Discovery Safety Boundaries and Common Limitations

QCDR Discovery is a private diagnostic tool for finding, explaining, and scoping rendered frontend output. It is intentionally bounded: it does not edit source files, silently save or enable Rules, guarantee exact source attribution, or turn a browser-side observation into automatic targeting.

Understanding those limits makes Discovery useful without treating diagnostic evidence as stronger than it really is.

Who Can Run Discovery

Discovery is a Max/All Access feature. The administrator must be signed in, have QCDR management access, and have Run Discovery permission; Super Users satisfy those authorization checks automatically. QCDR issues a signed, user-bound authorization that expires after 15 minutes. When it expires, start a fresh session from the Discovery tab.

Discovery Is Limited to This Joomla Site

The private inspector is designed for normal frontend URLs on the same Joomla site. External origins and real /administrator routes are blocked. Site Impact Scan also rejects obviously destructive paths and query parameters such as logout/delete/remove/destroy-style actions before it fetches a page.

Private Discovery responses use no-store/no-cache/noindex protections and a no-referrer policy. That protects the temporary authorization carried in the private URL, but it does not make Discovery a security scanner for the site.

Evidence Is Ranked, Not Assumed

Discovery distinguishes evidence strength. Exact QCDR runtime markers and certain render-boundary observations can be PROVEN; stored Joomla/template/language correlations may be HIGH, MEDIUM, or LOW. A candidate is evidence to investigate, not permission to rewrite a file or retarget a Rule automatically.

Dynamic DOM Watch is even more specific: it proves that the browser DOM changed after the watch began. It does not identify the exact JavaScript file, AJAX response, or call stack responsible for the mutation.

Scans Are Deliberately Bounded

  • Page Scan analyzes the current page; it is not a site crawler.
  • Site Impact Scan de-duplicates and caps a run at 40 safe frontend pages, including at most 20 manually entered URLs.
  • Each remotely fetched impact page is limited to HTML, a 12-second request window, and 5 MB of response text.
  • Dynamic DOM Watch stops after 60 seconds or 600 mutation records and retains a bounded result list.

Discovery Never Publishes a Change for You

Creating a Rule from Discovery opens an unsaved Draft in Administrator. QCDR may prefill the observed find value, current page scope, safe render-boundary context, notes, and a Target Fingerprint, but you remain responsible for reviewing, saving, Previewing, and enabling the Rule.

Target Fingerprints remain advisory after save. Rule Health may report exact, likely, weak, or missing evidence as the site changes, but QCDR does not silently rewrite the Rule target.

Use the Right Tool for the Missing Evidence

If Discovery shows only weak correlation, use Joomla configuration, template overrides, browser developer tools, network inspection, or the owning extension's diagnostics to continue the investigation. Discovery is strongest when it can prove rendered-output context; it is not a substitute for a PHP debugger or JavaScript profiler.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.