Skip to content
Proofsheetby FedPulse
Menu
Generate a report

How the app works

Proofsheet is software. It reads your file automatically, in minutes, and never runs it. No human opens your file. Here is each step, and what the software cannot do.

  1. You upload one file

    A firmware image, a phone app or a desktop program, up to 200 MB. You confirm you own it or have permission to analyse it.

  2. The app unpacks it

    It opens archives and firmware containers (gzip, tar, zip, cpio and disk partitions) and finds the programs inside. Nothing is run.

  3. The app lists the parts

    It reads names and versions from the files themselves: libraries, packages, the kernel, bundled apps. Each part keeps a note of where it was found.

  4. The app matches each part

    Exact versions are matched against the NVD, the public US list of known vulnerabilities. A match on a version range is labelled as such. Vulnerabilities on CISA's list of known exploited vulnerabilities are marked.

  5. The app flags common patterns

    Old encryption, keys or passwords left in the file, plain http addresses, unsigned programs, debug settings and update paths.

  6. The app generates the report

    A grade, the parts ranked by risk and every finding with its evidence. Then the Annex I map and the document pack.

Every line has its evidence

Each finding says where in the file the app saw it, which database matched, and which version. There are three states: evidenced, partial and open. Finding nothing is never called evidence. It is marked partial, with the reason.

What a file cannot show

  • Encrypted firmware: the app cannot open it, and the report says so.
  • How the product behaves when it runs: data use, logging, resilience to attack, secure reset.
  • Whether your update server can be trusted end to end.
  • Parts that live outside the file, such as your cloud service.
  • Changes a Linux distribution backported without changing the version number. The report flags where this may apply.

Your file

The uploaded file is deleted within 24 hours. The report stays for 30 days. No human opens your file. You must own the software or have written permission to analyse it.

Generate a free report