The question pool

A sitting draws 8 of these 169 questions at random. 6 correct is a pass.

Canine Development — studiet 14 questions

Why does Canine Development not take development work?
What is the commercial argument for giving the measure away under Apache-2.0?
“We publish the method before the numbers.” Why does the order matter?
Which products does canine.dev present?
What happened in the winter of 2025?
A journalist asks for our precision rate. What do you answer?
How do transparency, credibility and trust fit together?
Why do we say that trust is not ours to take?
A customer asks whether we are SOC 2 certified. What do you answer?
What must never be said about a green automated score?
Can we tell whether code was written by an AI?
What is the one exception to our transparency?
Why do we name the exception rather than keep quiet about it?
A colleague tells a customer: “we can adjust the number.” What is wrong with that?

Watchdog — produktet og guiderne 107 questions

Watchdog and Assay sit on top of the same measurement. Which question does each of them answer?
Watchdog runs on a calendar, not on pull requests. What does that cadence catch that PR scanning structurally cannot?
A customer asks: “Does it block my merge?” What do you answer?
What happens to the customer's source code during a scan?
What does it mean that depth is never gated? What is the customer paying for, then?
A dimension is reported as not-measured, with a reason. Why not simply 0?
What is the single optional write scope in the GitHub app, and is it on by default?
Why can a seller not touch up their own report before sharing it?
Who is our only real competitor?
What does a customer choose when they choose not to use Watchdog?
“Keep your scanners.” Why is that architecture rather than politeness?
Where does Watchdog explicitly stand aside?
Why can a tool disprove a control but never prove conformity?
What does it take to set a caught failure to Pass?
Which provenance types can a verdict carry?
Where is the authoritative list of which languages we examine, and how deeply?
Why do providers and consultancies sit in the overlap between the two products?
Why are there two pricing models — and what is the logic behind the split?
What is a line-scan?
A customer has built their product in five languages instead of one. What does that do to the price?
What is NOT included in every Watchdog package?
Watchdog's price is the volume bucket multiplied by the value of the package's modules. What is remarkable about that formula?
An agent has fixed a finding and called resolve_finding. When is the finding credited as resolved?
Why is there no write-to-repo tool in the MCP surface?
An agent believes a scored finding is a false positive and calls dispute_finding. What happens then?
Which two of these does Watchdog measure as hollow code — code that looks finished and does nothing?
A finding's identity is a hash of dimension, title and file — but never the line number. Why does that matter?
No scanner is accepted as proof of accessibility conformity under the EAA. So what is our role?
What does it take to mark a criterion as passed when the measurement caught it failing?
A dimension cannot be measured — the test suite will not run. What does the report say?
A customer's security auditor asks: where do you store our source code?
Which language model sees the customer's code?
Who is on the sub-processor list — the whole list?
“Do you have SOC 2?” What is the right answer?
A customer uploads code as a ZIP instead of connecting a repository. Why is it not deleted when the scan ends?
What applies to publishing on the free plan for open source?
A customer wants to be deleted. How does that work?
Which permissions does Watchdog's GitHub app ask for?
A customer asks where their source code ends up. What is the correct answer?
Why is an uploaded ZIP not deleted immediately, the way a cloned repo is?
Do we send the customer's code to OpenAI, Anthropic or Google?
What can the language model's advisory reading affect?
Can Watchdog change anything in the customer's repository?
A customer asks whether GitHub is one of our sub-processors. What do you answer?
What does the Ed25519 signature on a delivery package prove?
How is access to the reports we store controlled?
What does Watchdog add compared with a plain CVE list?
A customer asks whether their existing SAST tool affects the score.
What happens when a required tool cannot run?
Why can a vulnerability result change without the code having changed?
What does the security watch that runs every day actually run?
What does the daily security watch cost?
What is the difference between reproducing a survey and verifying a delivery?
A repository has no infrastructure manifests. What happens to that dimension?
What does a short list of findings mean?
Which four levels does the engine have, and what reaches the list?
How is the remediation plan sorted?
An agent calls resolve_finding. Is the finding closed by that?
What does a rescan establish when a fingerprint is no longer produced?
What is Watchdog's design target for noise in findings?
When is flag_advisory used rather than dispute_finding?
An agent key is scoped to one repository. What happens on a call outside that scope?
How are the five classes of automated check ranked?
A check runs in the pipeline but cannot fail the build. What is that called?
What does a red gate coverage card mean?
Two gaps measure equally badly. What decides the order?
What happens to a class the survey could not measure?
Which error does the detection work hardest to avoid?
What does NOT count as an invocation for the detection?
All five classes show as enforced. What does that mean?
What happens to the reports when a repository is disconnected?
How does a customer close their account?
A customer on a paid subscription asks whether the reports become public.
According to the data processing agreement: what may we do with the customer's repository?
Which personal data do we process according to the data processing agreement?
Who are the data subjects under the data processing agreement?
What does each framework in the catalogue show before you switch it on?
What is the same for all ten frameworks in the catalogue?
How can risk arise without anyone having changed a line of code?
What is the cadence of the full survey?
A customer asks why licence compliance is not checked daily.
What does a dimension do when a collector cannot read the ecosystem at all?
What half-life does the decay model behind the history dimensions use?
Bus factor findings name people. Who can see the names?
Do we compute a score per developer from the history?
Which two floors keep the history dimensions honest?
What is the architecture view — and what is it not?
Does the architecture view add new findings?
What does a red edge in the component graph mean?
A context shows as “clean”. What does that mean?
Why are boxes coloured by density rather than by number of findings?
A box shows “CAI 85 · findings poor”. Is that a contradiction?
What does the deployment view show — and what does it not?
What happens if a repository does not qualify for a diagram?
A customer asks whether the free first report is the whole story.
What is the free baseline tied to?
Is the free baseline a reduced version of a paid one?
Where do the cutlines between the CAI bands fall?
Which five lenses are always on?
One lens reads Critical, but the others are strong. What happens to the number?
What does the published rubric contain?
What happens to a dimension that cannot be measured on the repository?
A dimension cannot be measured because the project will not build at our end. What does the report say?
A customer asks whether the analysis runs with no internet access at all. What is the precise answer?
When is the content of an already published rubric version changed?
Why does every Watchdog report say “NOT ATTESTED”?
A repository is used to measure our own error rate. When does it count as validation?

CAI — standarden 22 questions

Who owns the CAI number?
Which of these lenses is NOT always on?
When does a conditional lens switch on, and what happens to the weights when it does not?
What is the reproducibility invariant?
Where are the bands cut, and what are they called?
What is the cap, and which problem does it solve?
What does a contractual floor of CAI ≥ 80 consist of?
Describe the firewall. What stands on each side, and what is the rule?
A customer files a compliance statement and suppresses a finding. What happens to the CAI number?
What do hotspots, bus factor, knowledge freshness and change coupling have in common?
If the methodology page and the specification disagree — which wins, and where is that written?
What do the signature and the content hash prove together?
A customer asks where they can see other people's measurements. Where do you send them?
Is everything on codeassuranceindex.info/surveys measured by Watchdog?
What is the trust invariant behind a shared delivery?
What, according to the CAI page, is the registry NOT?
When does the rubric version bump?
What happens if a scoring change is not in the public spec?
A customer has frozen the rubric for the life of the contract. Can the number still change?
What happens to a finding confirmed as a false positive?
What can the open reference scorer do?
The open scorer and a published report give different numbers. What does that mean?

Assay — købersiden 26 questions

What does the evidence package cost the buyer, and what are they paying for then?
What are the two entry flows into an Assay assessment?
What do all the reports in Assay's catalogue have in common?
What does “one evidence, many reports” mean for the price when three parties want to read the same code?
Why is consent built into the flow where the seller shares?
A freelancer and a house of forty developers are measured with the same rubric. Why is that a selling point rather than a limitation?
In a tender it is the suppliers' code that gets measured. Who should own the Assay subscription?
Which two numbers does a non-technical owner get that their own development team never gives them?
What is the difference between rebuild cost and value-at-risk?
Why is a bidder's hesitation about accepting the quality clause itself information?
Which audience page would you send to an insurer's underwriter?
What does a frozen rubric mean for a deal, concretely?
The owner of a group needs to rank forty codebases across subsidiaries and see which one is quietly rotting. Which report?
A supplier has scanned and shared their evidence with a buyer. What is the buyer paying for?
A customer calls: “We are going to buy a software house. What does it cost?” What is the right answer?
What do the contract annex and the delivery attestation do to the number?
What does the attestation say about what has been suppressed?
Why is the rubric frozen at contract signature?
Which two money figures does Assay read out of the evidence?
What happens to a control the measurement catches failing?
Who certifies in the compliance model?
Which frameworks come first in Assay's compliance home?
Why is the due diligence dossier worth citing for both parties?
What does Assay receive when a buyer asks for a decision report?
A buyer cannot get a report because the supplier has not shared evidence. What does Assay do?
What is the difference between the producer's quality standard and the buyer's acceptance profile?