Report Verification

Every security report Hal produces is a cryptographically signed PDF. The signature does two things: it proves the report came from Hal, and it proves the contents haven’t changed since Hal signed them. If anyone edits so much as a word after signing, the signature no longer matches.

You don’t have to trust that a report is genuine. You can check it.

Verify a report

Hal hosts a verifier at runhal.com/verify. To check a report:

Go to runhal.com/verify.
Drop the PDF onto the page, or select it from your computer.
Read the result.

The verifier tells you one of three things:

Genuine. The report was signed by Hal and has not been modified since signing.
Not a match. The signature doesn’t match Hal’s, which means the file was either changed after signing or didn’t come from Hal.
No signature. The PDF doesn’t contain a signature at all, so it isn’t a Hal-generated report.

Your document never leaves your browser. Verification runs entirely on your own machine. The PDF you drop in is read and checked locally — nothing is uploaded to Hal or anywhere else.

What verification proves

A genuine result confirms two facts:

The report was signed by Hal.
The contents are exactly as Hal wrote them — no additions, deletions, or edits since signing.

That covers the cases that matter in practice: someone forwarding a forged report, someone tampering with a real one before passing it on, or you simply wanting to confirm a report you received is authentic before acting on it.

What it doesn’t prove

Verification confirms a report’s origin and integrity. It does not judge the report’s findings — that’s the analysis inside, which the detection pipeline produced. A genuine signature means “this is really Hal’s report, unaltered,” not “the conclusion is correct.” The two are separate questions.

Viewing the signature in a PDF reader

Most people will read Hal reports inline — in email, in their portal, or in a browser — and never see signature details, because those viewers don’t display them. That’s expected. The signature is there for verification on demand, not for passive display.

If you open a signed report in a full PDF reader such as Adobe Acrobat, you may see a note that the signer’s identity is “unknown” or “not trusted.” This is normal and does not mean the report is invalid. It only means your reader doesn’t recognize Hal’s signing identity on its own. The reader will still confirm the document hasn’t been modified since signing, and the verifier is the authoritative way to confirm the report is genuinely Hal’s.

Detection Pipeline Glossary