Security 51 Anomalies Guide

An anomaly in Security 51 is not automatically a reason to deny someone. It is a piece of evidence that must be interpreted under the current shift's instructions. The same visual category can trigger denial, a security response, a protected exception, isolation, or no action at all depending on the day.

What the official material confirms

Alawar's official description tells players to watch for incorrect answers, behavior that breaks protocol, slurred speech, papers that look suspiciously perfect, identity problems, infection, and other oddities. It also confirms increasingly precise verification tools, quarantine, delayed consequences, and city-scale infection risk.

That establishes the game's evidence model, but it does not establish an exhaustive launch-build anomaly encyclopedia. Specific day rules and named findings below are dated current-build observations. If a patch or your branching state changes the bulletin, the game in front of you wins.

The anomaly categories

Use categories instead of trying to memorize every possible creature or mark.

Documents and behavior come first

Document mismatches are anomalies even when the person looks human. Compare name, both relevant numbers, portrait, role, clearance, destination, and time. The official demo update specifically confirms incorrect passport or pass numbers and forged medical certificates as possible failures.

Behavioral evidence is softer. Slurred speech or an answer that conflicts with protocol is suspicious, but the official page does not publish a fixed penalty for every behavior. Treat behavior as a reason to slow down and run the test the bulletin supports, not as permission to invent a rule.

The Checkpoint Guide gives the full low-cost verification sequence.

External and photo anomalies

Current-build progression introduces a body X-ray early and a camera shortly afterward. Observed daily rules distinguish between a broad external anomaly, a finding in a specific body region, and a photographic anomaly. This distinction matters: “external anomaly,” “neck anomaly,” and “anomaly in the photo” are not interchangeable phrases.

For the photo tool, wait for development and move toward the strongest interference before committing. A weak, unfinished image is incomplete evidence. Some shifts use a photo finding as a security trigger; others use a named photo result as a stronger allow exception. Read the whole bulletin before taking action.

Temperature, organs, and bones

Later Level 1 shifts add deeper scans:

• Thermal evidence separates colder and hotter areas.
• Organ imaging identifies internal abnormalities and named organ-specific findings.
• Bone imaging introduces skeleton and rib-specific checks.

The important lesson is specificity. A bulletin that names a rib anomaly does not necessarily apply the same response to every bone finding. A rule about one organ or one temperature direction does not authorize the same action for the opposite result.

When multiple tools are available, test in the cheapest useful order. If the day's rule is purely document-based, a complete medical sweep wastes time. If a mismatch can be overridden by a thermal or organ result, then the deeper scan becomes necessary only after the mismatch is found.

UV and hidden paper evidence

Level 2 introduces UV inspection of papers in the retained launch-build walkthrough. Hidden marks can have opposite meanings in the same shift: one symbol may require security while another can force an allow. That makes UV a good example of why “anything strange is dangerous” is the wrong mental model.

Place the relevant paper under the tool, inspect the full document, identify the exact named mark, and then reread the override language. A hidden trace is a category; the bulletin tells you what that trace means today.

Blood anomalies

Blood sample analysis arrives later than the early scans. The current-build walkthrough observes the player collecting a sample, examining it with a microscope, and printing the result. Named microscopic findings can again lead to different outcomes. A later tool adds blood type as another result alongside microscopic findings.

Do not use screenshots from another day as a permanent answer key. Match the exact printed name or blood type to the current instructions. The Medical Tests guide covers the sequence and the evidence limits around fingerprints.

Elevator anomalies

The elevator creates a second inspection surface because people can return from the facility changed. Current-build observations show camera modes being used on returning riders, followed by isolation or extermination when the shift provides those choices.

Keep headcount and identity in mind before the elevator opens:

• Is the number returning plausible?
• Is each rider the person who entered?
• Does night vision, thermal imaging, or another active mode reveal a new condition?
• Does today's containment rule say isolate, exterminate, or take another action?

An “empty” or uneventful camera view is not proof that all future elevator trips are safe. Inspect each return when the game provides a reason and a tool.

A practical anomaly decision tree

1. Mismatch in basic identity? Check whether today's bulletin has an override test.
2. Visible or behavioral concern? Identify the named body region or response rule.
3. Photo or UV interference? Finish the image or document inspection before deciding.
4. Deeper scan required? Identify the exact temperature, organ, or bone finding.
5. Blood required? Print the result and match the exact name or type.
6. Returning rider changed? Apply the active elevator containment protocol.
7. No rule matches? Do not invent one. Use the default action written for that shift.

What remains unknown

The retained sources do not prove a complete probability table for every anomaly, a permanent master list of all possible visual variants, or a fixed relationship between every finding and every ending. Visitor order is randomized, and the branching timeline may alter later context. Those limits are why this page teaches categories and instruction matching rather than claiming a definitive monster catalog.

FAQ

Is every anomaly dangerous?

No. Some are disqualifying, some require security, and some are explicit allow overrides. The current bulletin decides the response.

Why did the same-looking anomaly produce a different result?

The rule may have changed, the location may differ, or a stronger override may apply. Compare the exact named condition, not just the visual category.

Are visitors always the same?

No. The retained current-build walkthrough explicitly notes randomized visitors, so another player's order and earnings are not a guaranteed script.

What should I do when I cannot identify a result?

Pause if the game allows it, review the handbook and current instructions, and avoid committing until the relevant image, printout, or scan is clear.

Do anomalies affect the ending?

Official material confirms delayed consequences and multiple endings, but reliable full-release ending thresholds are not yet established here. Exact conditions remain intentionally unpublished.