Documentation
Everything you need after the install finishes
These are the project's own documentation files rather than a rewrite of them, so what is here is what you will read again in the repository once it is running.
Quick start
One command, six questions, and a first scan.
ReadInstallation
What it needs, what the installer does, and how to run it behind a proxy.
ReadAuthentication
Local accounts with a second factor, single sign on, and the credentials each host needs.
ReadRoles
Who can see what, and who can decide what.
ReadScheduling
Scans on a schedule, per organization, without cloning the whole estate at once.
ReadPipelines
Failing a build, uploading SARIF, and reviewing only what changed.
ReadIn the editor
The plugin for VS Code, Cursor, JetBrains and Eclipse, and where it comes from.
ReadTrends and drill down
How the numbers moved, three levels down to a branch, sorted and paged.
ReadValidating with AI
A model reads a finding, lowers the grade where it may, and teaches the scanner so it is never asked twice.
ReadCertified branches
A person signs off a branch, and a completed scan signs off the ones with nothing to read.
ReadReports
Every file the scanner writes, and what is in each of them.
ReadThe software inventory
Every package in the estate, which version, which license and which branches it sits on.
ReadBehind a load balancer
Running it where more than one thing has to reach it.
ReadHow to guides
Short answers to the things people actually want to do: exclude a credential everywhere it appears, stop a noisy rule, fail a build on new findings only, send mail through Microsoft 365 without SMTP.
All the guidesQuestions
What it stores, what it sends anywhere, whether it can write to your repositories, what it costs, and how it compares with what you are probably already paying for.
Read the questions