What scanner output would feel fair to maintainers?

[rossbuckley1990-hash]

Actenon includes a local advisory scanner for candidate AI-controlled consequential action paths.

The scanner is intended to map possible action surfaces. It should not accuse maintainers of shipping vulnerabilities.

Current scanner principles

Scanner output should clearly state:

• not a vulnerability claim
• runtime reachability not proven
• exploitability not proven
• production exposure not proven
• business impact not proven
• manual review may be required

Preferred language:

Critical-impact candidate action path, if reachable and ungated.

Avoided language:

Critical vulnerability detected.

Question

For open-source maintainers and security reviewers:

What scanner wording would feel useful rather than accusatory?

Useful feedback could include:

• better terms than “critical-impact candidate”
• what evidence should appear in each finding
• how to separate runtime source findings from tests/examples
• when a scanner report should recommend private disclosure
• how to avoid “sales scanner” behaviour
• what remediation language would be helpful

The goal is scanner output that teaches maintainers something useful even if they never adopt Actenon.