Source: usestrix/strix License: Apache-2.0 Runtime state: ACTIVE_BOUNDED_DEFENSIVE

Allowed: defensive code review, authorized app security assessment, CI security checks, finding remediation, re-test of owned/authorized targets. Denied: unauthorized targeting, credential theft, persistence, destructive exploitation, stealth/evasion, lateral movement, mass scanning. Execution requires explicit target authorization and isolated sandbox/tool runtime. Evidence: target authorization, scan configuration, findings, remediation diff, re-test result. Boundary: SECURITY_CAPABILITY != OFFENSIVE_AUTHORITY; FINDING != EXPLOIT_AUTHORIZATION; ORION = ADVISORY_ONLY.