Developer Reference Guide & CLI Documentation

Three Ways to Run Vulnerability Audits

Choose the workflow that best fits your development lifecycle.

1

Web UI Folder Drag & Drop

Fastest for ad-hoc audits. Drag any local project folder directly into your browser. In-browser AST filtering computes Protected LOC in milliseconds without sending binaries or dependencies.

2

Git Repository Integration

Ideal for automated branch tracking. Link your GitHub, GitLab, or Bitbucket repository URL. Cyfendo automatically identifies branch and commit SHAs to deliver incremental diff audits.

3

Lightweight Local CLI (`cyfendo scan .`)

Perfect for terminal users, remote SSH servers, and automated CI/CD pipelines. Zero dependencies, fast in-memory packaging, instant exact-cache reuse, and individual unified .patch exporting.

Method 1: Web UI Folder Upload

Run ad-hoc security reviews directly from your browser with zero local software requirements.

1

Open Dashboard & Click "Start New Scan"

Navigate to /dashboard and click the Start New Scan button. Ensure the Upload Folder tab is selected.

2

Select or Drag Your Local Project Folder

Select your local project root. Cyfendo’s in-browser scanner automatically applies exclusion rules:

Respects custom .gitignore and .cyfendoignore files.
Automatically ignores node_modules/, vendor/, .git/, dist/, build/, virtual environments (venv/), and binary assets.
Computes precise Protected LOC and displays an instant quota check before uploading.

3

Watch Live Multi-Agent Telemetry

Once submitted, live Server-Sent Events (SSE) stream the real-time execution across distributed analysis stages: AST Parsing → Taint Propagation → Ephemeral Sandbox PoC Verification → AI Remediation Patch Synthesis.

4

Review in the Interactive Vulnerability IDE

Inspect findings categorized by CWE and CVSS scores. View line-level taint vectors, run sandbox exploit proofs-of-concept, and download synthesized unified .patch diffs or SARIF reports.

Method 2: Git Repository Integration

Connect remote Git repositories to track security posture across branches and commits.

1

Select "Git Repository" in Scan Modal

In the Start New Scan modal, switch to the Git Repository tab.

2

Enter Repository URL & Branch

Provide your repository URL (e.g. https://github.com/org/repo.git) and branch (default: main or master). For private repositories, enter a Personal Access Token (PAT) with read access.

3

Incremental Continuity Tracking

Cyfendo links your repository to a stable Protected Project. When you rescan a branch after making changes, Cyfendo computes AST continuity—auditing only the modified/new LOC without duplicate charges.

Method 3: Cyfendo Local CLI Scanner

Zero-dependency, high-speed CLI scanner designed for developer terminals, headless SSH servers, and CI/CD pipelines.

1. Installation

Install globally via pip or use our standalone one-line installer:

bash — ubuntu@cyfendo: ~

$ pip install cyfendo

bash — ubuntu@cyfendo: ~

$ curl -sSL https://app.cyfendo.com/install.sh | bash

2. Authentication

Generate an API Key from Top-Right User Menu → Developer & CLI Access and authenticate your CLI:

bash — ubuntu@cyfendo: ~

# Option A: Interactive login command
$ cyfendo login --key cy_live_xxxxxxxxxxxxxxxxxxxxxxxx

# Option B: Set as environment variable
$ export CYFENDO_API_KEY=cy_live_xxxxxxxxxxxxxxxxxxxxxxxx

3. Running Scans

bash — ubuntu@cyfendo: ~/workspace

# Scan current working directory
$ cyfendo scan .

# Target a specific existing project in your workspace
$ cyfendo scan /path/to/source --project "payment-gateway"

# Export standard SARIF 2.1.0 & unified diff patch bundle
$ cyfendo scan . --sarif=results.sarif --patch=remediation.patch

Scan Settings & Advanced Options

Customize finding deduplication scopes, AI remediation synthesis, and benchmark evaluation modes across Web UI and CLI.

A

Deduplication Scopes (`--dedup-scope`)

Controls how raw taint traces and candidate findings across call graphs, AST scopes, and source files are clustered into consolidated security alerts:

root_cause (Default): Universal multi-factor AST clustering across functions and routes. Consolidates redundant alerts into single root-cause findings for developer triage.
file (Per-File Isolation): Prevents findings in separate files from merging. Crucial for synthetic test suites and granular file-by-file audits.
none (Raw Traces): Disables deduplication clustering entirely. Outputs every verified candidate finding trace directly without merging.

B

Fast PoC Mode vs. AI Remediation Patches (`--generate-patch`)

By default, Cyfendo runs in Fast PoC Mode—executing full AST taint propagation and gVisor sandbox exploit verification in seconds without blocking on AI patch synthesis.

To generate surgical fix diffs during the scan, enable the toggle in the Web UI or pass --generate-patch in the CLI. You can also generate dual-oracle verified patches on-demand directly inside the Vulnerability IDE for any individual finding.

C

Benchmark Evaluation Mode (`--benchmark-mode`)

Designed for automated evaluation benchmarks (such as OWASP Benchmark, Juliet, and custom synthetic suites). When enabled, Cyfendo automatically enforces Per-File Isolation (--dedup-scope=file) to avoid cross-file merging and disables initial patch generation for maximum evaluation throughput and exact groundtruth comparison.

bash — Advanced Scan Examples

# 1. Run in Benchmark Mode (per-file isolation, fast PoC)
$ cyfendo scan . --benchmark-mode

# 2. Run with per-file deduplication and full AI patch generation
$ cyfendo scan . --dedup-scope=file --generate-patch

# 3. Run raw audit without any deduplication
$ cyfendo scan . --dedup-scope=none

Inspecting & Applying Remediation Patches

Cyfendo generates review-ready unified diffs for verified vulnerabilities. Inspect and apply them manually or via CLI.

bash — ubuntu@cyfendo: ~/workspace

# 1. List and export individual .patch files into .cyfendo/patches/
$ cyfendo patches

# 2. Inspect colorized diff for a specific finding in the terminal
$ cyfendo patch fnd_91a4 --show

# 3. Apply patch directly to local source code using git apply
$ cyfendo patch fnd_91a4 --apply

# 4. Or apply manually with standard git tooling
$ git apply .cyfendo/patches/01_sql_injection.patch

CI/CD Quality Gates & Automation

Block pull requests with failing quality gates and upload SARIF reports to GitHub Advanced Security.

yaml — .github/workflows/security.yml

name: Cyfendo Security Scan
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Cyfendo CLI
        run: pip install cyfendo

      - name: Run Cyfendo Autonomous Audit
        env:
          CYFENDO_API_KEY: ${{ secrets.CYFENDO_API_KEY }}
        run: |
          cyfendo scan . \
            --fail-on=high \
            --sarif=cyfendo-results.sarif \
            --no-interactive

      - name: Upload SARIF to GitHub Security Tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: cyfendo-results.sarif

Protected LOC & Quota Accounting

Understand how Lines of Code are counted, cached, and billed under the Cyfendo Protected LOC model.

1

Source Code Lines Only

Cyfendo only meters executable source code lines. Blank lines, comment blocks, third-party vendor directories (e.g. node_modules/, vendor/, venv/), minified bundles, and compiled binaries are automatically filtered and never charged.

2

Zero Double-Billing for Rescans

Within a billing cycle, rescanning an existing Protected Project reuses your registered LOC capacity. If you rescan the same 10,000 LOC codebase 50 times in CI/CD, you consume exactly 10,000 Protected LOC, not 500,000.

3

Incremental AST Cache

When you push commits or scan feature branches, Cyfendo’s distributed cache instantly identifies unchanged files via cryptographic AST hashes, ensuring sub-second response times and immediate exploit validation.

Complete CLI Command Reference

Quick cheat sheet of all available commands and flags.

Command / Flag	Description	Example
`cyfendo login`	Authenticates CLI and stores credentials in `~/.cyfendo/config.json`.	cyfendo login --key cy_live_...
`cyfendo whoami`	Displays active user account, role, organization, and quota usage.	cyfendo whoami
`cyfendo status`	Checks Protected LOC balance, plan limit, and grace period status.	cyfendo status
`cyfendo projects`	Lists active protected projects in your workspace with LOC counts.	cyfendo projects
`cyfendo scan <path>`	Packages directory, uploads to Cyfendo, and streams live audit telemetry.	cyfendo scan .
`--project, -p`	Binds scan run to an existing Protected Project name or ID.	--project "backend-api"
`--dedup-scope <scope>`	Sets vulnerability deduplication scope: `root_cause` (default), `file` (per-file isolation), or `none` (raw traces).	--dedup-scope=file
`--benchmark-mode`	Runs in benchmark evaluation mode (overrides `--dedup-scope=file` and disables patch generation).	--benchmark-mode
`--generate-patch`	Synthesizes and sandbox-verifies AI remediation patches during scan.	--generate-patch
`--no-patch`	Explicitly skips remediation patch generation (default fast PoC mode).	--no-patch
`--patch-bundle <path>`	Exports aggregated unified remediation diff bundle file.	--patch-bundle fixes.patch
`--fail-on <level>`	Exits with code 1 if findings at or above threshold exist (`critical`, `high`, `medium`, `low`).	--fail-on=high
`--sarif <path>`	Exports findings in OASIS SARIF 2.1.0 JSON format for GitHub / IDE integration.	--sarif=results.sarif
`--no-interactive`	Disables animated spinners and progress bars for clean CI/CD log output.	--no-interactive
`cyfendo patches [id]`	Lists and exports all individual vulnerability `.patch` diffs.	cyfendo patches
`cyfendo patch <target>`	Inspects (`--show`) or applies (`--apply`) a vulnerability patch to local files.	cyfendo patch 01_sql --show
`cyfendo logout`	Clears stored credentials from `~/.cyfendo/config.json`.	cyfendo logout

Three Ways to Run Vulnerability Audits

Web UI Folder Drag & Drop

Git Repository Integration

Lightweight Local CLI (cyfendo scan .)

Method 1: Web UI Folder Upload

Open Dashboard & Click "Start New Scan"

Select or Drag Your Local Project Folder

Watch Live Multi-Agent Telemetry

Review in the Interactive Vulnerability IDE

Method 2: Git Repository Integration

Select "Git Repository" in Scan Modal

Enter Repository URL & Branch

Incremental Continuity Tracking

Method 3: Cyfendo Local CLI Scanner

1. Installation

2. Authentication

3. Running Scans

Scan Settings & Advanced Options

Deduplication Scopes (--dedup-scope)

Fast PoC Mode vs. AI Remediation Patches (--generate-patch)

Benchmark Evaluation Mode (--benchmark-mode)

Inspecting & Applying Remediation Patches

CI/CD Quality Gates & Automation

Protected LOC & Quota Accounting

Source Code Lines Only

Zero Double-Billing for Rescans

Incremental AST Cache

Complete CLI Command Reference

Lightweight Local CLI (`cyfendo scan .`)

Deduplication Scopes (`--dedup-scope`)

Fast PoC Mode vs. AI Remediation Patches (`--generate-patch`)

Benchmark Evaluation Mode (`--benchmark-mode`)