The scanner does not execute application code or import a user's project. It cannot prove that a dynamic query, generated file, external service, runtime configuration, custom wrapper, or unsupported API surface requires or does not require a scope. Classic webhook evidence currently covers only products/update and orders/create for app-specific [[webhooks.subscriptions]] using API version 2026-10; shop-specific subscriptions created dynamically through the Admin API are not inspected. Webhook payload filters and delivery destinations are not used to infer scopes. It cannot determine which scopes a merchant actually granted. Protected customer data approval and staff/user permissions are separate prerequisites.