Low, balanced, max
Every workflow ships with three profiles. What each one changes, and when each is the right choice.
A profile is how hard a Midkernel Scan run tries. The workflow says how to audit. The profile says which models to use, how many passes to take, and how long the run may spend.
The same workflow on low and on max reads the same instructions. It reaches different depths. Choosing the profile is the main decision before a run. This note is the manual for that choice.
How credits work lives on Pricing. This page is the profiles: models, depth, time caps, and when to pick each one.
What a profile sets
Three things, all of them in the workflow's manifest, and all of them visible before you run.
The models. low uses fast models (the ones that answer in seconds and are good at the obvious). balanced uses leading models. max uses the strongest models available for the task. The exact model and version are shown on the pre-run screen and recorded on the run.
The depth. low makes one pass through the scope. balanced makes two, and verifies each candidate finding before reporting it. max makes repeated passes, verifies everything, and spends its budget chasing the findings that are hardest to confirm.
The budget. Each profile carries a cap on model spend and a time limit (an hour on low, 24 hours on balanced, 48 hours on max). A run that reaches its cap stops, reports what it has, and says on the report that it stopped early.
same workflow text
profile
- low
- balanced
- max
The workflow text does not change when you pick a profile. The profile changes the models, the number of passes, whether findings are verified, and the time cap.
| profile | models | depth | time cap |
|---|---|---|---|
low | fast | one pass | one hour |
balanced | leading | two passes, verify each candidate | 24 hours |
max | strongest | repeated passes, verify everything | 48 hours |
When to use which
low is for pull requests, triage, and first looks. It is fast enough to run on every change and cheap enough that nobody has to think about it. It will find the injection in the diff. It will not trace the authorisation gap three files away.
balanced is the default for a reason: it verifies before it reports, and it is the right depth for a repository audit you will read carefully. If you run one workflow on a repository once, run it here.
max is for the runs you sign your name to. A release audit. A bounty target. A repository you have already run on balanced and want to squeeze. It is the profile most likely to produce a finding with a proof you can hand to someone. Read the pre-run screen before you start. Credit math is on Pricing.
Tweaking
Profiles are starting points, not tiers. Change the model. Raise or lower the passes. Narrow the scope to one service. Cap the budget at what you are willing to spend. The pre-run screen updates as you go.
A tweaked profile is recorded on the run exactly as it ran, so a colleague can reproduce it. On Team, you can save it as a private fork of the workflow and run it again next month.
- 01start from a profile
- 02tweak it
- 03the run record stores the tweak
The record is the reproduction. A colleague reads the run, not a memory of which preset you clicked.