CEFENSE
Get startedSign in

Quickstart

From nothing to a first finding, and the pull request that closes it.

5 sections2 min read

Two paths to the same place. Use the workspace if you would rather click, or the CLI if you live in a terminal. Both act on the same repositories and the same findings.

Before you begin

  • A Cefense account. Sign up at cefense.com.
  • A repository on GitHub, GitLab, or Bitbucket that you can grant access to.
  • For the CLI path only: Node 22.12 or newer, and git on your PATH.

From the workspace

  1. 1
    Open the workspace

    Go to cefense.com/app and sign in.

  2. 2
    Connect a provider

    Choose GitHub, GitLab, or Bitbucket. GitHub installs a GitHub App and asks which repositories it may see. GitLab and Bitbucket authorise through OAuth. See Connect a repository.

  3. 3
    Pick a repository

    Everything the provider granted access to is listed. Connecting one queues its first scan straight away.

  4. 4
    Wait for the scan

    The repository shows as queued, then running, then completed. A first scan of a large repository takes a few minutes.

  5. 5
    Read Findings

    Open Findings to review the reported issues and observations. Open a row for its source evidence, Research for related context, Fixes for proposed patches, and Verification for recorded replay results.

  6. 6
    Generate a patch and open the pull request

    From a finding, generate the patch, read the diff, and open the pull request. Read How fixes are written before you merge one.

From the terminal

Four commandsbash
npm install -g @cefense-npm/cefense-cli
cf auth login
cf repo connect
cf reproduced

cf auth login opens your browser and signs you in. cf repo connect lists what your provider granted access to, connects what you choose, and follows the first scan. cf reproduced prints the findings, worst first.

cf repo connect
cf repo connect acme/apiConnected  acme/apiScanning   acme/api  queued  running  completed        31 findingscf reproduced --repo acme/api

Close one finding

cf reproduced lists the findings with a short id against each one. Take an id and run the rest against it. Publishing asks you to type the repository name first, so there is no accidental pull request.

One finding, all the way throughbash
cf reproduced --severity critical,high
cf reproduced show <finding-id>
cf fix generate <finding-id> --wait
cf fix publish <finding-id>

Next steps

Core conceptsThe five words the rest of the docs use.The workspaceWhere findings, history, and settings live once a scan is done.Scan triggersScan on every push, on a schedule, or only when asked.Agent quickstartLet a coding agent run all of this for you.

Have a correction or need help?

Email the docs team