SecHound is a developer-first CLI that scans a web application and its source. Findings include the file and line to fix, not just a vulnerability name.

Does SecHound upload my source code?

Core scanning runs locally. Synced findings can include file paths, line numbers, and source-line evidence, so review scan results before using sensitive repositories. The optional Secure Coding Assistant asks before sending selected source snippets and excludes known sensitive files.

How do I scan my web application?

Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.

What does a scan cover?

One command checks for known secret patterns, vulnerable npm packages, selected risky source patterns, quality and performance issues, and security headers on a reachable local app. These are heuristic findings, not a complete penetration test.

Is there a free plan?

Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.

SecHound

Security review from the command line

Find vulnerabilities.Fix the exact line.

SecHound reads your source, tests the running application, and explains exactly what failed, where it lives, and how to fix it.

Install globally, then run sechound. Free scans; core analysis runs on your machine.

See the product flowScan → inspect → resolve

sechound.com

Overview

Welcome back, Alex

Manage scans from your local projects.

AI credit balance · Pro

142credits

View ledger →

API keys

Scans

Findings

Recent scans

View all

api-gateway
headers · localhost:4000
2 findings
marketing
secrets · localhost:3001
0 findings

Scan

checkout

localhost:3000 · completed · 1 high · 2 medium · 1 low

SQL injection

High

POST /api/orders/search · param q · app/api/orders/route.ts:47

~/checkout

CLI on localhost → findings on your dashboard

Illustrative preview. Results depend on the project and reachable target.

From scan to fix

A finding you can act on.

Here is an illustrative SQL injection finding based on a check SecHound actually runs. It flags a risky pattern; review the code to confirm the risk.

Read the CLI guide ↗

Example walkthrough · not a live scan

01 / run$ sechound scan
02 / inspect
Possible SQL string concatenation
app/api/orders/route.ts:47 · query construction needs review
03 / fix
Replace string interpolation with a parameterized query; review and test the change.
04 / verify
Re-run sechound scan and confirm the finding is gone.

Coverage

What the scan checks today.

Local rules flag known risky patterns; dependency auditing and reachable-app checks add more context. A finding is a lead to investigate, not proof of exploitability.

Secrets

Exposed keys, tokens, credentials, and committed environment files.

Dependencies

Known vulnerabilities in the packages your application ships.

Source

Injection, XSS, unsafe execution, weak authentication, and risky data access.

Runtime

Headers, cookies, CORS, and behavior observed from a reachable target.

Quality

Debug code, swallowed errors, fragile patterns, and security regressions.

Performance

Unbounded reads, blocking I/O, and avoidable query patterns.

AI reviews eligible source files for vulnerabilities. The CLI shows the file coverage and estimated credit cost before sharing redacted source chunks. A quick local rules scan is also available.

Not covered comprehensively: IDOR, privilege escalation, business logic, and advanced injection or exploit validation. Keep human review in the loop.

Privacy by default

Your source is not the product.

Core analysis happens on your machine. Normal scans sync structured findings, which can include source-line evidence—not your entire source tree. Optional AI code changes show what will be shared and ask first.

Read the privacy policy ↗

Pricing

Scan free. Pay for intelligence.

Deterministic scanning runs locally. Credits cover model-powered explanations, questions, and proposed code changes.

Free

$0forever

Try the CLI on a personal project.

✓Local scans (`sechound scan`)
✓10 AI credits / month
✓1 API key
✓7-day scan history

Pro

Popular

$20/month

For developers who scan every branch.

✓Local scans (`sechound scan`)
✓150 AI credits / month
✓5 API keys
✓90-day scan history

Team

$40/month

A shared security workspace for growing teams.

✓Everything in Pro
✓5 team seats with roles
✓Shared credit pool & usage reporting
✓375 AI credits / month
✓20 API keys
✓1-year scan history

Payments are processed by Paddle, our Merchant of Record. Purchases and renewals have a 30-day refund window. Read the Refund Policy.

FAQ

Before you run it.

What is SecHound?: SecHound is a developer-first CLI that scans a web application and its source. Findings include the file and line to fix, not just a vulnerability name.
Does SecHound upload my source code?: Core scanning runs locally. Synced findings can include file paths, line numbers, and source-line evidence, so review scan results before using sensitive repositories. The optional Secure Coding Assistant asks before sending selected source snippets and excludes known sensitive files.
How do I scan my web application?: Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.
What does a scan cover?: One command checks for known secret patterns, vulnerable npm packages, selected risky source patterns, quality and performance issues, and security headers on a reachable local app. These are heuristic findings, not a complete penetration test.
Is there a free plan?: Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.

Run the scan before the release.

Read the CLI docs