Documentation

Run it from a terminal, or from your pipeline.

Everything here describes commands and flags that exist in the shipped CLI. Where a capability has a limit, the limit is stated with it rather than left for you to find.

Command-line interfaceScan a repository without uploading it, scan a container image, or drive the deployment's API from a terminal.

API keysBearer tokens for the CLI and CI, scoped to the role of the account that created them.

Gating a pipelineFail a build on a severity threshold you choose, using the same engine that runs in the product.

WebhooksWhere a monitoring result goes when nobody is looking at the dashboard.

Keep reading

Where most people go next

Code and dependency securityVulnerable packages, committed secrets, container misconfiguration, and risky code patterns.

Teams and access controlOrganizations, roles, API keys, two-factor authentication, and a tamper-evident audit log.

Talk to usA question the pages did not answer, or a security issue to report.

Talk to us.

Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.

01You writePlain form, no qualifying call, no obligation. The marketing checkbox is optional and unticked.

02A person reads itMessages land with the team, not a queue-bot. Nothing is auto-replied.

03You get an answerTo the address you gave — including “this product is not the right fit”, when that is the honest answer.

Prefer email?

Use the form — no address is published on this deployment.

Reporting a vulnerability?

Read the disclosure policy first — it tells you what is in scope and what to expect.