Getting started

Open Sign up and enter your organization name, your name, a work e-mail address and a password (twice). Signing up creates your organization workspace and makes you its owner; you are signed in right away.

Passwords are checked against the password policy (length and complexity) when you submit the form.

After sign-up a banner asks you to verify your e-mail address. We send a verification link to the address you entered; opening it confirms the address and the page shows E-mail verified.

Until the address is verified you can sign in, browse, create projects and upload artifacts, but you cannot run analyses, export reports or create API keys. The link is single-use; you can request a new one from the banner.

Go to Projects and choose New Project. Give the project a name (for example S/4HANA 2023 upgrade preflight) and pick the target release. Open it with Enter Workspace.

A project is the unit of work: its artifacts, analysis runs, findings and reports belong to your organization only.

In the project open the Artifact Dropzone tab and drop or select files — several at once, up to 100 MB each (the operator can change the limit in Admin → Storage). Any file can be uploaded:

• .xml, .json, .csv, .abap, .txt and similar exports are analysed directly; CSV and text in UTF-16 or Windows-1252 and with semicolons, tabs or pipes (SAP GUI "Text with tabs", "unconverted" lists) are converted to UTF-8 CSV first;
• workbooks (.xlsx, .xlsm, .xls, .ods and SAP "Excel (MHTML)" / HTML exports) are read sheet by sheet: every sheet with data becomes a table of its own (CSV) that the checks analyse; dates keep their date;
• a .zip bundle is unpacked into its files;
• any other file (Word, PowerPoint, images, PDF) is kept as a document for reference — it is scanned and stored, but no check reads it;
• only programs, scripts and active web content (for example .exe, .js, .svg) are refused.

Every upload is checked before any engine sees it:

• the file type is detected from its content (magic bytes), not from the extension;
• archives are inspected for zip bombs, path traversal and nesting;
• the file is scanned for malware and stays in quarantine until it is clean;
• in XML, JSON, CSV and ABAP files, secrets such as passwords and API tokens are redacted before the file is stored; ZIP archives are stored as uploaded, and evidence snippets taken from them are redacted during analysis.

The file list shows the scan status (for example CLEAN) and the SHA-256 checksum that later appears in the evidence of every finding. Which format each engine expects is listed in File formats per engine.

Open the Analysis Launcher tab, select the uploaded files and the engines to run, then start the run (Execute Preflight Run). The run is queued and processed in the background; the project shows its status until it is COMPLETED (or FAILED / PARTIAL with the reason).

Engines are deterministic: the same files and the same knowledge snapshot always produce the same findings. See the engine catalog for what each engine checks.

Findings in the project navigation (or Review findings after a run) opens the full table with filters for severity, engine and status. Selecting a finding opens its detail with:

• the finding code, severity (shown as text and icon, never by colour alone) and confidence class (VERIFIED, RULE_DERIVED, INFERRED or UNKNOWN);
• the evidence: artifact path, line and column, code snippet and the SHA-256 of the artifact;
• the remediation text of the rule.

Findings are records of a specific run and knowledge snapshot; re-running creates new findings instead of rewriting old ones.

In Run History each completed run offers Reports: generate a PDF report, Excel (XLSX), CSV matrix, JSON bundle, offline HTML or all formats as ZIP, and download the generated files. Bundle (.zip) downloads the reproducibility bundle of the run.

Exports require a verified e-mail address and are recorded in the audit log.

• Invite colleagues from Settings → Members.
• Create an API key in Settings to use the API and CLI.
• Try the free tools for single questions without a workspace.