L1 baseline
Checks that need no model. This is what insidia init writes and what a scan runs. Use it on every pull request. The process exits 1 when the policy fails. L2 and L3 are not available.
Policy
The Insidia Benchmark
Run a policy against your app, or explore the public matrix used to test scanner adapters. They provide different kinds of evidence.
Policy
What a run writes
insidia scan --policy L1 writes a directory under .insidia/runs/:
benchmark.json— policy name, pass or fail, control results, and skipsfindings.json— each finding names its engine, probe, severity, and taxonomyresults.sarif— for code scanning in CIreport.html— one file, opened withinsidia report --open
Controls map to OWASP LLM, OWASP Agentic, and OWASP Web and API where the registry has a mapping. MITRE ATLAS is not mapped yet. A framework score is the controls that ran, not a percentage we market on this page.
The scanner matrix
The repository holds sandboxed targets with planted vulnerabilities and a permutation matrix for testing adapters and transports. Passing these fixtures is a regression check; it does not establish detector accuracy on real applications or release readiness. Independent validation is part of the current productization work.