A report you can check, not just read.
A synthetic example of Checkii's report export and signature format, generated through the platform's report approval and issuance API.
What this demonstrates
The local test used synthetic requester and reviewer accounts, an empty assessment and a dedicated ephemeral signing key. No scan ran and no vulnerability was demonstrated. Zero findings here say nothing about the security of a target. Scope and authorization entries are synthetic fixtures.
The files demonstrate the actual issuance schema and exact-byte signature verification. They contain no request/response transcript or customer evidence.
The bundle
| File | What it is |
|---|---|
| report.md | the report itself |
| snapshot.json | the structured findings the report was issued from |
| signature.json | the signed statement, signature and public key |
| verify.py | a standalone verifier, no Checkii software needed |
| VERIFY.md | the three checks, and what a signature does not prove |
Verify it
Obtain the verifier and key pin from an independently trusted, reviewed source version before checking downloaded artifacts. Do not trust a key merely because it appears in the bundle. Verification instructions provide the key pin, exact-byte digests and the required command.
The verifier requires explicit trusted key arguments and prints
VALID or INVALID. Changed bytes, malformed JSON or a
substituted key fail verification.
The same seven checks run in the browser, with no account and no upload, at checkii.ai/verify, against the published key registry or a key you pin yourself.
What a signature proves
Byte integrity relative to the supplied trusted key. It does not prove a person's identity, a scan's execution, finding accuracy, coverage or compliance. This sample uses a separate key and never the production report-signing key.
What we have not published yet
Independently measured detection quality. The benchmark harness exists and is pinned to exact fixture images, and no results have been produced from it. When they are, they will be published with the method, the corpus digest and the variance across runs, including the classes we miss.