| If you want to | Read |
|---|---|
| clean up an incident, start to finish | ../README.md |
| recover a personal GitHub account | ../github-account-recovery/README.md |
| recover an organization | ../github-org-recovery/README.md |
| check or clean one computer | ../machine-cleanup/ |
| run the scanner in CI | ../ci/README.md |
| understand the indicator set | ../ioc/README.md |
| know when the indicator set was last reviewed | indicator-reviews/ |
| change this repository, or point an agent at it | ../AGENTS.md |
| know why it works the way it does | adr/ |
| know what this tool does not promise | ../DISCLAIMER.md |
adr/ holds one record per design decision that could reasonably have
gone the other way, each with the reasoning and the cost.
Start there if you are wondering why something is missing rather than how to use it. Common questions it answers:
- Why is
node_modulesnot scanned? - Why does a colleague's name on a hostile push not clear them?
- Why does rewriting history not remove anything from GitHub?
- Why is the evidence directory deleted on restart?
- Why does a failed scan not report as clean?
img/ holds the artwork used by the README. Nothing reads it at runtime.