SecHound is a developer-first CLI that scans a web application and its source. Findings include the file and line to fix, not just a vulnerability name.

Does SecHound upload my source code?

Core scanning runs locally. Synced findings can include file paths, line numbers, and source-line evidence, so review scan results before using sensitive repositories. The optional Secure Coding Assistant asks before sending selected source snippets and excludes known sensitive files.

How do I scan my web application?

Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.

What does a scan cover?

One command checks for known secret patterns, vulnerable npm packages, selected risky source patterns, quality and performance issues, and security headers on a reachable local app. These are heuristic findings, not a complete penetration test.

Is there a free plan?

Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.

Docs

Scan the app on localhost. Fix the line it points to.

SecHound is a CLI for Next.js and Node apps. It reads source, probes the local server, and syncs a report to your dashboard — without uploading the repo during a normal scan.

Install

Use npx for a one-off run, or install the CLI globally if you scan often.

# one-off
$ npx sechound

# global
$ npm install -g sechound
$ sechound scan

Sign in

The CLI needs an account so reports can sync to the dashboard. Sign in with Google in the browser, or paste an API key from sechound.com/api-keys.

$ sechound login
   Browser on sechound.com · or paste sechound_live_…

$ sechound login --key
$ sechound logout

Scan a local app

Run the AI scan from the project root. SecHound maps the repository locally, then the AI requests relevant paths and searches within a bounded redacted context. Use sechound scan --quickfor the fast local rules scan and localhost checks.

$ sechound scan
   AI review: file count and estimated credits shown first
   Findings saved to your dashboard after all chunks complete

What a scan covers

Smart AI scans combine mandatory local security surfaces with files requested by the AI agent. Deep audits review every eligible, nonempty source file. The quick local scan checks security, quality, and performance rules.

secrets: API keys, tokens, and committed .env files
dependencies: Known-vulnerable packages in package-lock
code: SQL/command injection, XSS, eval, weak JWT handling
quality: Empty catch blocks, leftover debug, fragile patterns
performance: N+1 queries, unbounded reads, sync I/O
headers: CSP, CORS, and related headers if localhost is up

Reports and the dashboard

Each finding includes severity, rule, file, line, and a remediation note. After a scan, open the dashboard or print the last report in the terminal.

$ sechound report

Local-first privacy

Quick local scans keep the source tree on your machine. AI source scans ask for confirmation before sending redacted, eligible chunks. Synced reports store finding metadata — rule IDs, paths, line numbers, severity, and redacted evidence. The optional Secure Coding Assistant lists the relevant source files it selected and asks before sending redacted snippets. Environment files and credential files are excluded.

Plans and AI credits

Quick local scans are included on every plan. AI operations consume a reusable whole-credit allowance based on measured model usage, so small messages and partial scan batches can share a credit. See pricing for Free (10 credits/month), Pro ($20 / 150), and Team ($40 / 375 shared credits with five seats).

CI

Set SECHOUND_API_KEY in the environment instead of running sechound login. The CLI never writes that key to disk. Point it at another API host with SECHOUND_API_URL when you need to.

Command reference

Command	What it does
sechound	Interactive session
sechound scan	AI review eligible source files and sync the report
sechound scan --quick	Run the fast local rules scan
sechound code	Propose secure, approved AI code changes
sechound code "..."	Start with a specific coding request
sechound report	Print the last report from your account
sechound login	Sign in with the browser or an API key
sechound login --key	Paste a sechound_live_ key
sechound logout	End this machine’s CLI session

FAQ

What is SecHound?: SecHound is a developer-first CLI that scans a web application and its source. Findings include the file and line to fix, not just a vulnerability name.
Does SecHound upload my source code?: Core scanning runs locally. Synced findings can include file paths, line numbers, and source-line evidence, so review scan results before using sensitive repositories. The optional Secure Coding Assistant asks before sending selected source snippets and excludes known sensitive files.
How do I scan my web application?: Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.
What does a scan cover?: One command checks for known secret patterns, vulnerable npm packages, selected risky source patterns, quality and performance issues, and security headers on a reachable local app. These are heuristic findings, not a complete penetration test.
Is there a free plan?: Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.