— Docs

Everything you need to ship AISEC into your workflow.

Quickstarts, configuration references, and the API. Stubs link out to deeper guides. The dashboard's /help has video walkthroughs.

⌕ ⌘ K
01 / Getting started

CLI quickstart

Install the binary, authenticate, run your first scan in under five minutes.

  • Install (brew, apt, curl)
  • aisec login
  • aisec scan --target
  • aisec replay
Read on →
02 / Configuration

Scope config

Tell the agent what's in scope, what's off-limits, and how aggressively to probe.

  • aisec.yml schema
  • Allow / deny rules
  • Auth profiles (OAuth, SAML)
  • Rate limits & safe-mode
Read on →
03 / Operations

Scheduled rhythm

Daily, weekly, on-deploy, on-demand. Set the cadence per target.

  • Cron-style schedules
  • Deploy-triggered runs
  • Quiet hours / change-freeze
  • Burst windows
Read on →
04 / Integrations

Connect your stack

Slack, Jira, Linear, GitHub Actions, PagerDuty, SAML SSO, webhooks.

  • GitHub Actions YAML
  • Jira / Linear field mapping
  • SAML + SCIM provisioning
  • Webhook event reference
Read on →
05 / Reference

API reference

REST endpoints for findings, scans, evidence, and revalidation.

  • Auth: bearer tokens
  • /findings · list, get, close
  • /scans · trigger, status
  • /evidence · download
Read on →
06 / Help

Troubleshooting

The handful of things that go wrong, and how to fix them in a minute.

  • Domain-control verification fails
  • Rate-limit / WAF interference
  • Auth profile expired
  • Report generation timeout
Read on →
— CLI quickstart

Five minutes to your first chain.

macOS, Linux, Windows. Single static binary. No agent install on your servers.

1

Install

One line — pulls the latest signed binary.

curl -sSL get.aisec.sh | sh
2

Authenticate

Browser flow — bearer token written to ~/.aisec/auth.

aisec login
3

Verify domain control

One-time DNS TXT or HTTP file check.

aisec verify aisec.tools
4

Run your first scan

Daily cadence by default — overridable per target.

aisec scan --target app.aisec.tools
5

Replay any finding

Hand the curl to engineering. Watch it pass on patch.

aisec replay FND-2891-014
shell bash · cwd=~/work/acme · aisec-cli 
$ curl -sSL get.aisec.sh | sh
▸ aisec 1.4.2 installed → /usr/local/bin/aisec

$ aisec login
opening browser… token written.

$ aisec verify aisec.tools
✓ DNS TXT _verify.aisec.tools confirmed.

$ aisec scan --target app.aisec.tools
▸ recon     7 hosts, 2 new
▸ probe     14 findings
▸ chain     2 critical chains assembled
▸ verify    PoC ready · poc-2891.curl
✓ done      report → run-2891.pdf
— API reference

REST. Tokens. JSON.

Base URL https://api.aisec.sh/v1 · Authenticate with Authorization: Bearer …

Method Path Description
GET /findings List findings · filter by severity, status, target, date range
GET /findings/:id Single finding with PoC, evidence, mappings, history
POST /findings/:id/close Mark fixed — triggers auto-revalidation on next deploy
POST /findings/:id/replay Re-run the PoC immediately and stream the result
GET /scans List scans for the workspace
POST /scans Trigger an on-demand scan against a configured target
GET /scans/:id Scan status, progress, findings emitted so far
GET /evidence/:id Download evidence bundle (PDF, JSON, SARIF, STIX)
GET /targets List configured targets, scopes, schedules
POST /webhooks Register an outbound webhook: finding.created, chain.verified

→ Full reference, schemas & examples at api.aisec.sh

— Stuck?

Three places to ask.

Slack Connect

Premium and Enterprise customers: your engineers and ours, in a shared channel. 4-hour response SLA in business hours.

Open Slack Connect →

Community forum

Open-by-default forum for feature requests, playbook ideas, and the changelog. Engineers from AISEC answer here.

Visit community.aisec.sh →

Email support

[email protected] — for everyone, every plan. We read every message; SLA scales with plan.

Email support →