check, which evaluates your code against
policies, and scan, which runs the specialized vulnerability and
infrastructure-as-code scanners. This page covers both.
Check code against policies
check is the core command. Point it at files or directories:
check reads your git-staged changes (or from stdin) — which is what
the pre-commit hook uses:
Choose an output format
check supports text (default), json, sarif, and markdown. See
Output formats.
Scope to frameworks
Run only the rules mapped to one or more frameworks:Scan dependencies for vulnerabilities
scan vuln checks your dependency manifests against known vulnerabilities (OSV):
Scan infrastructure-as-code
scan iac checks IaC files for security misconfigurations. It supports Terraform,
CloudFormation, Kubernetes, and Helm:
--path, --format (text / json / sarif), and
--fail-on (none / high / critical). See the
CLI reference.
Generate an SBOM
To produce a Software Bill of Materials from your dependency manifests:What runs where
You rarely call these commands by hand once you’re set up — they run automatically at each enforcement layer: in your IDE, while an AI assistant works, on commit and push, and on every pull request.Next steps
Reading findings
Make sense of what a run reports.
Thresholds
Decide what severity blocks a run.