Documentation
Getting Started
Integrate Cipher into your CI/CD pipeline. Verified vulnerability detection in under 2 minutes.
Quick Start
Add the Cipher GitHub Action to your repository. On every push and pull request, Cipher will scan your code, run exploit verification, and block deployments with confirmed vulnerabilities.
name: Cipher Security Check
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Cipher Security Scan
uses: cipher-security/cipher-action@v1
with:
api_key: ${{ secrets.CIPHER_API_KEY }}
- name: Upload Audit Report
uses: actions/upload-artifact@v4
if: always()
with:
name: cipher-audit-report
path: cipher-report.jsonHow It Works
Trigger
Cipher runs automatically on every push and pull request. No manual intervention required.
Scan & Analyze
AI-native pattern detection identifies vulnerabilities specific to AI-generated code — beyond static signatures.
Exploit Verification
Cipher Labs attempts controlled exploit simulation. Real vulnerabilities are confirmed; false positives are dismissed.
Verdict & Report
A detailed audit report is generated with verified findings, severity scores, and specific remediation guidance.
Configuration
Customize Cipher's behavior with a configuration file. Set risk thresholds, ignore patterns, and target specific languages.
{
"thresholds": {
"maxCritical": 0,
"maxHigh": 0,
"maxMedium": 5
},
"ignore": [
"**/*.test.ts",
"**/node_modules/**"
],
"languages": ["javascript", "typescript", "python"]
}Vulnerability Coverage
Input & Injection
- SQL Injection
- Command Injection
- Unsafe eval()
- XSS Vulnerabilities
Authentication
- Hardcoded Secrets
- Weak JWT Config
- Missing Auth Checks
- Weak Password Hashing
Data Handling
- Sensitive Data in Logs
- Insecure Storage
- Plaintext Secrets
- Unsafe Serialization
Configuration
- Permissive CORS
- Debug Mode
- Insecure HTTP
- Unsafe Environment