What isn't

• Traffic from certificate-pinned apps. It can't be inspected, so it is blocked rather than leaked, with a one-click bypass.
• Anything a service reads server-side — an AI connector pulling from your cloud drive never crosses your machine, so no local tool can see it.
• Files Saibre can't safely rewrite (encrypted PDFs, exotic encodings) are flagged or blocked, not silently passed.

Saibre reports its own coverage per app — protected for all users, partial, or none — so a gap shows up in the interface, not in an incident.