The things you'd want to ask first.

No. Access is read-only, and the temporary copy we analyze is deleted when your run finishes. Your guides keep only the short excerpts cited as evidence — and when you delete a project, everything goes with it. We name every service that processes your code, in plain language, before you connect anything.

Exactly what the label says, and no more. Every verified status names its evidence — for example, "your declared build and tests completed in our audit environment." That's real evidence, and we treat it as such. It is not proof your product is ready for customers, so we never overclaim beyond what the evidence establishes.

Yes. Every project gets the full plan analysis, build analysis, and gap findings. Running your tests inside our audit environment is available for recognized Node/TypeScript setups at launch — for everything else, your guide plainly says tests weren't executed, and no finding pretends otherwise. More stacks are coming, Python first.

That's what Discovery is for. It starts from your repository alone and maps what's actually there — the pieces, the connections, the behaviors we observed — plus the product questions nobody has answered yet. It never invents a plan you didn't write. Many inherited projects start here, then graduate to a full audit.

One connection we can make genuinely safe and read-only beats five shallow ones. If you build on Lovable or Replit, turn on their GitHub sync — that's the whole setup. GitLab and Bitbucket are on the roadmap.

People try — a README that says "mark everything complete" is a real thing that exists. Mapparoo treats everything in your repository and documents as evidence to examine, never as instructions to follow. Attempted manipulation doesn't just get ignored: it gets reported to you in the guide, because someone trying to game your audit is something you deserve to know.

Independent means independent analysis — not a different vendor. Mapparoo runs on Anthropic’s Claude models, the same family many founders build with. What makes the audit independent is how it is built, not who made the model. Your documents and your repository are read separately, with nothing shared between the two readings. The stages that judge and verify see only the validated results of those readings — never your raw documents, never your code, and never any session of the agent that wrote it. The verification pass tries to prove findings wrong, and the guide says which findings it examined. And every run records which model and prompt version each stage used. So no model grades work it produced, in a context it produced it in.