Interactive guides
Step-by-step walkthroughs for every way to run an XploitScan scan. Written so a non-technical founder can follow along without a security background.
Scan from the browser
2 min · Indie hackers, founders, anyone without a CLI
Drag a folder, paste code, or scan a public GitHub URL. Best for first scans and quick sanity checks.
Open guide →
Scan from the terminal
3 min · Developers, anyone working in a terminal already
Install the CLI with one command, scan a project locally, and read the results. No code uploaded.
Open guide →
Install the GitHub App
2 min · Anyone on GitHub — fastest path to PR scanning
Install once, get automatic PR scans + inline review comments. No workflow file, no API key.
Open guide →
Add the GitHub Action
5 min · Teams with CI/CD pipelines
Run a security scan on every PR, post a Critical/High/Medium/Low table comment, and upload SARIF.
Open guide →
Add XploitScan to GitLab CI
4 min · GitLab users
Drop a single job into .gitlab-ci.yml. Fails pipelines on critical findings, uploads the report as an artifact.
Open guide →
Add XploitScan to Bitbucket Pipelines
4 min · Bitbucket users
One step in bitbucket-pipelines.yml scans every PR. Works on the free tier.
Open guide →
Call the API directly
4 min · Custom integrations and build tooling
POST a JSON payload to the public scan endpoint from any CI system, custom tool, or build script.
Open guide →
Install XploitScan rules in Cursor
3 min · Anyone coding in Cursor IDE
Teach Cursor to refuse the most common AI security mistakes at write-time instead of catching them after.
Open guide →
Not sure which one is right for you? If you're new, start with the browser guide.
Start with the browser scanner →