Developer Reference Guide: Running & Managing Audits

Web UI Folder Drag & Drop

Fastest for ad-hoc audits. Drag any local project folder directly into your browser. In-browser AST filtering computes Protected LOC in milliseconds without sending binaries or dependencies.

Git Repository Integration

Ideal for automated branch tracking. Link your GitHub, GitLab, or Bitbucket repository URL. Cyfendo automatically identifies branch and commit SHAs to deliver incremental diff audits.

Lightweight Cloud CLI (cyfendo scan .)

Standard cloud-synchronized scanning for terminal users and CI/CD pipelines. Packages code locally, uploads to ephemeral cloud sandboxes, streams live telemetry, and exports unified .patch diffs.

100% Local Machine • Zero Source Code Egress. Executes entire multi-agent security pipeline on your local hardware using your own LLM API keys (OpenAI, Anthropic, Gemini, Vertex, Azure) or air-gapped local models (Ollama/vLLM). Code, ASTs, finding proofs, and patches never leave your machine.

Open Dashboard & Click "Start New Scan"

Navigate to /dashboard and click the Start New Scan button. Ensure the Upload Folder tab is selected.

Select or Drag Your Local Project Folder

Select your local project root. Cyfendo’s in-browser scanner automatically applies exclusion rules:

• Respects custom .gitignore and .cyfendoignore files.
• Automatically ignores node_modules/, vendor/, .git/, dist/, build/, virtual environments (venv/), and binary assets.
• Computes precise Protected LOC and displays an instant quota check before uploading.

Watch Live Multi-Agent Telemetry

Once submitted, live Server-Sent Events (SSE) stream the real-time execution across distributed analysis stages: AST Parsing → Taint Propagation → Ephemeral Sandbox PoC Verification → AI Remediation Patch Synthesis.

Review in the Interactive Vulnerability IDE

Inspect findings categorized by CWE and CVSS scores. View line-level taint vectors, run sandbox exploit proofs-of-concept, and download synthesized unified .patch diffs or SARIF reports.

Select "Git Repository" in Scan Modal

In the Start New Scan modal on your Dashboard, switch to the Git Repository tab. Provide your repository URL (e.g. https://github.com/org/repo.git) and specify the branch to inspect (e.g. main, develop, or release/v2).

Monorepo Subdirectory Scoping (Optional)

If your repository contains multiple microservices or packages, specify a relative path in Subdirectory (Optional) (e.g., apps/api or packages/backend). Cyfendo packages and audits only source files inside that subpath, preventing unnecessary LOC consumption from unrelated projects.

Private Repository Authentication

For private repositories, provide a Personal Access Token (PAT) with read-only repository permissions (e.g. GitHub fine-grained PAT with Contents: Read-only, GitLab Project Access Token, or Bitbucket App Password). Tokens are encrypted at rest with AES-256 (Fernet), decrypted in-memory only during ephemeral sandbox fetches, and never stored in plaintext.

Incremental Continuity & Churn Tracking

Cyfendo links each repository to an active Protected Project. When rescanning code, Cyfendo evaluates semantic AST continuity against previous snapshots—charging your quota only for newly added or modified lines of code.

Install or Update the Cyfendo CLI

Install the official Cyfendo Python package (requires Python 3.9+) or use the standalone curl script:

$ pip install --upgrade cyfendo

Authenticate Your Cyfendo Workspace

Generate a Cyfendo API key from User Menu → Developer & CLI Access and authenticate your local machine. This verifies your plan entitlements and Protected LOC balance:

$ cyfendo login --key cy_live_xxxxxxxxxxxxxxxxxxxxxxxx

# Verify workspace balance & active plan:
$ cyfendo status

Select Your Model Provider & Set Credentials

Export your AI provider API key as an environment variable, or supply it directly via the --llm-key flag at runtime:

# For OpenAI:
$ export OPENAI_API_KEY="sk-proj-xxxxxxxxxxxxxxxxxxxxxxxx"

# For Anthropic Claude:
$ export ANTHROPIC_API_KEY="sk-ant-xxxxxxxxxxxxxxxxxxxxxxxx"

# For Google Gemini / Vertex AI:
$ export GEMINI_API_KEY="AIzaSyxxxxxxxxxxxxxxxxxxxx"
# Or for GCP Vertex: export GCP_PROJECT="my-enterprise-project"

# For Azure OpenAI:
$ export AZURE_OPENAI_ENDPOINT="https://my-resource.openai.azure.com/"
$ export AZURE_OPENAI_KEY="xxxxxxxxxxxxxxxxxxxxxxxx"
$ export AZURE_OPENAI_DEPLOYMENT="gpt-4o"

Configure Persistent Defaults (Optional)

Save your preferred provider and model defaults in ~/.cyfendo/config.json so you never have to pass flags on subsequent scans:

$ cyfendo config --set-provider openai
$ cyfendo config --set-model gpt-4o
$ cyfendo config --set-llm-key sk-proj-xxxxxxxxxxxxxxxxxxxxxxxx

Execute the Cyfendo Private Scan

Run cyfendo scan --private . on your target directory. Add --generate-patch to synthesize unified remediation diffs:

# 1. Run local scan with OpenAI GPT-4o and patch generation:
$ cyfendo scan --private \
    --provider openai \
    --model gpt-4o \
    --generate-patch \
    .

# 2. Run with Anthropic Claude 3.7 Sonnet and extended reasoning:
$ cyfendo scan --private \
    --provider anthropic \
    --model claude-3-7-sonnet-latest \
    --thinking high \
    --generate-patch \
    .

# 3. Add custom steering directive to guide deep vulnerability search:
$ cyfendo scan --private \
    --provider openai \
    --model gpt-4o \
    --directive "Focus audit on authentication bypass, BOLA, and SSRF" \
    .

Review Findings & Apply Patches Locally

All artifacts are saved to .cyfendo/ in your project root. Inspect reports in your terminal and apply patches with a single command:

# List all generated patches:
$ cyfendo patches

# View colorized diff for a specific finding:
$ cyfendo patch fnd_388b --show

# Apply patch directly to source code via git apply:
$ cyfendo patch fnd_388b --apply

# Read full Markdown audit report:
$ cat .cyfendo/report.md

Deduplication Scopes (--dedup-scope)

Controls how raw taint traces and candidate findings across call graphs, AST scopes, and source files are clustered into consolidated security alerts:

• root_cause (Default): Universal multi-factor AST clustering across functions and routes. Consolidates redundant alerts into single root-cause findings for developer triage.
• file (Per-File Isolation): Prevents findings in separate files from merging. Crucial for synthetic test suites and granular file-by-file audits.
• none (Raw Traces): Disables deduplication clustering entirely. Outputs every verified candidate finding trace directly without merging.

Fast PoC Mode vs. AI Remediation Patches (--generate-patch)

By default, Cyfendo runs in Fast PoC Mode—executing full AST taint propagation and gVisor sandbox exploit verification in seconds without blocking on AI patch synthesis.

To generate surgical fix diffs during the scan, enable the toggle in the Web UI or pass --generate-patch in the CLI. You can also generate dual-oracle verified patches on-demand directly inside the Vulnerability IDE for any individual finding.

Benchmark Evaluation Mode (--benchmark-mode)

Designed for automated evaluation benchmarks (such as OWASP Benchmark, Juliet, and custom synthetic suites). When enabled, Cyfendo automatically enforces Per-File Isolation (--dedup-scope=file) to avoid cross-file merging and disables initial patch generation for maximum evaluation throughput and exact groundtruth comparison.

Developer Account (Personal Workspace)

Tailored for solo developers, founders, and security consultants. Bound to an individual identity with personal billing plans (Free up to 10K LOC, Starter, Growth, or Scale) and private repositories.

Business Account (Organization Workspace)

Designed for engineering teams and enterprises. Features an organization-named workspace (e.g. Acme Cybersecurity Inc.), pooled Protected LOC capacity and monthly scan quotas shared across all team members, centralized invoicing, and multi-seat management.

One Identity → Multiple Workspaces

A single login (email/password or Google Workspace SSO) can link to a personal developer workspace and multiple business organizations simultaneously. Switch between workspaces on the fly via the top navigation dropdown in the Web UI or via cyfendo workspace switch in the CLI.

Tokenized Email Invitations

Owners invite teammates by specifying their email address and assigned role (Run & View or View-Only). Cyfendo issues a cryptographically secure tokenized link valid for 7 days.

Frictionless Onboarding

If the invitee already has a Cyfendo account, opening the link immediately attaches the organization to their identity. If they are new to Cyfendo, they complete a streamlined one-step activation (/auth/activate/<token>) without entering credit card details.

Strict Data Isolation & Instant Offboarding

Company repositories, source snapshots, scan telemetry, and remediation patches belong strictly to the Organization Workspace. When an employee is removed, their access to all corporate assets is revoked instantaneously, while their personal developer workspace remains completely intact.

Source Code Lines Only

Cyfendo only meters executable source code lines. Blank lines, comment blocks, third-party vendor directories (e.g. node_modules/, vendor/, venv/), minified bundles, and compiled binaries are automatically filtered and never charged.

Zero Double-Billing for Rescans

Within a billing cycle, rescanning an existing Protected Project reuses your registered LOC capacity. If you rescan the same 10,000 LOC codebase 50 times in CI/CD, you consume exactly 10,000 Protected LOC, not 500,000.

Incremental AST Cache

When you push commits or scan feature branches, Cyfendo’s distributed cache instantly identifies unchanged files via cryptographic AST hashes, ensuring sub-second response times and immediate exploit validation.