closed API and self-hosted CLI (Pro)

API

Create a token on API & CLI. Send it in the X-Secscan-Token header. The API documentation describes every endpoint: resumable uploads, repository and URL imports, website scans, scan status with live progress, and full JSON reports.

curl -H "X-Secscan-Token: $SECSCAN_TOKEN" https://secscan.webservice.digital/api/v1/me

CLI

The CLI runs the same heuristics on your own infrastructure, for example in CI pipelines or air-gapped networks.

python3 secscan.py login            # stores your token
python3 secscan.py update           # downloads the vulnerability and YARA data
python3 secscan.py all ./project    # local scan
python3 secscan.py remote scan ./project.tar.gz   # scan on HEIMDALL servers

The CLI checks your Pro licence online and works offline for 7 days after the last check.

Keep your token secret. Never post it here; revoke it on the API page if it leaked.