Command-line interface

Install#

Download it from Webcuris. It is a single CommonJS file with no runtime dependencies beyond Node — nothing to install, nothing to check out, and no package to add to your project.

Run it from the repository you want scanned. scan-local reads the directory you invoke it in, not the directory the file sits in, so keeping one copy somewhere convenient and pointing Node at it works fine.

curl -fsSL https://webcuris.com/cli -o webcuris.cjs\nnode webcuris.cjs --help

Local scanning, where nothing leaves the machine#

scan-local reads the repository on the machine it runs on. Your source code never leaves the machine — only the findings are sent, so Webcuris sees "a hard-coded secret at src/config.js line 14", never the file.

Findings are uploaded by default, which is what makes them appear on your dashboard. Pass --no-upload to keep everything local and print to the terminal only; the command confirms in its output when it has sent nothing.

--project names the run so several repositories can be told apart in one terminal session. --json prints the full result for another tool to consume rather than the human summary.

node webcuris.cjs scan-local .
webcuris scan-local ./services/api --project=api --json

Container images#

image inspects a public registry image: its base distribution, the packages inside it, configuration problems in how it was built, and known vulnerabilities for the packages it can match.

Package counts are a floor, not a total. If a size limit is reached the output says so rather than reporting a smaller number as if it were complete.

node webcuris.cjs image ghcr.io/example/api:1.4.2
webcuris image node:22-alpine --config-only

Stopping a secret before it is committed#

pre-commit scans staged changes and exits non-zero if it finds a credential. install-hook writes it into .git/hooks/pre-commit for you; pass --force to replace an existing hook.

This is the cheapest place in the whole system to catch a secret. Once a credential reaches a remote, rotating it is the only real remedy — deleting the commit is not one.

node webcuris.cjs install-hook
webcuris pre-commit

Driving Webcuris remotely#

scan runs a website assessment against a URL. --deep requests the checks that need proven ownership, and is refused if the domain is not verified.

scan-repo asks the server to scan a path on its own disk. That is switched off on Webcuris — the server refuses every path unless the service owner has allow-listed the directory — so use scan-local for code that is not on GitHub. sbom writes the software bill of materials for a completed scan.

node webcuris.cjs scan https://example.com
webcuris scan https://example.com --deep
webcuris sbom scn_01H... sbom.json

Configuration#

Both settings can be given as environment variables or as flags. The flag wins where both are present.

WEBCURIS_URL is this site's address, https://webcuris.com. WEBCURIS_API_KEY is a key created under Account → API keys.

export WEBCURIS_URL="https://scan.example.com"
export WEBCURIS_API_KEY="wk_..."

# or per invocation
webcuris scan https://example.com --url=https://scan.example.com --key=wk_...