Command-line interface

Install#

Download it from the deployment you signed in to. It is a single CommonJS file with no runtime dependencies beyond Node — nothing to install, nothing to check out, and no package to add to your project.

Run it from the repository you want scanned. `scan-local` reads the directory you invoke it in, not the directory the file sits in, so keeping one copy somewhere convenient and pointing Node at it works fine.

curl -fsSL https://staging.webcuris.com/cli -o webcuris.cjs\nnode webcuris.cjs --help

Local scanning, where nothing leaves the machine#

`scan-local` reads the repository on the machine it runs on. Your **source code never leaves the machine** — only the findings are sent, so the deployment sees "a hard-coded secret at src/config.js line 14", never the file.

Findings are uploaded **by default**, which is what makes them appear on your dashboard. Pass `--no-upload` to keep everything local and print to the terminal only; the command confirms in its output when it has sent nothing.

`--project` names the run so several repositories can be told apart in one terminal session. `--json` prints the full result for another tool to consume rather than the human summary.

node webcuris.cjs scan-local .
webcuris scan-local ./services/api --project=api --json

Container images#

`image` inspects a public registry image: its base distribution, the packages inside it, configuration problems in how it was built, and known vulnerabilities for the packages it can match.

Package counts are a floor, not a total. If a size limit is reached the output says so rather than reporting a smaller number as if it were complete.

node webcuris.cjs image ghcr.io/example/api:1.4.2
webcuris image node:22-alpine --config-only

Stopping a secret before it is committed#

`pre-commit` scans staged changes and exits non-zero if it finds a credential. `install-hook` writes it into `.git/hooks/pre-commit` for you; pass `--force` to replace an existing hook.

This is the cheapest place in the whole system to catch a secret. Once a credential reaches a remote, rotating it is the only real remedy — deleting the commit is not one.

node webcuris.cjs install-hook
webcuris pre-commit

Driving the deployment remotely#

`scan` runs a website assessment against a URL. `--deep` requests the checks that need proven ownership, and is refused if the domain is not verified.

`scan-repo` asks the server to scan a path on its own disk, which only works for directories an operator has allow-listed in `CODE_SCAN_ALLOWED_ROOTS`. `sbom` writes the software bill of materials for a completed scan.

node webcuris.cjs scan https://example.com
webcuris scan https://example.com --deep
webcuris sbom scn_01H... sbom.json

Configuration#

Both settings can be given as environment variables or as flags. The flag wins where both are present.

`WEBCURIS_URL` is the base URL of your deployment, defaulting to `http://localhost:3000`. `WEBCURIS_API_KEY` is a key created under Account → API keys.

export WEBCURIS_URL="https://scan.example.com"
export WEBCURIS_API_KEY="wk_..."

# or per invocation
webcuris scan https://example.com --url=https://scan.example.com --key=wk_...