Docs / CLI

CLI scan

Local repo scan finds exposed PII in your codebase. Detection runs locally via @noeticguard/core. The terminal shows blurred teasers; a masked risk report opens on the dashboard — share and save when you want.

On this page+

Run a scan

Production defaults are https://api.noeticguard.com and https://app.noeticguard.com— no environment variables required for a normal scan. Override NOETICGUARD_API_URL / NOETICGUARD_DASHBOARD_URL only for local API development.

@noeticguard/cli is not on the public npm registry yet (private: true). Run from the monorepo until publish. When published, npx @noeticguard/cli scan will be the short path.

  1. Clone the repo and install in apps/noeticguard-cli (Node.js 18+).
  2. Run npx . scan or node bin/noeticguard.js scan (optionally with a path). Add --email [email protected] to pin the report for Save / CLI Scans when that address has an account.
  3. Optional: create a workspace so you can Save the report under Dashboard → CLI Scans. The scan itself needs no API key.
bash
git clone https://github.com/NoeticGuard/NoeticGuard.git
cd NoeticGuard/apps/noeticguard-cli
npm install
npx . scan
# or: node bin/noeticguard.js scan ./src
# optional: npx . scan --email [email protected]
# when published: npx @noeticguard/cli scan

In a TTY, omitting --email prompts once (Enter skips). CI: --skip-email.

Authenticated scan: pass --key ng_pub_… or set NOETICGUARD_API_KEY. The CLI loads workspace policy from GET /v1/config (including Brand / Secrets / PCI packs when entitled). Without a key, freemium local defaults apply.

Output

The terminal prints a colorized summary with blurred teasers (for example y****@g****.com) — not full vault tokens. The CLI posts a masked anonymous report and opens the risk report at app.noeticguard.com/scan/<id>.

  • Share is on-demand from the report (copy link, email, WhatsApp, Slack, Teams). Scans are not emailed automatically.
  • Save to workspace: sign in → claim the report → Dashboard → CLI Scans. Optional --email helps link the report (and past scans) to that account.

Full file lists and ignore rules live in the CLI README.

Risk score

The report score is 0–100 from four weighted signals, then snapped into a band (High starts at 55, Critical at 75):

  • Type severity 40% — how sensitive the entity types are (SSN vs email)
  • Finding volume 25% — how many PII instances were found
  • File spread 20% — how many files are involved (scans of fewer than 5 files cap this so a sample run is not treated like a whole-repo incident)
  • Type diversity 15% — how many different PII types appear

On the report, Why this score shows the four signal values (for example Type severity 85 · Finding volume 45 · File spread 20 · Type diversity 79).