383,384],{},"critical","; its ceiling is ",[215,387,388],{},"high",".\nThis is guidance to the model, not a server rule: a ",[215,391,384],{}," hygiene finding that does come back is\nstored as reported. Reclassify it in triage.",[166,394,395],{},"Deterministic tools such as knip, depcheck, cargo-udeps and Renovate remain better at exact\ndependency detection. Hygiene focuses on the judgment calls those tools cannot make.",[397,398,266],"h3",{"id":399},"kept-on-purpose",[166,401,402,404,405,407,408,267,410,413],{},[203,403,266],{}," is how Hygiene shows ",[215,406,270],{},": the item is real cruft, but not worth removing.\nIt stays open, drops out of the actionable views, and does not block the PR gate. It is not the same\nas ",[203,409,328],{},[215,411,412],{},"false_positive","), which says the finding is wrong.",[335,415,278],{"id":416},"pipeline",[166,418,419],{},"Pipeline is in beta.",[166,421,422,423,426],{},"Pipeline is ",[203,424,425],{},"static only",". It reads your CI configuration, build files and test harness, and the\nscripts they invoke. It reads no timing data and never runs builds, tests or benchmarks to measure\nthem. TheSpider is not a CI timing dashboard.",[345,428,429,432,437,446,455],{},[348,430,431],{},"Findings cite the CI, build or test file lines that cause the cost.",[348,433,434,436],{},[215,435,374],{}," states the saving structurally, for example \"skips 4 of 7 jobs on docs-only PRs\" or\n\"builds the image once per pipeline instead of three times\". It never states minutes.",[348,438,439,267,442,445],{},[203,440,441],{},"Cost driver",[215,443,444],{},"cost_driver","): where the time or compute goes, what triggers it, and whether it\nsits on the merge or critical path.",[348,447,448,267,451,454],{},[203,449,450],{},"Verification plan",[215,452,453],{},"verification_plan","): which job durations or pipeline counts to compare in\nyour own CI before and after the change.",[348,456,457,459],{},[215,458,370],{}," is the change, plus what keeps correctness and security coverage.",[166,461,462,463,466,467,470,471,473],{},"Severity follows two axes. ",[203,464,465],{},"Frequency",", highest first: every pull request, every commit to the\ndefault branch, nightly or tag pipelines. ",[203,468,469],{},"Kind",", highest first: latency on the merge or critical\npath, a full redundant job of compute, part of a job. ",[215,472,384],{}," is reserved for exceptional,\nclearly evidenced blockage of the merge path on every pull request.",[166,475,476,477,480],{},"Limitation: inline test modules, for example Rust ",[215,478,479],{},"#[cfg(test)]"," blocks inside source files, are\noutside the starter test-harness pass. The model still follows the CI test commands into them.",[166,482,483],{},"Optional timing ingestion (JUnit or CI durations) is a possible follow-up, not part of this profile.",[312,485,486,487,491,492,494,495,310],{},"The ",[488,489,490],"em",{},"Pipeline profile"," audits your CI configuration. It is unrelated to running the\n",[306,493,77],{"href":78}," ",[488,496,497],{},"in your CI pipeline",[335,499,501],{"id":500},"hardening-note","Hardening note",[166,503,504,506,507,510],{},[203,505,501],{}," is the one label for ",[215,508,509],{},"evidence_basis = speculative"," in every profile. What it\nmeans depends on the profile:",[170,512,513,522],{},[173,514,515],{},[176,516,517,519],{},[179,518,181],{},[179,520,521],{},"A hardening note is",[195,523,524,532,539],{},[176,525,526,529],{},[200,527,528],{},"Security, Bugs",[200,530,531],{},"A hardening observation rather than a demonstrated exploit or failure path",[176,533,534,536],{},[200,535,248],{},[200,537,538],{},"A removal that could not be fully confirmed, such as a symbol still exported from a package other repositories could install",[176,540,541,543],{},[200,542,278],{},[200,544,545],{},"A cost that depends on runtime behaviour the files do not show, such as test duration or cache hit rate",[335,547,549],{"id":548},"cross-profile-identity","Cross-profile identity",[166,551,552],{},"Findings, dedupe and triage are project-wide, so one finding can collect reports from several\nprofiles.",[345,554,555,566,569],{},[348,556,557,558,561,562,565],{},"The merge guard reads each finding's categories through the ",[203,559,560],{},"starter"," category codes of the\nfour profiles. When the two sets map to different profiles and either side maps to Hygiene or\nPipeline, the pair never merges automatically and no AI adjudication is spent on it. A Hygiene\n\"unused dependency\" on ",[215,563,564],{},"package.json"," therefore cannot absorb a Security \"supply chain\" finding on\nthe same file.",[348,567,568],{},"The guard is not a guarantee. Findings with empty or custom categories are not covered and can\nstill merge across profiles, and a custom category that reuses a Hygiene or Pipeline starter code\ncounts as that profile. A finding whose categories span Hygiene and another profile can merge with\neither.",[348,570,571,572,574],{},"A merge can erase a ",[203,573,266],{}," decision: the surviving finding keeps its own status.",[335,576,77],{"id":577},"pr-gate",[166,579,486,580,582,583,586],{},[306,581,77],{"href":78}," runs exactly ",[203,584,585],{},"one"," profile: the project default.",[345,588,589,592,595],{},[348,590,591],{},"Switching the default away from Security removes security gating on every PR. TheSpider does not\nrecommend it.",[348,593,594],{},"A Hygiene default fails PRs on cruft.",[348,596,597],{},"A Pipeline default fails PRs on pipeline findings.",[166,599,600],{},"Run Hygiene and Pipeline as scheduled or manual campaigns instead.",[166,602,603,604,607,608,611,612,614,615,618,619,621,622,624,625,628,629,632],{},"Because of this, choosing Hygiene or Pipeline as a ",[203,605,606],{},"new"," project's first audit (the dashboard's\n",[203,609,610],{},"New project"," form, ",[215,613,320],{},", or the MCP ",[215,616,617],{},"thespider_init"," tool) keeps Security as\nthe project default. The first audit runs with an explicit ",[215,620,260],{}," or\n",[215,623,289],{},", and the commands TheSpider prints include it. To gate pull requests on another\nprofile, an admin changes ",[203,626,627],{},"Default profile"," in the project's ",[203,630,631],{},"Settings",", which warns before a\nnon-Security default is saved.",[335,634,636],{"id":635},"cost","Cost",[166,638,639,640,643],{},"A campaign plans 6 slices per enabled model (2 passes × 3 buckets), the same as Security and Bugs.\nModel enablement is per profile (",[203,641,642],{},"Settings → Models","). Projects that existed before these profiles\nwere added got Hygiene and Pipeline with their default profile's model enablement.",[166,645,646],{},"An incremental Pipeline campaign over application-only changes plans zero slices: no CI, build or\ntest file changed.",[335,648,309],{"id":649},"agent-versions",[166,651,300,652,310],{},[203,653,303],{},[345,655,656,663],{},[348,657,658,659,329,661,310],{},"thespider-agent 0.6.0 and older fail on a project whose default profile is Hygiene or Pipeline\nunless you pass ",[215,660,217],{},[215,662,238],{},[348,664,665,666,669,670,621,673,310],{},"They also fail to load a committed ",[215,667,668],{},".thespider\u002Fconfig.toml"," with ",[215,671,672],{},"profile = \"hygiene\"",[215,674,675],{},"profile = \"pipeline\"",[166,677,678,681],{},[215,679,680],{},"setup"," therefore writes that line commented out:",[683,684,689],"pre",{"className":685,"code":686,"language":687,"meta":688,"style":688},"language-toml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# profile = \"hygiene\"   # requires thespider-agent >= 0.7.0\n","toml","",[215,690,691],{"__ignoreMap":688},[692,693,696],"span",{"class":694,"line":695},"line",1,[692,697,686],{},[166,699,700,701,329,703,705,706,709,710,713,714,717],{},"Pass ",[215,702,260],{},[215,704,289],{}," to ",[215,707,708],{},"run",", ",[215,711,712],{},"daemon"," and ",[215,715,716],{},"findings"," instead, until\nevery machine on the project runs 0.7.0 or later.",[719,720,721],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":688,"searchDepth":723,"depth":723,"links":724},2,[725,729,730,731,732,733,734],{"id":337,"depth":723,"text":248,"children":726},[727],{"id":399,"depth":728,"text":266},3,{"id":416,"depth":723,"text":278},{"id":500,"depth":723,"text":501},{"id":548,"depth":723,"text":549},{"id":577,"depth":723,"text":77},{"id":635,"depth":723,"text":636},{"id":649,"depth":723,"text":309},"What Security, Bugs, Hygiene and Pipeline find, and what they don't","md",null,{},{"icon":65},{"title":112,"description":735},"HlTtIVdo4c1MQree_s4wDUl3elogvCL1EwnHsQaWuxY",[743,745],{"title":107,"path":108,"stem":109,"description":744,"icon":110,"children":-1},"Let a local model fix findings, retest each one, and repeat until the backlog is clear",{"title":122,"path":123,"stem":124,"description":746,"icon":117,"children":-1},"When to run TheSpider on your own infrastructure",1792198238911]