Where to post
Five categories. If you are not sure which, the first one is almost always right, and nothing is lost by guessing wrong.
It got this wrong
A score, a finding, or a silence you think is mistaken. The most valuable thing on this page, and the category most likely to change the tool. A false positive and a miss are equally worth posting.
Rule ideas
A flaw it should catch and does not. Describe how it shows up in real code rather than supplying a pattern, because the pattern is the easy half.
Setup and help
Getting the optional deep pass working, local model runtimes, or an artifact it declined to read. Answers can be marked as accepted here, so a question that gets solved stays useful to the next person who asks it.
Announcements
Releases, and changes worth knowing about before you update. Worth subscribing to if you use Halation regularly, since this is where a change in what a score means gets said out loud.
A result that looks wrong
The most useful report there is, and the one worth spending two extra minutes on. What makes one actionable:
- What you scanned, and where it came from, with a link if it is public
- The score and the finding, or the finding you expected and did not get
- Why you think it is wrong, which is the part only you can supply
If it is your own application and you can share the source, say so. A false positive is far easier to settle against real source than against a decompiled binary, because decompiling throws away every comment in the file and the comment is usually where the author already explained why the alarming-looking thing is fine.
The results screen has an Export report button. Its Markdown export produces the findings, the score and the receipt of what the scan actually did. Pasting that is more use than a screenshot, because the receipt says what was read and what was skipped.
A check it should have
Say what the flaw is and how it appears in real code. What decides whether a rule can exist is not the pattern: it is whether both severity judgments can be made honestly, and whether it stays quiet on ordinary code.
Every finding is rated twice, once for whoever ships the application and once for whoever runs it, and those genuinely differ. A committed private key is critical for the developer and close to nothing for the person who downloaded the app, because it is the author's key being burned rather than theirs. A rule that cannot answer both questions is not ready, whatever its pattern matches.
The rule reference lists all thirty-nine that exist today, so you can check whether something is already covered under a name you did not expect.
Something it would not read
Coverage is bounded by what can be recovered, not by the rule table, so an artifact it declined to open is worth reporting even though it is not a wrong answer. It is also the failure that matters most, because a tool that cannot read your application is of no use to you no matter how good its checks are.
Include the kind of artifact and how it was built. Solid-compressed NSIS installers and Inno Setup installers are both known and stated limits rather than surprises, and the recovery table says what each kind of artifact yields.
What goes somewhere else
Use private vulnerability reporting rather than a discussion. The line is narrower than it sounds, and it is worth stating because for a scanner almost anything can be described as a security issue: the question is whether an application being scanned can do something to the person scanning it. A crafted archive that makes Halation write outside the folder it was given, or a path that leaks your API key, belongs in a private report. A wrong score does not, and never did.
One maintainer and a security tool, where a narrowed pattern suppresses findings as easily as a widened one adds them. The guarantee is that every line in a release was written by its maintainer. The reasoning is written down, and since the licence is MIT you can fork it, change whatever you like and ship your own build. Nothing restricts what you do with the code; it only decides what goes out under this name.