SecHelix security scanner flags incomplete scans as failures, not false passes

A developer has built an open-source application-security agent called SecHelix that deliberately exits with an error when a scan cannot be completed, rather than returning a false all-clear. The tool distinguishes between a lane that was skipped because it was inapplicable, one that was blocked due to missing dependencies or exhausted budgets, and one that genuinely succeeded. A key design choice keeps the verification stage independent from the findings-hunter stage, so the verifier never sees the hunter's confidence labels or notes before examining the code. In a controlled test using a planted fake finding, the verifier correctly refuted the fabricated vulnerability by citing the exact line of code that disproved it. The project is open-source under Apache-2.0 and can be run entirely offline without an account.