Antivirus Compatibility
AMWScan can coexist with antivirus products without treating malware samples as ordinary project files or package contents. Its scanner definitions can still be flagged because they contain detection patterns, but AMWScan reads those patterns as data and does not execute them. Antivirus acceptance and scanner detection accuracy are therefore separate outcomes.
Validated definition bundles
Release packages contain an AMWDB bundle: a gzip-compressed TAR archive with a manifest plus signatures, exploits, hashes, and function definitions. Before the scanner uses it, the archive reader rejects links, unexpected or missing files, oversized content, invalid manifests, checksum mismatches, and engine-version incompatibility. It also validates the definition data, including its regular expressions and indexes.
Definition updates are downloaded into private staging storage and activated only after the complete bundle passes validation. If an update fails, the scanner retains its last verified bundle instead of scanning with incomplete definitions. A missing or invalid bundle stops the scan rather than producing a clean result. See Threat Definitions & Detection Levels for supported definition controls.
Isolated regression corpus
The default checkout and ordinary unit and integration suites do not require a malware corpus. They use harmless operational fixtures and inert rule-boundary markers.
Tests that require real samples run only through the dedicated composer test:corpus suite. It requires an explicitly provisioned AMWSCAN_CORPUS_DIR; no corpus is downloaded automatically. The test resolver rejects absolute paths, traversal, and resolved paths outside that directory. Before a corpus run, it verifies every required sample against the versioned manifest's file size and SHA-256 value. Tests read samples as bytes and do not include, evaluate, serve, invoke, or execute them.
Release package contents
Source archives exclude tests, test-files, local research directories, and corpus directories. Release checks for PHAR, Docker, and WordPress packages reject those paths while requiring the runtime AMWDB bundle. This keeps test material out of published artifacts while keeping the definitions needed for offline scans.
Vendor results
No reproducible vendor observation is currently recorded for this project. A vendor result is attributable only when it identifies the product and engine versions, detection name, affected path, exact artifact SHA-256, and scan date. Only benign definition files or release artifacts are false-positive candidates; real malware samples are never submitted for vendor correction.