# API Authentication
Source: https://docs.vidocsecurity.com/api/authentication

Authenticate requests to the Vidoc REST API

The Vidoc API uses API keys for authentication. All requests must include a valid API key.

## Getting an API Key

1. Go to [app.vidocsecurity.com](https://app.vidocsecurity.com)
2. Select your project
3. Navigate to **Settings** → **API Keys**
4. Click **"Create API Key"**
5. Copy and store the key securely

See [API Keys](/settings/api-keys) for detailed management.

## Authentication Methods

### Bearer Token (Recommended)

Include the API key in the `Authorization` header:

```bash theme={null}
curl -X POST https://api.vidocsecurity.com/v1/scan-workflows/start \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"codebaseId": "...", "branch": "main"}'
```

### Header Token

Alternatively, use the `X-API-Key` header:

```bash theme={null}
curl -X POST https://api.vidocsecurity.com/v1/scan-workflows/start \
  -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"codebaseId": "...", "branch": "main"}'
```

## Base URL

All API requests use:

```
https://api.vidocsecurity.com/v1
```

## Request Format

### Headers

| Header          | Required       | Description           |
| --------------- | -------------- | --------------------- |
| `Authorization` | Yes            | `Bearer your-api-key` |
| `Content-Type`  | Yes (POST/PUT) | `application/json`    |

### Request Body

POST and PUT requests use JSON:

```json theme={null}
{
  "codebaseId": "abc123",
  "branch": "main"
}
```

## Response Format

### Success Response

```json theme={null}
{
  "id": "scan-123",
  "status": "pending",
  "createdAt": "2024-01-15T10:30:00Z"
}
```

### Error Response

```json theme={null}
{
  "statusCode": 401,
  "message": "Invalid API key",
  "error": "Unauthorized"
}
```

## Error Codes

| Code  | Description                 |
| ----- | --------------------------- |
| `401` | Invalid or missing API key  |
| `403` | Key doesn't have permission |
| `404` | Resource not found          |
| `429` | Rate limit exceeded         |
| `500` | Server error                |

## Rate Limits

| Operation   | Limit          |
| ----------- | -------------- |
| Start scan  | 10 per minute  |
| Get status  | 100 per minute |
| List issues | 100 per minute |

Rate limit headers are included in responses:

```
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1705315200
```

## Code Examples

### JavaScript/Node.js

```javascript theme={null}
const response = await fetch('https://api.vidocsecurity.com/v1/scan-workflows/start', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.VIDOC_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    codebaseId: 'abc123',
    branch: 'main',
  }),
});

const data = await response.json();
```

### Python

```python theme={null}
import requests
import os

response = requests.post(
    'https://api.vidocsecurity.com/v1/scan-workflows/start',
    headers={
        'Authorization': f'Bearer {os.environ["VIDOC_API_KEY"]}',
        'Content-Type': 'application/json',
    },
    json={
        'codebaseId': 'abc123',
        'branch': 'main',
    }
)

data = response.json()
```

### cURL

```bash theme={null}
curl -X POST https://api.vidocsecurity.com/v1/scan-workflows/start \
  -H "Authorization: Bearer $VIDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"codebaseId": "abc123", "branch": "main"}'
```

## Security Best Practices

1. **Never commit API keys** - Use environment variables
2. **Rotate keys regularly** - Create new keys every 90 days
3. **Use separate keys** - One per environment/purpose
4. **Monitor usage** - Check last used timestamps
5. **Revoke compromised keys** - Immediately if exposed

## Related Pages

<CardGroup>
  <Card title="API Keys" icon="key" href="/settings/api-keys">
    Manage API keys
  </Card>

  <Card title="Scanning API" icon="magnifying-glass" href="/api/scanning">
    Start scans via API
  </Card>

  <Card title="Issues API" icon="bug" href="/api/issues">
    Access issues via API
  </Card>

  <Card title="CLI Authentication" icon="terminal" href="/cli/authentication">
    CLI auth methods
  </Card>
</CardGroup>


# Issues API
Source: https://docs.vidocsecurity.com/api/issues

Access and manage security issues via the REST API

The Issues API allows you to programmatically access security findings from your scans.

<Info>
  The Issues API is available for enterprise plans. Contact support for access.
</Info>

## List Issues

### Endpoint

```
GET /v1/issues
```

### Query Parameters

| Parameter    | Type   | Description                                        |
| ------------ | ------ | -------------------------------------------------- |
| `projectId`  | string | Filter by project                                  |
| `codebaseId` | string | Filter by repository                               |
| `status`     | string | `open`, `ignored`, `closed`                        |
| `severity`   | string | `critical`, `high`, `medium`, `low`, `informative` |
| `category`   | string | Security category (e.g., `sqli`, `xss`)            |
| `limit`      | number | Results per page (default: 50, max: 100)           |
| `offset`     | number | Pagination offset                                  |

### Example Request

```bash theme={null}
curl "https://api.vidocsecurity.com/v1/issues?status=open&severity=critical" \
  -H "Authorization: Bearer $VIDOC_API_KEY"
```

### Response

```json theme={null}
{
  "issues": [
    {
      "id": "issue_abc123",
      "title": "SQL Injection in user query",
      "severity": "critical",
      "category": "sqli",
      "status": "open",
      "filePath": "src/db/users.js",
      "lineNumber": 45,
      "codebaseId": "codebase_xyz",
      "branch": "main",
      "createdAt": "2024-01-15T10:35:00Z"
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}
```

## Get Issue Details

### Endpoint

```
GET /v1/issues/:issueId
```

### Example Request

```bash theme={null}
curl https://api.vidocsecurity.com/v1/issues/issue_abc123 \
  -H "Authorization: Bearer $VIDOC_API_KEY"
```

### Response

```json theme={null}
{
  "id": "issue_abc123",
  "title": "SQL Injection in user query",
  "description": "User input is directly concatenated into SQL query without sanitization.",
  "severity": "critical",
  "category": "sqli",
  "status": "open",
  "filePath": "src/db/users.js",
  "lineNumber": 45,
  "codeSnippet": "const query = `SELECT * FROM users WHERE id = ${userId}`;",
  "remediation": "Use parameterized queries to prevent SQL injection.",
  "codebaseId": "codebase_xyz",
  "branch": "main",
  "scanId": "scan_789",
  "createdAt": "2024-01-15T10:35:00Z"
}
```

## Update Issue Status

### Endpoint

```
PATCH /v1/issues/:issueId
```

### Request Body

| Field    | Type   | Description                             |
| -------- | ------ | --------------------------------------- |
| `status` | string | New status: `open`, `ignored`, `closed` |
| `reason` | string | Reason (required for `ignored`)         |

### Mark as Fixed

```bash theme={null}
curl -X PATCH https://api.vidocsecurity.com/v1/issues/issue_abc123 \
  -H "Authorization: Bearer $VIDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status": "closed"}'
```

### Ignore Issue

```bash theme={null}
curl -X PATCH https://api.vidocsecurity.com/v1/issues/issue_abc123 \
  -H "Authorization: Bearer $VIDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "ignored",
    "reason": "False positive - input is sanitized in middleware"
  }'
```

### Response

```json theme={null}
{
  "id": "issue_abc123",
  "status": "ignored",
  "updatedAt": "2024-01-15T11:00:00Z"
}
```

## Issue Categories

| Category            | Description                      |
| ------------------- | -------------------------------- |
| `sqli`              | SQL Injection                    |
| `xss`               | Cross-Site Scripting             |
| `command-injection` | Command Injection                |
| `ssrf`              | Server-Side Request Forgery      |
| `path-traversal`    | Path Traversal                   |
| `idor`              | Insecure Direct Object Reference |
| `hardcoded-secrets` | Hardcoded Credentials            |
| `weak-cryptography` | Weak Cryptography                |

See [Security Categories](/security/overview) for the full list.

## Pagination

For large result sets, use pagination:

```javascript theme={null}
async function getAllIssues(apiKey, projectId) {
  const issues = [];
  let offset = 0;
  const limit = 100;

  while (true) {
    const response = await fetch(
      `https://api.vidocsecurity.com/v1/issues?projectId=${projectId}&limit=${limit}&offset=${offset}`,
      {
        headers: { 'Authorization': `Bearer ${apiKey}` }
      }
    );

    const data = await response.json();
    issues.push(...data.issues);

    if (data.issues.length < limit) {
      break; // No more results
    }

    offset += limit;
  }

  return issues;
}
```

## Filtering Examples

### Critical Issues Only

```
GET /v1/issues?severity=critical&status=open
```

### By Repository

```
GET /v1/issues?codebaseId=codebase_abc123
```

### By Category

```
GET /v1/issues?category=sqli
```

### Multiple Filters

```
GET /v1/issues?severity=high&category=xss&status=open
```

## Webhooks (Coming Soon)

Subscribe to issue events:

* New issue detected
* Issue status changed
* Scan completed

Contact support to join the beta.

## Related Pages

<CardGroup>
  <Card title="API Authentication" icon="key" href="/api/authentication">
    Authentication setup
  </Card>

  <Card title="Scanning API" icon="magnifying-glass" href="/api/scanning">
    Trigger scans
  </Card>

  <Card title="Issues Dashboard" icon="bug" href="/dashboard/issues">
    Web interface
  </Card>

  <Card title="Security Categories" icon="shield" href="/security/overview">
    Issue categories
  </Card>
</CardGroup>


# Scanning API
Source: https://docs.vidocsecurity.com/api/scanning

Start and monitor security scans via the REST API

The Scanning API allows you to programmatically trigger and monitor security scans.

## Start a Scan

### Endpoint

```
POST /v1/scan-workflows/start
```

### Request Body

| Field               | Type      | Required | Description                               |
| ------------------- | --------- | -------- | ----------------------------------------- |
| `codebaseId`        | string    | Yes      | Repository/codebase identifier            |
| `branch`            | string    | Yes      | Git branch to scan                        |
| `scanSpecificFiles` | boolean   | No       | Only scan specific files                  |
| `fileIds`           | string\[] | No       | File IDs to scan (if `scanSpecificFiles`) |

### Example Request

```bash theme={null}
curl -X POST https://api.vidocsecurity.com/v1/scan-workflows/start \
  -H "Authorization: Bearer $VIDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "codebaseId": "codebase_abc123",
    "branch": "main"
  }'
```

### Response

```json theme={null}
{
  "id": "scan_xyz789"
}
```

### Scan Specific Files

To scan only certain files:

```json theme={null}
{
  "codebaseId": "codebase_abc123",
  "branch": "main",
  "scanSpecificFiles": true,
  "fileIds": ["file_1", "file_2", "file_3"]
}
```

## Get Scan Status

### Endpoint

```
GET /v1/scan-workflows/:scanId/status
```

### Example Request

```bash theme={null}
curl https://api.vidocsecurity.com/v1/scan-workflows/scan_xyz789/status \
  -H "Authorization: Bearer $VIDOC_API_KEY"
```

### Response

```json theme={null}
{
  "id": "scan_xyz789",
  "status": "completed",
  "projectId": "proj_abc",
  "codebaseId": "codebase_abc123",
  "branch": "main",
  "createdAt": "2024-01-15T10:30:00Z",
  "completedAt": "2024-01-15T10:35:00Z",
  "issuesFound": 3
}
```

### Status Values

| Status      | Description                |
| ----------- | -------------------------- |
| `pending`   | Scan queued                |
| `running`   | Scan in progress           |
| `completed` | Scan finished successfully |
| `failed`    | Scan encountered an error  |

## Polling for Completion

Poll the status endpoint until the scan completes:

```javascript theme={null}
async function waitForScan(scanId, apiKey) {
  const maxAttempts = 60;
  const delayMs = 5000;

  for (let i = 0; i < maxAttempts; i++) {
    const response = await fetch(
      `https://api.vidocsecurity.com/v1/scan-workflows/${scanId}/status`,
      {
        headers: { 'Authorization': `Bearer ${apiKey}` }
      }
    );

    const scan = await response.json();

    if (scan.status === 'completed') {
      return scan;
    }

    if (scan.status === 'failed') {
      throw new Error('Scan failed');
    }

    await new Promise(resolve => setTimeout(resolve, delayMs));
  }

  throw new Error('Scan timed out');
}
```

## Finding Your Codebase ID

The `codebaseId` is required to start a scan. Find it:

### Via Dashboard

1. Go to **Repositories**
2. Click a repository
3. The codebase ID is in the URL: `/repositories/codebase_abc123`

### Via API

List repositories to get codebase IDs (contact support for this endpoint documentation).

## Error Handling

### Common Errors

| Error                | Cause                | Solution             |
| -------------------- | -------------------- | -------------------- |
| `Codebase not found` | Invalid codebaseId   | Verify the ID exists |
| `Branch not found`   | Branch doesn't exist | Check branch name    |
| `Invalid file IDs`   | File IDs don't exist | Verify file IDs      |

### Error Response Format

```json theme={null}
{
  "statusCode": 404,
  "message": "Codebase not found",
  "error": "Not Found"
}
```

## Rate Limits

| Operation  | Limit          |
| ---------- | -------------- |
| Start scan | 10 per minute  |
| Get status | 100 per minute |

If rate limited, wait and retry:

```javascript theme={null}
if (response.status === 429) {
  const retryAfter = response.headers.get('Retry-After') || 60;
  await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
  // Retry request
}
```

## Complete Example

```javascript theme={null}
const VIDOC_API_KEY = process.env.VIDOC_API_KEY;
const API_BASE = 'https://api.vidocsecurity.com/v1';

async function runScan(codebaseId, branch) {
  // Start scan
  const startResponse = await fetch(`${API_BASE}/scan-workflows/start`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${VIDOC_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ codebaseId, branch }),
  });

  const { id: scanId } = await startResponse.json();
  console.log(`Scan started: ${scanId}`);

  // Wait for completion
  let status = 'pending';
  while (status === 'pending' || status === 'running') {
    await new Promise(r => setTimeout(r, 5000));

    const statusResponse = await fetch(
      `${API_BASE}/scan-workflows/${scanId}/status`,
      {
        headers: { 'Authorization': `Bearer ${VIDOC_API_KEY}` },
      }
    );

    const scan = await statusResponse.json();
    status = scan.status;
    console.log(`Status: ${status}`);

    if (status === 'completed') {
      console.log(`Found ${scan.issuesFound} issues`);
      return scan;
    }

    if (status === 'failed') {
      throw new Error('Scan failed');
    }
  }
}

runScan('codebase_abc123', 'main');
```

## Related Pages

<CardGroup>
  <Card title="API Authentication" icon="key" href="/api/authentication">
    Authentication setup
  </Card>

  <Card title="Issues API" icon="bug" href="/api/issues">
    Access scan results
  </Card>

  <Card title="CLI Scanning" icon="terminal" href="/cli/scanning">
    CLI alternative
  </Card>

  <Card title="CI/CD Integration" icon="gear" href="/cli/ci-cd">
    Automate scans
  </Card>
</CardGroup>


# Bitbucket Integration
Source: https://docs.vidocsecurity.com/bitbucket/coming-soon

Bitbucket integration is coming soon

<Info>
  Bitbucket integration is coming soon! We're working on bringing Vidoc's security scanning to Bitbucket Cloud and Bitbucket Server.
</Info>

## Planned Features

When Bitbucket integration launches, you'll be able to:

* **Connect Bitbucket repositories** - Link your Bitbucket repos to Vidoc
* **Automatic PR scanning** - Scan pull requests automatically
* **PR comments** - Get security findings as PR comments
* **Auto-scan on push** - Trigger scans on default branch updates
* **Bitbucket Pipelines integration** - Native pipeline support

## Current Alternatives

While we work on Bitbucket integration, you can still scan Bitbucket repositories:

### Using the CLI

1. Clone your Bitbucket repository locally
2. Install and authenticate the Vidoc CLI
3. Run scans from your local machine

```bash theme={null}
# Install CLI
npm i -g @vidocsecurity/cli

# Authenticate
vidoc login

# Scan
cd your-bitbucket-repo
vidoc scan
```

### In Bitbucket Pipelines

Add Vidoc to your `bitbucket-pipelines.yml`:

```yaml theme={null}
image: node:20

pipelines:
  default:
    - step:
        name: Security Scan
        script:
          - npm i -g @vidocsecurity/cli
          - vidoc scan --fail-on high

  pull-requests:
    '**':
      - step:
          name: PR Security Scan
          script:
            - npm i -g @vidocsecurity/cli
            - vidoc scan --fail-on high
```

Remember to add `VIDOC_API_KEY` to your repository variables:

1. Go to Repository Settings → Repository variables
2. Add `VIDOC_API_KEY` with your API key
3. Mark as "Secured"

See [CI/CD Integration](/cli/ci-cd) for detailed setup.

## Stay Updated

Want to be notified when Bitbucket integration launches?

1. Email us at [contact@vidocsecurity.com](mailto:contact@vidocsecurity.com)
2. Follow us on [Twitter](https://twitter.com/vidocsecurity)
3. Check our [blog](https://blog.vidocsecurity.com) for announcements

## Request Features

Have specific Bitbucket features you'd like to see? Let us know:

* Email: [contact@vidocsecurity.com](mailto:contact@vidocsecurity.com)
* Feature requests help us prioritize development

## Related Pages

<CardGroup>
  <Card title="GitHub Setup" icon="github" href="/github/setup">
    GitHub integration (available now)
  </Card>

  <Card title="CLI Installation" icon="terminal" href="/cli/installation">
    Scan any repo via CLI
  </Card>

  <Card title="CI/CD Integration" icon="gear" href="/cli/ci-cd">
    Add to Bitbucket Pipelines
  </Card>

  <Card title="GitLab" icon="gitlab" href="/gitlab/coming-soon">
    GitLab integration status
  </Card>
</CardGroup>


# CLI Authentication
Source: https://docs.vidocsecurity.com/cli/authentication

Authenticate the Vidoc CLI with your API token

The CLI requires authentication to scan your code and sync results with your Vidoc project.

## Get Your Token

1. Go to [app.vidocsecurity.com](https://app.vidocsecurity.com)
2. Select your project
3. Navigate to **Settings** → **API Keys**
4. Click **"Create API Key"**
5. Copy the token

<Warning>
  Store your token securely. Don't commit it to version control.
</Warning>

## Login

### Interactive Login

```bash theme={null}
vidoc login
```

You'll be prompted to enter your token.

### Direct Login

Provide the token as an argument:

```bash theme={null}
vidoc login <your-token>
```

### Single-Tenant Installations

For self-hosted Vidoc instances, specify the API URL:

```bash theme={null}
vidoc login --url https://your-vidoc-instance.com <your-token>
```

## Profiles

Profiles let you manage multiple Vidoc configurations (e.g., different projects or environments).

### Create a Named Profile

```bash theme={null}
vidoc login --profile work <your-token>
vidoc login --profile personal <other-token>
```

### List Profiles

```bash theme={null}
vidoc config list-profiles
```

### Switch Profile

```bash theme={null}
vidoc config set-profile work
```

### Create Empty Profile

```bash theme={null}
vidoc config create-profile staging
```

### Delete Profile

```bash theme={null}
vidoc config delete-profile old-project
```

## View Current Configuration

See your current authentication status and settings:

```bash theme={null}
vidoc config show
```

## CI/CD Authentication

For CI/CD pipelines, pass the token directly:

```bash theme={null}
vidoc ci --token $VIDOC_TOKEN
```

Or use the `--token` flag with scan:

```bash theme={null}
vidoc scan --token $VIDOC_TOKEN
```

See [CI/CD Integration](/cli/ci-cd) for pipeline examples.

## Troubleshooting

### "Invalid token"

1. Verify the token was copied correctly
2. Check for extra whitespace
3. Ensure the token hasn't been revoked in the dashboard

### "Unauthorized"

The token may be associated with a deleted project. Create a new token in an active project.

## Related Pages

<CardGroup>
  <Card title="Installation" icon="download" href="/cli/installation">
    Install the CLI
  </Card>

  <Card title="Scanning" icon="magnifying-glass" href="/cli/scanning">
    Run scans
  </Card>

  <Card title="API Keys" icon="key" href="/settings/api-keys">
    Manage tokens
  </Card>

  <Card title="CI/CD" icon="gear" href="/cli/ci-cd">
    CI/CD integration
  </Card>
</CardGroup>


# CI/CD Integration
Source: https://docs.vidocsecurity.com/cli/ci-cd

Integrate Vidoc security scanning into your CI/CD pipelines

Automate security scanning by integrating Vidoc into your CI/CD pipelines.

## CI Command

Use the dedicated `ci` command for automated environments:

```bash theme={null}
vidoc ci --token $VIDOC_TOKEN
```

The `ci` command runs in non-interactive mode, optimized for CI/CD pipelines.

## CI Command Options

| Option             | Short | Description                           |
| ------------------ | ----- | ------------------------------------- |
| `--token <token>`  |       | Authentication token (required in CI) |
| `--force-reindex`  | `-f`  | Force complete reindex                |
| `--only-indexing`  |       | Index only, skip full scan            |
| `--profile <name>` | `-p`  | Use named profile                     |
| `--api-url <url>`  |       | Override API URL (for single-tenant)  |
| `--config <path>`  | `-c`  | Custom config file path               |

## GitHub Actions

```yaml theme={null}
# .github/workflows/security.yml
name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  vidoc-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Vidoc CLI
        run: npm i -g @vidocsecurity/cli

      - name: Run Security Scan
        run: vidoc ci --token ${{ secrets.VIDOC_TOKEN }}
```

### Store the Secret

1. Go to GitHub repo → Settings → Secrets → Actions
2. Click "New repository secret"
3. Name: `VIDOC_TOKEN`
4. Value: Your token from Vidoc dashboard

## GitLab CI

```yaml theme={null}
# .gitlab-ci.yml
security-scan:
  image: node:20
  stage: test
  script:
    - npm i -g @vidocsecurity/cli
    - vidoc ci --token $VIDOC_TOKEN
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
```

### Store the Variable

1. Go to GitLab project → Settings → CI/CD → Variables
2. Add variable: `VIDOC_TOKEN`
3. Mark as "Masked" and "Protected"

## CircleCI

```yaml theme={null}
# .circleci/config.yml
version: 2.1

jobs:
  security-scan:
    docker:
      - image: cimg/node:20.0
    steps:
      - checkout
      - run:
          name: Install Vidoc CLI
          command: npm i -g @vidocsecurity/cli
      - run:
          name: Run Security Scan
          command: vidoc ci --token $VIDOC_TOKEN

workflows:
  security:
    jobs:
      - security-scan
```

## Jenkins

```groovy theme={null}
// Jenkinsfile
pipeline {
    agent any

    environment {
        VIDOC_TOKEN = credentials('vidoc-token')
    }

    stages {
        stage('Security Scan') {
            steps {
                sh 'npm i -g @vidocsecurity/cli'
                sh 'vidoc ci --token $VIDOC_TOKEN'
            }
        }
    }
}
```

## Azure DevOps

```yaml theme={null}
# azure-pipelines.yml
trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '20.x'

  - script: npm i -g @vidocsecurity/cli
    displayName: 'Install Vidoc CLI'

  - script: vidoc ci --token $(VIDOC_TOKEN)
    displayName: 'Security Scan'
```

## Bitbucket Pipelines

```yaml theme={null}
# bitbucket-pipelines.yml
image: node:20

pipelines:
  default:
    - step:
        name: Security Scan
        script:
          - npm i -g @vidocsecurity/cli
          - vidoc ci --token $VIDOC_TOKEN
```

## Single-Tenant Installations

For self-hosted Vidoc, include the API URL:

```bash theme={null}
vidoc ci --token $VIDOC_TOKEN --api-url https://your-vidoc-instance.com
```

## Best Practices

### Cache CLI Installation

Speed up pipelines by caching:

```yaml theme={null}
# GitHub Actions example
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: npm-vidoc-cli
```

### Use Profiles for Different Environments

```bash theme={null}
# Create profiles for different projects
vidoc login --profile prod --token $PROD_TOKEN
vidoc login --profile staging --token $STAGING_TOKEN

# Use in CI
vidoc ci --profile prod
```

## Viewing Results

After CI scans complete:

1. Go to [app.vidocsecurity.com](https://app.vidocsecurity.com)
2. Select your project
3. View issues in the dashboard
4. Check PR-specific results in **Pull Requests**

## Troubleshooting

### "Unauthorized" in CI

1. Verify `VIDOC_TOKEN` secret is set correctly
2. Check the token hasn't been revoked
3. Ensure the token has proper permissions

### Scan Timeout

For large codebases, increase your CI job timeout. First scans take longer due to initial indexing.

### "No files found"

Ensure the checkout step runs before the scan and the working directory is correct.

## Related Pages

<CardGroup>
  <Card title="CLI Scanning" icon="terminal" href="/cli/scanning">
    Scan command details
  </Card>

  <Card title="Authentication" icon="key" href="/cli/authentication">
    Token setup
  </Card>

  <Card title="API Keys" icon="key" href="/settings/api-keys">
    Manage tokens
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Review results
  </Card>
</CardGroup>


# CLI Installation
Source: https://docs.vidocsecurity.com/cli/installation

Install the Vidoc CLI for local and CI/CD scanning

The Vidoc CLI scans your codebase for security vulnerabilities from your terminal or CI/CD pipelines.

## Requirements

* **Node.js** 18 or higher
* **npm** or **yarn** package manager

## Installation

### npm (Recommended)

```bash theme={null}
npm i -g @vidocsecurity/cli
```

### yarn

```bash theme={null}
yarn global add @vidocsecurity/cli
```

### npx (No Installation)

Run without installing:

```bash theme={null}
npx @vidocsecurity/cli scan
```

## Verify Installation

Check that the CLI is installed:

```bash theme={null}
vidoc version
```

## Update

Update to the latest version:

```bash theme={null}
npm update -g @vidocsecurity/cli
```

## Uninstall

Remove the CLI:

```bash theme={null}
npm uninstall -g @vidocsecurity/cli
```

## Troubleshooting

### "command not found: vidoc"

Ensure the npm global bin directory is in your PATH:

```bash theme={null}
# Find npm global bin directory
npm config get prefix

# Add to your shell profile (.bashrc, .zshrc, etc.)
export PATH="$(npm config get prefix)/bin:$PATH"
```

### Permission Errors

If you get permission errors during installation:

```bash theme={null}
# Option 1: Fix npm permissions (recommended)
mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
export PATH=~/.npm-global/bin:$PATH

# Option 2: Use sudo (not recommended)
sudo npm i -g @vidocsecurity/cli
```

## Next Steps

<CardGroup>
  <Card title="Authentication" icon="key" href="/cli/authentication">
    Login with your API token
  </Card>

  <Card title="Scanning" icon="magnifying-glass" href="/cli/scanning">
    Run your first scan
  </Card>
</CardGroup>


# CLI Scanning
Source: https://docs.vidocsecurity.com/cli/scanning

Scan your codebase for security vulnerabilities using the CLI

Use the Vidoc CLI to scan your code for security vulnerabilities from your terminal.

## Basic Scan

Navigate to your project directory and run:

```bash theme={null}
vidoc scan
```

Or simply:

```bash theme={null}
vidoc
```

The CLI indexes your code, scans for vulnerabilities, and syncs results with your Vidoc project.

## Scan Options

### Force Reindex

Force a complete reindex of the codebase (useful if files changed outside of git):

```bash theme={null}
vidoc scan --force-reindex
# or
vidoc scan -f
```

### Index Only

Index the codebase without running a full scan:

```bash theme={null}
vidoc scan --only-indexing
```

### Use a Specific Profile

Scan using a named profile:

```bash theme={null}
vidoc scan --profile work
# or
vidoc scan -p work
```

### Override Token

Use a specific token for this scan:

```bash theme={null}
vidoc scan --token <your-token>
```

### Custom API URL

For single-tenant installations:

```bash theme={null}
vidoc scan --api-url https://your-vidoc-instance.com
```

### Custom Config File

Use a specific configuration file:

```bash theme={null}
vidoc scan --config /path/to/config
# or
vidoc scan -c /path/to/config
```

## How Scanning Works

```mermaid theme={null}
flowchart LR
    A[vidoc scan] --> B[Index Files]
    B --> C[Upload to Vidoc]
    C --> D[AI Analysis]
    D --> E[Results in Dashboard]
```

1. **Index** - CLI analyzes your local files
2. **Upload** - Code is sent to Vidoc for analysis
3. **Analyze** - AI scans for security vulnerabilities
4. **Results** - View findings in the Vidoc dashboard

## Viewing Results

After scanning, view results in the Vidoc dashboard:

1. Go to [app.vidocsecurity.com](https://app.vidocsecurity.com)
2. Select your project
3. Navigate to **Issues** to see findings

## CI Mode

For CI/CD pipelines, use the dedicated `ci` command:

```bash theme={null}
vidoc ci
```

This runs in non-interactive mode optimized for automated environments. See [CI/CD Integration](/cli/ci-cd) for details.

## Global Options

These options work with any command:

| Option             | Short | Description                   |
| ------------------ | ----- | ----------------------------- |
| `--force-reindex`  | `-f`  | Force complete reindex        |
| `--only-indexing`  |       | Index only, skip full scan    |
| `--profile <name>` | `-p`  | Use named profile             |
| `--api-url <url>`  |       | Override API URL              |
| `--token <token>`  |       | Override authentication token |
| `--config <path>`  | `-c`  | Custom config file path       |

## Troubleshooting

### "Not authenticated"

Run `vidoc login` to authenticate, or pass `--token` with your scan.

### "No files found"

1. Check you're in the correct directory
2. Ensure the directory contains supported file types
3. Verify the project is properly initialized

### Scan Taking Too Long

1. Use `--only-indexing` first to see indexing progress
2. Large codebases take longer on first scan
3. Subsequent scans are faster (incremental indexing)

## Related Pages

<CardGroup>
  <Card title="Installation" icon="download" href="/cli/installation">
    Install the CLI
  </Card>

  <Card title="Authentication" icon="key" href="/cli/authentication">
    Configure tokens
  </Card>

  <Card title="CI/CD Integration" icon="gear" href="/cli/ci-cd">
    Automate in pipelines
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Review scan results
  </Card>
</CardGroup>


# AI Chat
Source: https://docs.vidocsecurity.com/dashboard/ai-chat

Get AI assistance understanding and fixing security issues

AI Chat provides an intelligent assistant to help you understand security vulnerabilities, get remediation guidance, and answer questions about your code.

## Accessing AI Chat

### From an Issue

1. Open any issue in the dashboard
2. Click **"Ask AI"**
3. Chat opens with the issue context preloaded

### From the Header

1. Click the **AI Chat** icon in the project header
2. Chat opens for general security questions
3. No specific issue context

## What AI Chat Can Do

### Explain Vulnerabilities

Ask about any security issue:

* "What is SQL injection?"
* "How can this XSS be exploited?"
* "What's the impact of this vulnerability?"

### Suggest Fixes

Get remediation guidance:

* "How do I fix this?"
* "Show me a secure implementation"
* "What library should I use for sanitization?"

### Analyze Code

Discuss code patterns:

* "Is this input validation sufficient?"
* "What security issues might this function have?"
* "How can I make this more secure?"

### Answer Security Questions

General security guidance:

* "What's the best practice for storing passwords?"
* "How should I handle user authentication?"
* "What security headers should I set?"

## Example Conversations

### Understanding an Issue

```
You: What does this SQL injection issue mean?

AI: This SQL injection vulnerability occurs because user input
is directly concatenated into the SQL query string. An attacker
could input something like `' OR '1'='1` to bypass authentication
or `'; DROP TABLE users; --` to delete data.

The vulnerable code builds the query like:
"SELECT * FROM users WHERE id = " + userId

To fix this, use parameterized queries...
```

### Getting a Fix

```
You: How do I fix this XSS vulnerability?

AI: For this XSS issue where user input is being rendered in HTML,
you have several options:

1. Use textContent instead of innerHTML:
   element.textContent = userInput;

2. Use a sanitization library:
   element.innerHTML = DOMPurify.sanitize(userInput);

3. Encode the output for the context...
```

## Context Awareness

When opened from an issue, AI Chat knows:

* The vulnerability type and description
* The affected code snippet
* The file path and location
* Your codebase language and framework

This context helps provide relevant, specific guidance.

## Tips for Better Responses

### Be Specific

```
❌ "How do I fix this?"
✅ "How do I fix this SQL injection using Prisma ORM?"
```

### Provide Context

```
❌ "Is this secure?"
✅ "Is this secure for a public API endpoint that handles payments?"
```

### Ask Follow-ups

The chat maintains conversation history, so you can:

* Ask clarifying questions
* Request more detail
* Ask for alternative approaches

## Limitations

AI Chat is designed to help, but:

* Always verify suggestions before implementing
* It may not know your specific business logic
* Complex architectural questions may need human review
* It cannot access external systems or run code

## Chat History

* Chat history persists during your session
* History is cleared when you close the browser
* Conversations are not stored permanently

## Related Pages

<CardGroup>
  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View and manage findings
  </Card>

  <Card title="Learnings" icon="brain" href="/dashboard/learnings">
    Create learnings from issues
  </Card>

  <Card title="Security Categories" icon="shield" href="/security/overview">
    Learn about vulnerability types
  </Card>

  <Card title="How It Works" icon="lightbulb" href="/how-it-works">
    Understand AI detection
  </Card>
</CardGroup>


# Issues
Source: https://docs.vidocsecurity.com/dashboard/issues

View and manage security findings across your repositories

The Issues page displays all security vulnerabilities found in your code. Review findings, mark false positives, and track remediation progress.

## Issues Overview

Security issues are sorted by severity:

| Severity        | Description                                            |
| --------------- | ------------------------------------------------------ |
| **Critical**    | Immediate exploitation risk, requires urgent attention |
| **High**        | Serious vulnerability that should be fixed soon        |
| **Medium**      | Moderate risk, plan to address                         |
| **Low**         | Minor security weakness                                |
| **Informative** | Security best practice suggestion                      |

## Viewing Issues

The issue list shows:

* **Severity** - Color-coded severity level
* **Title** - Brief description of the vulnerability
* **Category** - Security category (XSS, SQLi, etc.)
* **File** - Location in your codebase
* **Repository** - Source repository
* **Status** - Open, Ignored, or Closed

### Issue Details

Click any issue to see:

* **Full Description** - Detailed explanation of the vulnerability
* **Code Snippet** - Highlighted vulnerable code with line numbers
* **Remediation** - Suggested fix or mitigation
* **Context** - Repository, branch, and file path
* **AI Analysis** - Vidoc's reasoning for flagging this issue

## Filtering Issues

Use filters to find specific issues:

* **Severity** - Filter by Critical, High, Medium, Low, Informative
* **Status** - Open, Ignored, Closed
* **Repository** - Specific repository
* **Branch** - Git branch
* **Category** - Security category (XSS, SQL Injection, etc.)
* **File path** - Search by file path pattern

## Managing Issues

### Mark as Fixed

When you've remediated a vulnerability:

1. Click **"Mark as Fixed"**
2. The issue moves to Closed status
3. If the vulnerability reappears, it will be reopened automatically

### Ignore an Issue

For false positives or accepted risks:

1. Click **"Ignore"**
2. Provide a reason (required)
3. Vidoc creates a [learning](/dashboard/learnings) to avoid similar false positives

<Tip>
  Write clear, specific reasons when ignoring issues. This helps Vidoc learn your codebase patterns and improves future scan accuracy.
</Tip>

### Reopen an Issue

To reactivate a closed or ignored issue:

1. Filter to show Closed or Ignored issues
2. Click **"Reopen"** on the issue
3. The issue returns to Open status

## Bulk Actions

Select multiple issues to perform bulk operations:

1. Check the boxes next to issues
2. Use the bulk action dropdown:
   * **Mark as Fixed** - Close selected issues
   * **Ignore** - Ignore with a shared reason
   * **Reopen** - Reactivate selected issues

## Ask AI

For complex security issues, use the AI assistant:

1. Click **"Ask AI"** on any issue
2. Ask questions about:
   * How the vulnerability could be exploited
   * Recommended remediation approaches
   * Impact assessment

See [AI Chat](/dashboard/ai-chat) for more on the AI assistant.

## Issue Lifecycle

```mermaid theme={null}
stateDiagram-v2
    [*] --> Open: Scan detects issue
    Open --> Closed: Mark as Fixed
    Open --> Ignored: Ignore (create learning)
    Closed --> Open: Reopen / Redetected
    Ignored --> Open: Reopen
```

## Related Pages

<CardGroup>
  <Card title="Repositories" icon="code" href="/dashboard/repositories">
    View issues by repository
  </Card>

  <Card title="Learnings" icon="brain" href="/dashboard/learnings">
    Review false positive learnings
  </Card>

  <Card title="AI Chat" icon="message" href="/dashboard/ai-chat">
    Get AI help with issues
  </Card>

  <Card title="Pull Requests" icon="code-pull-request" href="/dashboard/pull-requests">
    View issues by PR
  </Card>
</CardGroup>


# Learnings
Source: https://docs.vidocsecurity.com/dashboard/learnings

AI-driven rules from ignored issues to reduce false positives

Learnings are rules Vidoc creates when you ignore issues. They help Vidoc avoid flagging similar false positives in future scans.

## How Learnings Work

```mermaid theme={null}
flowchart LR
    A[Ignore Issue] --> B[Provide Reason]
    B --> C[Learning Created]
    C --> D[Future Scans]
    D --> E[Similar Issues Filtered]
```

1. You find a false positive issue
2. Click **"Ignore"** and provide a reason
3. Vidoc creates a learning from the context
4. Future scans apply the learning automatically
5. Similar false positives are filtered out

## Creating Effective Learnings

When ignoring an issue, provide clear, specific reasons:

| Good Reason                                          | Why It's Effective             |
| ---------------------------------------------------- | ------------------------------ |
| "Input is sanitized by sanitizeHtml() in middleware" | Explains the security control  |
| "This is a test file, not production code"           | Identifies context             |
| "User input is validated against allowlist"          | Describes protection mechanism |

<Tip>
  Better reasons create more accurate learnings. Be specific about why the issue is a false positive.
</Tip>

## Viewing Learnings

The Learnings page displays:

* **Learning ID** - Unique identifier
* **Reason** - Why the original issue was ignored
* **Created** - When the learning was created
* **Applied Count** - Number of issues this learning affects

### Learning Details

Click a learning to see:

* Original issue that triggered the learning
* All issues where this learning is applied
* Full context and code snippets

## Managing Learnings

### Delete a Learning

If a learning is too broad or no longer valid:

1. Click the learning
2. Click **"Delete Learning"**
3. Affected issues return to Open status

<Warning>
  Deleting a learning may cause previously filtered issues to reappear in future scans.
</Warning>

### Review Applied Issues

To see which issues a learning affects:

1. Click the learning
2. View the **"Applied Issues"** section
3. Review if the learning is correctly applied

## Best Practices

* **Review learnings periodically** - Ensure they're still valid
* **Use specific reasons** - Vague reasons create imprecise learnings
* **Don't ignore real issues** - Only create learnings for true false positives
* **Check applied count** - High counts may indicate overly broad learnings

## Related Pages

<CardGroup>
  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Ignore issues to create learnings
  </Card>

  <Card title="AI Chat" icon="message" href="/dashboard/ai-chat">
    Get AI help with issues
  </Card>
</CardGroup>


# Dashboard Overview
Source: https://docs.vidocsecurity.com/dashboard/overview

Navigate the Vidoc dashboard to manage security across your projects

The Vidoc dashboard is your central hub for managing code security across all repositories and projects.

## Dashboard Layout

### Project Selector

Switch between projects using the dropdown in the sidebar. Each project contains its own repositories, issues, and settings.

### Main Navigation

| Section           | Purpose                                   |
| ----------------- | ----------------------------------------- |
| **Issues**        | All security findings across repositories |
| **Repositories**  | Manage repos and run scans                |
| **Pull Requests** | PR-specific security results              |
| **Learnings**     | False positive rules from ignored issues  |
| **AI Chat**       | Security assistant                        |
| **Settings**      | API keys, team members, integrations      |

## Key Metrics

The dashboard displays:

* **Open Issues** - Total unresolved security findings
* **Critical/High** - Issues requiring immediate attention
* **Recent Scans** - Latest scan activity
* **Repositories** - Connected repositories count

## Quick Actions

### Run a Scan

1. Go to **Repositories**
2. Click **"Scan"** on any repository
3. Monitor progress in the scan list

### Review Issues

1. Go to **Issues**
2. Filter by severity to prioritize
3. Click an issue for details

### Connect GitHub

1. Go to **Settings** → **Integrations**
2. Click **"Connect GitHub"**
3. Authorize and select repositories

## Projects

Projects group related repositories. Use projects to:

* Separate security scans by team or application
* Apply different settings per project
* Manage team access at the project level

See [Projects](/dashboard/projects) for project management.

## Related Pages

<CardGroup>
  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Review security findings
  </Card>

  <Card title="Repositories" icon="code" href="/dashboard/repositories">
    Manage repositories and scans
  </Card>

  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Connect GitHub integration
  </Card>

  <Card title="API Keys" icon="key" href="/settings/api-keys">
    Manage API keys
  </Card>
</CardGroup>


# Projects
Source: https://docs.vidocsecurity.com/dashboard/projects

Organize repositories and manage security settings by project

Projects group related repositories together, allowing you to organize security scanning by team, application, or any structure that fits your workflow.

## Creating a Project

1. Click **"New Project"** in the sidebar
2. Enter a project name
3. Click **"Create"**

## Project Structure

Each project contains:

| Section           | Description                         |
| ----------------- | ----------------------------------- |
| **Repositories**  | Connected code repositories         |
| **Issues**        | Security findings across all repos  |
| **Pull Requests** | PR-specific scan results            |
| **Learnings**     | False positive rules                |
| **Settings**      | API keys, integrations, team access |

## Managing Projects

### Switch Projects

Use the project dropdown in the sidebar to switch between projects.

### Rename a Project

1. Go to project **Settings**
2. Click **"General"**
3. Update the project name
4. Click **"Save"**

### Delete a Project

1. Go to project **Settings**
2. Scroll to **"Danger Zone"**
3. Click **"Delete Project"**
4. Confirm deletion

<Warning>
  Deleting a project permanently removes all repositories, issues, and learnings associated with it.
</Warning>

## Project Organization

### By Application

Create one project per application:

```
├── Web App
│   ├── frontend repo
│   └── backend repo
├── Mobile App
│   └── mobile repo
└── Admin Dashboard
    └── admin repo
```

### By Team

Organize by team ownership:

```
├── Team Alpha
│   ├── service-a
│   └── service-b
├── Team Beta
│   └── service-c
```

### By Environment

Separate by deployment environment:

```
├── Production
│   └── prod repos
├── Staging
│   └── staging repos
```

## Project Settings

### API Keys

Each project has its own API keys:

1. Go to **Settings** → **API Keys**
2. Create keys for CI/CD or CLI access
3. Keys are scoped to this project only

See [API Keys](/settings/api-keys) for details.

### Team Members

Manage who has access:

1. Go to **Settings** → **Team**
2. Invite members by email
3. Assign roles (Admin, Member, Viewer)

See [Team Members](/settings/team-members) for details.

### Integrations

Configure project-specific integrations:

1. Go to **Settings** → **Integrations**
2. Connect GitHub for this project
3. Each project can have different GitHub orgs

## Project Metrics

The project dashboard shows:

* **Total Issues** - Open security findings
* **Critical/High** - Priority issues count
* **Repositories** - Connected repos count
* **Recent Activity** - Latest scans and changes

## Best Practices

### Naming Conventions

Use clear, consistent names:

* `customer-portal` not `cp`
* `payment-service` not `svc1`

### Repository Grouping

Group repos that:

* Deploy together
* Share the same security context
* Are managed by the same team

### Learnings Scope

Remember that learnings are project-scoped:

* A learning in Project A doesn't affect Project B
* Consider this when organizing repos

## Related Pages

<CardGroup>
  <Card title="Repositories" icon="code" href="/dashboard/repositories">
    Add repos to projects
  </Card>

  <Card title="API Keys" icon="key" href="/settings/api-keys">
    Manage project API keys
  </Card>

  <Card title="Team Members" icon="users" href="/settings/team-members">
    Manage access
  </Card>

  <Card title="Dashboard Overview" icon="chart-line" href="/dashboard/overview">
    Navigate the dashboard
  </Card>
</CardGroup>


# Pull Requests
Source: https://docs.vidocsecurity.com/dashboard/pull-requests

Review security scans on GitHub pull requests

The Pull Requests page shows security scan results for GitHub PRs, helping you catch issues before code is merged.

## Pull Request List

View all PRs with security scans:

| Column         | Description                                       |
| -------------- | ------------------------------------------------- |
| **PR**         | PR number and title                               |
| **Repository** | Source repository                                 |
| **Status**     | Scan status (Pending, Scanning, Complete, Failed) |
| **Issues**     | Number of security issues found                   |
| **Created**    | When the PR was opened                            |

## PR Detail View

Click a PR to see:

* **Security issues** introduced in this PR
* **Code changes** that triggered each finding
* **Link to GitHub** for the full PR context
* **Scan history** for the PR

### PR-Specific Filtering

Issues shown are filtered to changes in the PR only. This helps you focus on new vulnerabilities rather than pre-existing issues.

## Scan Triggers

PRs are automatically scanned when:

1. **PR Created** - Initial scan on new PR
2. **PR Updated** - Re-scan when new commits are pushed
3. **Manual Trigger** - Click "Scan" on the PR

<Info>
  Auto-scan requires [GitHub Integration](/github/setup) to be configured.
</Info>

## PR Status Indicators

| Status       | Meaning                   |
| ------------ | ------------------------- |
| **Pending**  | Scan queued               |
| **Scanning** | Scan in progress          |
| **Complete** | Scan finished             |
| **Failed**   | Scan encountered an error |

## GitHub PR Comments

When scans complete, Vidoc posts findings as PR comments:

* **Inline comments** on specific lines of code
* **Summary comment** with all findings

See [PR Comments](/github/pr-comments) to configure comment behavior.

## Enabling PR Scans

To scan PRs automatically:

1. [Connect GitHub](/github/setup)
2. Enable auto-scan for the repository
3. Create or update a PR

## Related Pages

<CardGroup>
  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View all security findings
  </Card>

  <Card title="PR Comments" icon="comment" href="/github/pr-comments">
    Configure PR comment settings
  </Card>

  <Card title="Auto Scan" icon="rotate" href="/github/auto-scan">
    Configure automatic scanning
  </Card>

  <Card title="Repositories" icon="code" href="/dashboard/repositories">
    Manage repositories
  </Card>
</CardGroup>


# Repositories
Source: https://docs.vidocsecurity.com/dashboard/repositories

Manage code repositories and run security scans

The Repositories page shows all repositories in your project. Add repositories, run scans, and view security issues for each repository.

## Repository List

View all repositories with:

* **Repository name** - Name from GitHub or custom label
* **Last scan** - When the repository was last scanned
* **Issues** - Open issue count
* **Status** - Scan status (Idle, Scanning, etc.)

## Adding Repositories

### Via GitHub Integration (Recommended)

1. Go to **Settings** → **Integrations**
2. Click **"Connect GitHub"** if not connected
3. Return to **Repositories** → **"Add Repository"**
4. Select repositories from the dropdown

### Manual Setup

For repositories not in GitHub:

1. Click **"Add Repository"**
2. Select **"Manual Setup"**
3. Follow CLI instructions to upload your code

## Running Scans

### Manual Scan

1. Find the repository in the list
2. Click **"Scan"**
3. Monitor progress in the scan indicator

### Automatic Scans

Enable auto-scanning for repositories:

1. Click the repository settings (gear icon)
2. Toggle **"Auto Scan"** on
3. Scans trigger on:
   * New pull requests
   * Pushes to the default branch

See [Auto Scan](/github/auto-scan) for configuration options.

## Repository Detail View

Click a repository to see:

* **Issues tab** - Security findings for this repository only
* **Scans tab** - History of all scans
* **Settings** - Repository-specific configuration

### Filtering Issues

Within a repository view:

* Filter by **branch** to see branch-specific issues
* Filter by **severity** to prioritize critical findings
* Filter by **status** to see open, ignored, or closed issues

## Repository Settings

Configure per-repository options:

| Setting            | Description                          |
| ------------------ | ------------------------------------ |
| **Default Branch** | Branch to scan for baseline issues   |
| **Auto Scan**      | Enable automatic scanning on PR/push |
| **Ignored Paths**  | File patterns to exclude from scans  |

## Deleting Repositories

1. Click repository settings (gear icon)
2. Scroll to **"Danger Zone"**
3. Click **"Delete Repository"**

<Warning>
  Deleting a repository removes all associated issues and scan history.
</Warning>

## Related Pages

<CardGroup>
  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View all issues across repositories
  </Card>

  <Card title="Auto Scan" icon="rotate" href="/github/auto-scan">
    Configure automatic scanning
  </Card>

  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Connect GitHub for easier setup
  </Card>

  <Card title="CLI Scanning" icon="terminal" href="/cli/scanning">
    Scan via command line
  </Card>
</CardGroup>


# Auto Scan
Source: https://docs.vidocsecurity.com/github/auto-scan

Configure automatic security scanning for GitHub repositories

Auto Scan automatically triggers security scans when code changes occur in your GitHub repositories.

## Scan Triggers

When enabled, auto-scan runs on:

| Event                      | Description                      |
| -------------------------- | -------------------------------- |
| **Pull Request Opened**    | Scans new PRs immediately        |
| **Pull Request Updated**   | Re-scans when commits are pushed |
| **Push to Default Branch** | Scans merges to main/master      |

## Enabling Auto Scan

### Per Repository

1. Go to **Repositories**
2. Click settings (gear icon) on a repository
3. Toggle **"Auto Scan"** on

### For All Repositories

1. Go to **Settings** → **Integrations** → **GitHub**
2. Enable **"Auto Scan for New Repositories"**
3. New repositories will have auto-scan enabled by default

## Configuration Options

### Default Branch Scanning

Control when default branch scans occur:

* **On merge** - Scan after PR merges (recommended)
* **On push** - Scan every push to default branch
* **Disabled** - Don't scan default branch automatically

### PR Scan Settings

Configure PR scanning behavior:

| Setting            | Description                     |
| ------------------ | ------------------------------- |
| **Scan on open**   | Scan when PR is created         |
| **Scan on update** | Re-scan when new commits pushed |
| **Skip draft PRs** | Don't scan draft pull requests  |

## Scan Frequency

Vidoc rate-limits scans to prevent abuse:

* **PR scans** - Immediate, one per PR update
* **Default branch** - Batched if multiple merges occur quickly

## Scan Status

Monitor auto-scan status:

1. **Webhook delivery** - Check GitHub webhook settings
2. **Scan history** - View in Repositories → \[Repo] → Scans
3. **PR status** - Check the Pull Requests page

## Disabling Auto Scan

### Per Repository

1. Go to **Repositories**
2. Click settings on the repository
3. Toggle **"Auto Scan"** off

### Temporarily

Use branch patterns to exclude branches:

1. Repository settings → **"Ignored Branches"**
2. Add patterns (e.g., `feature/*`)

## Troubleshooting

### Scans Not Triggering

1. Verify GitHub integration is connected
2. Check webhook delivery in GitHub repo settings
3. Ensure auto-scan is enabled for the repository
4. See [Troubleshooting](/github/troubleshooting)

### Duplicate Scans

If you see duplicate scans:

1. Check if CLI and auto-scan are both running
2. Verify webhook isn't configured multiple times

## Related Pages

<CardGroup>
  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Configure GitHub integration
  </Card>

  <Card title="PR Comments" icon="comment" href="/github/pr-comments">
    Configure PR feedback
  </Card>

  <Card title="Repositories" icon="code" href="/dashboard/repositories">
    Manage repository settings
  </Card>

  <Card title="Troubleshooting" icon="wrench" href="/github/troubleshooting">
    Fix GitHub issues
  </Card>
</CardGroup>


# PR Comments
Source: https://docs.vidocsecurity.com/github/pr-comments

Configure how Vidoc reports security findings in GitHub pull requests

Vidoc posts security findings directly to your GitHub pull requests, helping developers catch issues before merging.

## Comment Types

### Inline Comments

Posted on specific lines of code where issues are found:

* Shows vulnerability type and severity
* Links to full issue details in Vidoc
* Appears in the PR's "Files changed" view

### Summary Comment

A single comment summarizing all findings:

* Lists all issues found in the PR
* Groups by severity
* Posted once per scan

## Enabling PR Comments

1. [Connect GitHub](/github/setup) if not already connected
2. Go to **Settings** → **Integrations** → **GitHub**
3. Enable **"Post PR Comments"**
4. Configure comment preferences

## Configuration Options

| Setting                | Description                                   | Default |
| ---------------------- | --------------------------------------------- | ------- |
| **Inline comments**    | Comment on specific code lines                | Enabled |
| **Summary comment**    | Post summary of all findings                  | Enabled |
| **Minimum severity**   | Only comment on issues at or above this level | Low     |
| **Comment on re-scan** | Update comments when PR is re-scanned         | Enabled |

### Minimum Severity

Control noise by setting a minimum severity for PR comments:

* **Critical only** - Only comment on critical issues
* **High and above** - Critical + High
* **Medium and above** - Critical + High + Medium
* **Low and above** - All except Informative
* **All** - Include informative issues

<Tip>
  Start with "Medium and above" and adjust based on your team's preferences.
</Tip>

## Comment Format

### Inline Comment Example

```
🔴 **Critical: SQL Injection**

User input flows directly into SQL query without sanitization.

**Remediation:** Use parameterized queries or an ORM.

[View in Vidoc →](https://app.vidocsecurity.com/...)
```

### Summary Comment Example

```
## Vidoc Security Scan Results

Found **3 issues** in this pull request:

| Severity | Issue | File |
|----------|-------|------|
| 🔴 Critical | SQL Injection | src/db.js:45 |
| 🟠 High | XSS | src/render.js:12 |
| 🟡 Medium | Open Redirect | src/auth.js:78 |

[View full report →](https://app.vidocsecurity.com/...)
```

## Managing Comments

### Resolve Comments

When you fix an issue:

1. Push the fix to the PR
2. Vidoc re-scans automatically (if auto-scan enabled)
3. Resolved issues are marked as such in comments

### Hide Comments

To hide Vidoc comments from a PR:

1. On GitHub, click the "..." menu on the comment
2. Select "Hide" → "Resolved"

<Note>
  This doesn't affect the issue status in Vidoc.
</Note>

## PR Check Status

Vidoc can also report as a GitHub Check:

1. Go to **Settings** → **Integrations** → **GitHub**
2. Enable **"Report as Check"**
3. PRs show Vidoc status in the checks section

### Check Status Logic

| Result                    | Status                      |
| ------------------------- | --------------------------- |
| No issues                 | ✅ Passed                    |
| Issues below threshold    | ✅ Passed (with annotations) |
| Issues at/above threshold | ❌ Failed                    |

Configure the failure threshold in GitHub integration settings.

## Disabling PR Comments

1. Go to **Settings** → **Integrations** → **GitHub**
2. Disable **"Post PR Comments"**

Or disable per-repository in repository settings.

## Related Pages

<CardGroup>
  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Configure GitHub integration
  </Card>

  <Card title="Auto Scan" icon="rotate" href="/github/auto-scan">
    Configure automatic scanning
  </Card>

  <Card title="Pull Requests" icon="code-pull-request" href="/dashboard/pull-requests">
    View PR scan results
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Manage all security issues
  </Card>
</CardGroup>


# GitHub Setup
Source: https://docs.vidocsecurity.com/github/setup

Connect GitHub to enable automatic security scanning

Connect your GitHub account to Vidoc for automatic scanning of pull requests and repositories.

## Installation

### Step 1: Connect GitHub

1. Go to your project in the Vidoc dashboard
2. Navigate to **Settings** → **Integrations**
3. Click **"Connect GitHub"**
4. You'll be redirected to GitHub to authorize the Vidoc app

### Step 2: Authorize Access

On the GitHub authorization page:

1. Review the permissions requested
2. Select which organizations to grant access
3. Click **"Authorize"**

<Info>
  Vidoc requires read access to your code and write access to pull request comments.
</Info>

### Step 3: Select Repositories

After authorization:

1. Return to Vidoc
2. Click **"Add Repository"**
3. Select repositories from the list
4. Choose which branches to scan

## Permissions Explained

| Permission               | Purpose                                   |
| ------------------------ | ----------------------------------------- |
| **Read: Code**           | Scan your source code for vulnerabilities |
| **Read: Pull requests**  | Detect new PRs to scan                    |
| **Write: Pull requests** | Post security findings as comments        |
| **Read: Metadata**       | Access repository information             |

## Repository Settings

After adding a repository, configure scanning behavior:

### Default Branch

The branch scanned for baseline security posture. Usually `main` or `master`.

### Auto Scan

Enable to automatically scan:

* New pull requests
* Pushes to the default branch

See [Auto Scan](/github/auto-scan) for configuration options.

### PR Comments

Configure how Vidoc reports findings in pull requests:

* **Inline comments** - Comments on specific lines of code
* **Summary comment** - Overview of all findings in the PR

See [PR Comments](/github/pr-comments) for detailed settings.

## Multiple Organizations

To scan repositories from multiple GitHub organizations:

1. Go to **Settings** → **Integrations**
2. Click **"Add Organization"**
3. Authorize Vidoc for the new organization
4. Select repositories to add

## Troubleshooting

### "Repository not appearing in list"

1. Check that Vidoc is authorized for the repository's organization
2. Go to GitHub → Settings → Applications → Vidoc
3. Click **"Configure"** and add the missing repository

### "Scans not triggering"

1. Verify Auto Scan is enabled for the repository
2. Check webhook delivery in GitHub repository settings
3. See [Troubleshooting](/github/troubleshooting) for more solutions

### Revoking Access

To disconnect GitHub:

1. Go to Vidoc **Settings** → **Integrations**
2. Click **"Disconnect"** next to GitHub
3. Optionally, revoke access in GitHub Settings → Applications

## Next Steps

<CardGroup>
  <Card title="Auto Scan" icon="rotate" href="/github/auto-scan">
    Configure automatic scanning triggers
  </Card>

  <Card title="PR Comments" icon="comment" href="/github/pr-comments">
    Customize PR feedback settings
  </Card>
</CardGroup>


# GitHub Troubleshooting
Source: https://docs.vidocsecurity.com/github/troubleshooting

Solve common GitHub integration issues

Solutions for common problems with Vidoc's GitHub integration.

## Scans Not Triggering

### Check Integration Status

1. Go to **Settings** → **Integrations**
2. Verify GitHub shows as "Connected"
3. If disconnected, click **"Connect GitHub"**

### Verify Repository Settings

1. Go to **Repositories**
2. Click settings (gear) on the repository
3. Ensure **"Auto Scan"** is enabled

### Check Webhooks

1. Go to GitHub → Repository → Settings → Webhooks
2. Find the Vidoc webhook
3. Check **"Recent Deliveries"**
4. Look for failed deliveries (red X)

**Common webhook issues:**

* `401 Unauthorized` - Reconnect GitHub integration
* `404 Not Found` - Repository may not be configured
* `500 Server Error` - Temporary issue, should auto-retry

### Verify PR Settings

If PR scans aren't triggering:

1. Check if the PR is a draft (drafts may be skipped)
2. Verify the target branch is monitored
3. Check if the repository has auto-scan enabled

## Repository Not Appearing

### Check Organization Access

1. Go to GitHub → Settings → Applications → Vidoc
2. Click **"Configure"**
3. Verify the organization is listed
4. Add any missing repositories

### Request Organization Approval

If you don't have admin access:

1. Ask an organization admin to approve Vidoc
2. Go to GitHub → Organization → Settings → Third-party access
3. Approve the Vidoc application

### Refresh Repository List

1. In Vidoc, go to **Repositories**
2. Click **"Add Repository"**
3. Click **"Refresh"** to sync with GitHub

## PR Comments Not Posting

### Check Permissions

1. Go to GitHub → Settings → Applications → Vidoc
2. Verify write access to pull requests
3. Re-authorize if needed

### Check Comment Settings

1. Go to Vidoc **Settings** → **Integrations** → **GitHub**
2. Ensure **"Post PR Comments"** is enabled
3. Check the minimum severity setting

### Verify Issue Existence

Comments are only posted if issues are found:

1. Check the scan completed successfully
2. Review issues in the Vidoc dashboard
3. Verify issues meet the minimum severity threshold

## Authentication Errors

### "Bad Credentials" Error

1. Go to **Settings** → **Integrations**
2. Click **"Disconnect"** next to GitHub
3. Click **"Connect GitHub"**
4. Re-authorize the application

### "Resource Not Accessible"

The token may have expired or lost permissions:

1. Disconnect GitHub in Vidoc
2. In GitHub, revoke Vidoc's access (Settings → Applications)
3. Reconnect from Vidoc

## Scan Failures

### "Repository Not Found"

1. Verify the repository exists
2. Check Vidoc has access (not removed in GitHub)
3. Refresh the repository list

### "Branch Not Found"

1. Check the branch name is correct
2. Verify the branch exists in GitHub
3. Push the branch if it's local only

### "Clone Failed"

1. Repository may be too large
2. Check for submodules requiring separate auth
3. Try scanning a specific branch

## Rate Limiting

### GitHub API Rate Limits

If you see rate limit errors:

1. Wait for the rate limit to reset (usually 1 hour)
2. Reduce the number of concurrent scans
3. Contact support for enterprise rate limits

### Vidoc Rate Limits

1. Check if multiple scans are running
2. Avoid triggering scans on every commit
3. Use branch filters to reduce scan frequency

## Sync Issues

### Issues Not Syncing

If issues in Vidoc don't match GitHub:

1. Refresh the browser
2. Wait for scan to complete
3. Check for sync errors in scan history

### Stale Data

1. Click **"Sync"** on the repository
2. Wait for re-scan to complete
3. Clear browser cache if needed

## Quick Fixes

| Problem          | Quick Fix                        |
| ---------------- | -------------------------------- |
| Not connected    | Reconnect GitHub integration     |
| Missing repos    | Configure in GitHub app settings |
| No PR comments   | Enable in integration settings   |
| Webhook failures | Check delivery logs in GitHub    |
| Scan stuck       | Check scan history for errors    |

## Getting Help

If issues persist:

1. Check the [Vidoc Status Page](https://status.vidocsecurity.com) for outages
2. Email support at [contact@vidocsecurity.com](mailto:contact@vidocsecurity.com)
3. Include:
   * Repository URL
   * Error messages
   * Steps to reproduce

## Related Pages

<CardGroup>
  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Initial setup guide
  </Card>

  <Card title="Auto Scan" icon="rotate" href="/github/auto-scan">
    Configure triggers
  </Card>

  <Card title="PR Comments" icon="comment" href="/github/pr-comments">
    Comment settings
  </Card>

  <Card title="Repositories" icon="code" href="/dashboard/repositories">
    Manage repos
  </Card>
</CardGroup>


# GitLab Integration
Source: https://docs.vidocsecurity.com/gitlab/coming-soon

GitLab integration is coming soon

<Info>
  GitLab integration is coming soon! We're working on bringing the same seamless experience you love with GitHub to GitLab.
</Info>

## Planned Features

When GitLab integration launches, you'll be able to:

* **Connect GitLab repositories** - Link your GitLab projects to Vidoc
* **Automatic MR scanning** - Scan merge requests automatically
* **MR comments** - Get security findings as MR comments
* **Auto-scan on push** - Trigger scans on default branch updates

## Current Alternatives

While we work on GitLab integration, you can still scan GitLab repositories:

### Using the CLI

1. Clone your GitLab repository locally
2. Install and authenticate the Vidoc CLI
3. Run scans from your local machine

```bash theme={null}
# Install CLI
npm i -g @vidocsecurity/cli

# Authenticate
vidoc login

# Scan
cd your-gitlab-repo
vidoc scan
```

### In GitLab CI/CD

Add Vidoc to your `.gitlab-ci.yml`:

```yaml theme={null}
security-scan:
  image: node:20
  stage: test
  script:
    - npm i -g @vidocsecurity/cli
    - vidoc scan --fail-on high
  variables:
    VIDOC_API_KEY: $VIDOC_API_KEY
```

See [CI/CD Integration](/cli/ci-cd) for detailed setup.

## Stay Updated

Want to be notified when GitLab integration launches?

1. Email us at [contact@vidocsecurity.com](mailto:contact@vidocsecurity.com)
2. Follow us on [Twitter](https://twitter.com/vidocsecurity)
3. Check our [blog](https://blog.vidocsecurity.com) for announcements

## Request Features

Have specific GitLab features you'd like to see? Let us know:

* Email: [contact@vidocsecurity.com](mailto:contact@vidocsecurity.com)
* Feature requests help us prioritize development

## Related Pages

<CardGroup>
  <Card title="GitHub Setup" icon="github" href="/github/setup">
    GitHub integration (available now)
  </Card>

  <Card title="CLI Installation" icon="terminal" href="/cli/installation">
    Scan any repo via CLI
  </Card>

  <Card title="CI/CD Integration" icon="gear" href="/cli/ci-cd">
    Add to GitLab CI
  </Card>

  <Card title="Bitbucket" icon="bitbucket" href="/bitbucket/coming-soon">
    Bitbucket integration status
  </Card>
</CardGroup>


# How It Works
Source: https://docs.vidocsecurity.com/how-it-works

AI-powered security scanning that finds real vulnerabilities

Vidoc uses AI to find real security vulnerabilities in your code while minimizing false positives.

## Context Engine

At the heart of Vidoc is our **Context Engine** - AI that deeply understands your codebase. Unlike traditional scanners that match patterns, Vidoc's Context Engine analyzes how your code actually works.

This means:

* **Fewer false positives** - Findings are validated against your actual code context
* **Finds complex issues** - Detects vulnerabilities that pattern matching misses
* **Understands your codebase** - Considers your frameworks, libraries, and coding patterns

## What Vidoc Detects

### Attack Vulnerabilities

Security threats that can be directly exploited:

* SQL Injection
* Cross-Site Scripting (XSS)
* Command Injection
* Server-Side Request Forgery (SSRF)
* Path Traversal
* And more...

See [Attack Vulnerabilities](/security/attack-vulnerabilities) for the full list.

### Compliance Issues

Security weaknesses and misconfigurations:

* Hardcoded Secrets
* Weak Cryptography
* Insecure Transport
* Information Disclosure
* Misconfigurations

See [Compliance Issues](/security/compliance-issues) for the full list.

## Learnings

Vidoc gets smarter as you use it. When you mark an issue as a false positive, Vidoc creates a learning that feeds back into the Context Engine.

* Provide a reason when ignoring issues
* Learnings apply to future scans automatically
* Your team's knowledge improves detection accuracy

See [Learnings](/dashboard/learnings) for more details.

## Security & Privacy

* Your code is encrypted in transit and at rest
* Code is processed securely and not stored permanently
* Scan results are retained according to your settings

## Related Pages

<CardGroup>
  <Card title="Security Categories" icon="shield" href="/security/overview">
    Full list of detected issues
  </Card>

  <Card title="Learnings" icon="brain" href="/dashboard/learnings">
    How learnings improve accuracy
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    Review scan results
  </Card>

  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Run your first scan
  </Card>
</CardGroup>


# Introduction
Source: https://docs.vidocsecurity.com/introduction

AI-powered code security that finds real vulnerabilities

## What is Vidoc?

Vidoc is a code security platform that uses AI to detect real security vulnerabilities in your source code. Unlike traditional static analysis tools that flood you with false positives, Vidoc validates each finding against your codebase context to surface only actionable issues.

## Key Capabilities

<CardGroup>
  <Card title="AI-Powered Detection" icon="brain">
    LLMs analyze your code to find vulnerabilities that pattern-based scanners miss
  </Card>

  <Card title="Context-Aware Validation" icon="check-circle">
    Each finding is validated against your codebase to reduce false positives
  </Card>

  <Card title="Learnings System" icon="graduation-cap">
    Teach Vidoc your codebase patterns to continuously improve accuracy
  </Card>

  <Card title="PR Integration" icon="code-pull-request">
    Get security feedback directly in your GitHub pull requests
  </Card>
</CardGroup>

## Who Uses Vidoc?

**AppSec Teams** use the Vidoc dashboard to:

* Configure security scanning for repositories
* Review and triage security findings
* Create learnings to reduce false positives
* Track security posture across projects

**Developers** interact with Vidoc through:

* GitHub PR comments with security feedback
* CLI for local scanning during development
* AI chat for understanding security issues

## How It Works

```mermaid theme={null}
flowchart LR
    A[Your Code] --> B[Vidoc Scan]
    B --> C[AI Detection]
    C --> D[Context Validation]
    D --> E[Real Issues]
    E --> F[PR Comments / Dashboard]
```

1. **Scan** - Vidoc analyzes your code via GitHub integration or CLI
2. **Detect** - AI identifies potential security vulnerabilities
3. **Validate** - Each finding is validated against codebase context
4. **Report** - Real issues surface in the dashboard and PR comments

## Security Categories

Vidoc detects two main types of security issues:

| Type                       | Description                               | Examples                                                 |
| -------------------------- | ----------------------------------------- | -------------------------------------------------------- |
| **Attack Vulnerabilities** | Issues that can be directly exploited     | XSS, SQL Injection, Command Injection, SSRF              |
| **Compliance Issues**      | Security weaknesses and misconfigurations | Hardcoded secrets, weak cryptography, insecure transport |

## Get Started

<CardGroup>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Run your first scan in 5 minutes
  </Card>

  <Card title="GitHub Setup" icon="github" href="/github/setup">
    Connect GitHub for automatic PR scanning
  </Card>

  <Card title="CLI Installation" icon="terminal" href="/cli/installation">
    Install the Vidoc CLI for local scanning
  </Card>

  <Card title="How It Works" icon="lightbulb" href="/how-it-works">
    Learn about Vidoc's AI-powered detection
  </Card>
</CardGroup>


# Quickstart
Source: https://docs.vidocsecurity.com/quickstart

Run your first security scan in 5 minutes

This guide walks you through setting up Vidoc and running your first security scan.

## Prerequisites

* A GitHub account with repositories to scan
* Node.js 18+ (for CLI scanning)

## Step 1: Create an Account

1. Go to [app.vidocsecurity.com](https://app.vidocsecurity.com)
2. Sign in with your GitHub account
3. You'll be redirected to your dashboard

## Step 2: Create a Project

Projects group related repositories together. To create your first project:

1. Click **"New Project"** in the dashboard
2. Enter a project name (e.g., "My App")
3. Click **"Create"**

## Step 3: Connect GitHub

Connect your GitHub account to enable automatic scanning:

1. Go to **Settings** → **Integrations**
2. Click **"Connect GitHub"**
3. Authorize Vidoc to access your repositories
4. Select which repositories to scan

<Info>
  See [GitHub Setup](/github/setup) for detailed configuration options.
</Info>

## Step 4: Add a Repository

1. Click **"Add Repository"** in your project
2. Select a repository from the list
3. Choose the default branch to scan

## Step 5: Run Your First Scan

### Option A: GitHub Integration (Recommended)

Once connected, Vidoc automatically scans:

* New pull requests
* Pushes to the default branch

Create a pull request to trigger your first scan.

### Option B: CLI Scan

Install and run the CLI for immediate results:

```bash theme={null}
# Install the CLI
npm i -g @vidocsecurity/cli

# Login with your API key
vidoc login

# Scan your code
vidoc scan
```

<Tip>
  Get your API key from **Settings** → **API Keys** in the dashboard.
</Tip>

## Step 6: Review Results

After the scan completes:

1. Go to **Issues** in your project
2. Review the security findings
3. Click on an issue to see details:
   * Vulnerability description
   * Affected code snippet
   * Remediation guidance

### Handling False Positives

If an issue is a false positive:

1. Click **"Ignore"** on the issue
2. Provide a reason (e.g., "Input is already sanitized")
3. Vidoc creates a learning to avoid similar false positives

## Next Steps

<CardGroup>
  <Card title="Dashboard Overview" icon="chart-line" href="/dashboard/overview">
    Learn to navigate the Vidoc dashboard
  </Card>

  <Card title="GitHub PR Comments" icon="comment" href="/github/pr-comments">
    Configure PR feedback settings
  </Card>

  <Card title="CLI Scanning" icon="terminal" href="/cli/scanning">
    Advanced CLI scanning options
  </Card>

  <Card title="Learnings" icon="brain" href="/dashboard/learnings">
    Teach Vidoc your codebase patterns
  </Card>
</CardGroup>


# Attack Vulnerabilities
Source: https://docs.vidocsecurity.com/security/attack-vulnerabilities

Security vulnerabilities that can be directly exploited

Attack vulnerabilities are code patterns that allow malicious actors to perform unauthorized actions. These represent direct security threats.

## Injection Attacks

### SQL Injection (sqli)

**Severity:** Critical

User input incorporated into SQL queries without proper sanitization.

```javascript theme={null}
// Vulnerable
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Fixed
const query = `SELECT * FROM users WHERE id = ?`;
db.query(query, [userId]);
```

**Impact:** Database theft, modification, or deletion.

***

### NoSQL Injection (nosql-injection)

**Severity:** Critical

User input in NoSQL database queries.

```javascript theme={null}
// Vulnerable
db.users.find({ user: req.body.user, pass: req.body.pass });

// Fixed - validate input types
const user = String(req.body.user);
const pass = String(req.body.pass);
```

**Impact:** Authentication bypass, data theft.

***

### Command Injection (command-injection)

**Severity:** Critical

User input passed to system commands.

```javascript theme={null}
// Vulnerable
exec(`ping ${userInput}`);

// Fixed - use parameterized APIs
execFile('ping', ['-c', '4', userInput]);
```

**Impact:** Full system compromise.

***

### Code Evaluation (code-evaluation)

**Severity:** Critical

Dynamic code execution with user input.

```javascript theme={null}
// Vulnerable
eval(userInput);
new Function(userInput)();

// Fixed - avoid eval entirely
JSON.parse(userInput); // for JSON data
```

**Impact:** Arbitrary code execution.

***

### Server-Side Template Injection (ssti)

**Severity:** Critical

User input in server-side templates.

```python theme={null}
# Vulnerable
template.render("Hello " + user_input)

# Fixed
template.render("Hello {{ name }}", name=user_input)
```

**Impact:** Remote code execution.

## Cross-Site Scripting (XSS)

**Severity:** High

User input rendered in HTML without proper encoding.

```javascript theme={null}
// Vulnerable
element.innerHTML = userInput;

// Fixed
element.textContent = userInput;
// Or use proper sanitization
element.innerHTML = DOMPurify.sanitize(userInput);
```

**Impact:** Session hijacking, phishing, malware distribution.

## Request Forgery

### Server-Side Request Forgery (ssrf)

**Severity:** High

Server makes requests to URLs controlled by user input.

```javascript theme={null}
// Vulnerable
fetch(userProvidedUrl);

// Fixed - validate against allowlist
const allowed = ['api.example.com'];
const url = new URL(userProvidedUrl);
if (!allowed.includes(url.hostname)) throw new Error('Invalid URL');
```

**Impact:** Internal network access, cloud metadata exposure.

***

### Cross-Site Request Forgery (csrf)

**Severity:** Medium

State-changing requests without CSRF protection.

```javascript theme={null}
// Vulnerable - no CSRF token
app.post('/transfer', (req, res) => { /* ... */ });

// Fixed - verify CSRF token
app.post('/transfer', csrfProtection, (req, res) => { /* ... */ });
```

**Impact:** Unauthorized actions on behalf of users.

## Access Control

### Insecure Direct Object Reference (idor)

**Severity:** High

Access to resources without proper authorization checks.

```javascript theme={null}
// Vulnerable
app.get('/document/:id', (req, res) => {
  return db.documents.findById(req.params.id);
});

// Fixed
app.get('/document/:id', (req, res) => {
  const doc = db.documents.findById(req.params.id);
  if (doc.userId !== req.user.id) return res.status(403);
  return doc;
});
```

**Impact:** Unauthorized data access.

***

### Broken Access Control (broken-access-control)

**Severity:** High

Missing or improper access control checks.

**Impact:** Privilege escalation, unauthorized actions.

***

### Broken Authentication (broken-authentication)

**Severity:** High

Flawed authentication implementation.

**Impact:** Account takeover, unauthorized access.

## File System

### Path Traversal (path-traversal)

**Severity:** High

User input in file paths allowing access outside intended directory.

```javascript theme={null}
// Vulnerable
const file = path.join('/uploads', userInput);

// Fixed
const file = path.join('/uploads', path.basename(userInput));
```

**Impact:** Arbitrary file read/write.

***

### Unrestricted File Upload (unrestricted-file-upload)

**Severity:** High

File uploads without proper validation.

**Impact:** Remote code execution, malware hosting.

## Other Attack Vectors

### Remote Code Execution (rce)

**Severity:** Critical

Any method allowing arbitrary code execution.

**Impact:** Full system compromise.

***

### XML External Entity (xxe)

**Severity:** High

XML parsing with external entity processing enabled.

```javascript theme={null}
// Vulnerable
xmlParser.parse(userXml);

// Fixed - disable external entities
xmlParser.parse(userXml, { noent: false, dtdload: false });
```

**Impact:** File disclosure, SSRF, denial of service.

***

### Open Redirect (open-redirect)

**Severity:** Medium

Redirects to URLs controlled by user input.

```javascript theme={null}
// Vulnerable
res.redirect(req.query.next);

// Fixed
const allowedHosts = ['example.com'];
const url = new URL(req.query.next, 'https://example.com');
if (!allowedHosts.includes(url.hostname)) throw new Error('Invalid redirect');
```

**Impact:** Phishing, credential theft.

***

### Prototype Pollution (prototype-pollution)

**Severity:** High

Modification of JavaScript object prototypes via user input.

**Impact:** Denial of service, potential RCE.

***

### Insecure Deserialization (insecure-deserialization)

**Severity:** Critical

Deserializing untrusted data without validation.

**Impact:** Remote code execution.

***

### Header Injection (header-injection)

**Severity:** Medium

User input in HTTP headers.

**Impact:** Response splitting, cache poisoning.

***

### Log Injection (log-injection)

**Severity:** Low

User input in log messages without sanitization.

**Impact:** Log forging, log analysis bypass.

***

### Session Fixation (session-fixation)

**Severity:** Medium

Session ID can be set by attacker.

**Impact:** Session hijacking.

***

### Race Condition (race-condition)

**Severity:** Medium

Time-of-check to time-of-use vulnerabilities.

**Impact:** Security bypass, data corruption.

***

### Denial of Service (dos)

**Severity:** Medium

Code patterns that can cause service unavailability.

**Impact:** Service disruption.

***

### Regex Injection (regex-injection)

**Severity:** Medium

User input in regular expressions (ReDoS risk).

**Impact:** Denial of service.

***

### PostMessage Misuse (postmessage-misuse)

**Severity:** Medium

Improper handling of cross-origin messages.

**Impact:** Cross-origin attacks.

## Related Pages

<CardGroup>
  <Card title="Compliance Issues" icon="clipboard-check" href="/security/compliance-issues">
    Security weaknesses
  </Card>

  <Card title="Security Overview" icon="shield" href="/security/overview">
    All security categories
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View your findings
  </Card>

  <Card title="How It Works" icon="lightbulb" href="/how-it-works">
    Detection explained
  </Card>
</CardGroup>


# Compliance Issues
Source: https://docs.vidocsecurity.com/security/compliance-issues

Security weaknesses and misconfigurations detected by Vidoc

Compliance issues are security weaknesses that may not be directly exploitable but weaken your security posture and violate security best practices.

## Secrets & Credentials

### Hardcoded Secrets (hardcoded-secrets)

**Severity:** High

Credentials, API keys, or tokens embedded in source code.

```javascript theme={null}
// Vulnerable
const apiKey = "sk-1234567890abcdef";
const dbPassword = "supersecret123";

// Fixed - use environment variables
const apiKey = process.env.API_KEY;
const dbPassword = process.env.DB_PASSWORD;
```

**Risk:** Credential exposure if code is leaked or shared.

**Detection:** Vidoc identifies patterns matching:

* API keys (AWS, GCP, Stripe, etc.)
* Database credentials
* JWT secrets
* OAuth tokens
* Private keys

## Cryptography

### Weak Cryptography (weak-cryptography)

**Severity:** Medium

Use of deprecated or weak cryptographic algorithms.

```javascript theme={null}
// Vulnerable
crypto.createHash('md5').update(data).digest();
crypto.createCipheriv('des', key, iv);

// Fixed
crypto.createHash('sha256').update(data).digest();
crypto.createCipheriv('aes-256-gcm', key, iv);
```

**Weak algorithms:**

* MD5, SHA1 (for security purposes)
* DES, 3DES, RC4
* RSA keys \< 2048 bits
* ECDSA keys \< 256 bits

***

### Weak Randomness (weak-randomness)

**Severity:** Medium

Using non-cryptographic random number generators for security purposes.

```javascript theme={null}
// Vulnerable
const token = Math.random().toString(36);

// Fixed
const token = crypto.randomBytes(32).toString('hex');
```

**Risk:** Predictable values can be guessed by attackers.

## Transport Security

### Insecure Transport (insecure-transport)

**Severity:** Medium

Data transmitted without encryption.

```javascript theme={null}
// Vulnerable
const url = 'http://api.example.com/data';

// Fixed
const url = 'https://api.example.com/data';
```

**Issues detected:**

* HTTP URLs for sensitive data
* Disabled SSL/TLS verification
* Weak TLS versions (TLS 1.0, 1.1)
* Missing HSTS headers

## Information Disclosure

### Information Disclosure (information-disclosure)

**Severity:** Medium

Code that may expose sensitive information.

```javascript theme={null}
// Vulnerable - detailed error messages
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack });
});

// Fixed
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({ error: 'Internal server error' });
});
```

**Types:**

* Stack traces in responses
* Debug information in production
* Verbose error messages
* Internal paths exposed
* Version information disclosure

## Configuration

### Misconfiguration (misconfiguration)

**Severity:** Varies

Insecure default settings or missing security configurations.

**Examples:**

* Debug mode in production
* Default credentials
* Excessive permissions
* Missing security headers
* Disabled security features

```javascript theme={null}
// Vulnerable
app.use(cors()); // Allows all origins

// Fixed
app.use(cors({
  origin: ['https://example.com'],
  credentials: true
}));
```

***

### Excessive Privileges (excessive-privileges)

**Severity:** Medium

Code running with more permissions than necessary.

**Examples:**

* Running as root/admin unnecessarily
* Overly broad IAM policies
* File permissions too permissive

## Supply Chain

### Supply Chain Risk (supply-chain-risk)

**Severity:** Varies

Risks from third-party dependencies.

**Detection includes:**

* Known vulnerable packages
* Typosquatting package names
* Packages with known malicious versions
* Outdated dependencies with security patches

**Mitigation:**

* Keep dependencies updated
* Use lockfiles
* Review new dependencies
* Use security scanning for packages

## Timing & Side Channels

### Timing Side Channel (timing-side-channel)

**Severity:** Low

Code vulnerable to timing attacks.

```javascript theme={null}
// Vulnerable - timing attack on password comparison
if (password === storedPassword) { /* ... */ }

// Fixed - constant-time comparison
crypto.timingSafeEqual(
  Buffer.from(password),
  Buffer.from(storedPassword)
);
```

**Risk:** Attackers can deduce secrets by measuring response times.

## Memory Safety

### Memory Safety (memory-safety)

**Severity:** High

Memory-related vulnerabilities in languages like C/C++.

**Types:**

* Buffer overflows
* Use-after-free
* Double-free
* Memory leaks with sensitive data

## Summary Table

| Category               | Typical Severity | Key Risk                 |
| ---------------------- | ---------------- | ------------------------ |
| Hardcoded Secrets      | High             | Credential exposure      |
| Weak Cryptography      | Medium           | Broken encryption        |
| Weak Randomness        | Medium           | Predictable values       |
| Insecure Transport     | Medium           | Data interception        |
| Information Disclosure | Medium           | Data leakage             |
| Misconfiguration       | Varies           | Security bypass          |
| Supply Chain Risk      | Varies           | Compromised dependencies |
| Timing Side Channel    | Low              | Secret disclosure        |

## Related Pages

<CardGroup>
  <Card title="Attack Vulnerabilities" icon="skull" href="/security/attack-vulnerabilities">
    Exploitable threats
  </Card>

  <Card title="Security Overview" icon="shield" href="/security/overview">
    All categories
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View findings
  </Card>

  <Card title="How It Works" icon="lightbulb" href="/how-it-works">
    Detection explained
  </Card>
</CardGroup>


# Security Categories
Source: https://docs.vidocsecurity.com/security/overview

Overview of vulnerability categories detected by Vidoc

Vidoc detects security vulnerabilities across two main categories: Attack Vulnerabilities and Compliance Issues.

## Category Types

### Attack Vulnerabilities

Direct security threats that can be actively exploited by attackers. These represent code that allows unauthorized actions when malicious input is provided.

**Examples:** SQL Injection, XSS, Command Injection, SSRF

[View all Attack Vulnerabilities →](/security/attack-vulnerabilities)

### Compliance Issues

Security weaknesses, misconfigurations, and violations of security best practices. These may not be directly exploitable but weaken your security posture.

**Examples:** Hardcoded Secrets, Weak Cryptography, Insecure Transport

[View all Compliance Issues →](/security/compliance-issues)

## Severity Levels

Each issue is assigned a severity based on potential impact and exploitability:

| Severity        | Description                                  | Response            |
| --------------- | -------------------------------------------- | ------------------- |
| **Critical**    | Immediately exploitable, high impact         | Fix immediately     |
| **High**        | Easily exploitable, significant impact       | Fix soon            |
| **Medium**      | Exploitable with conditions, moderate impact | Plan to fix         |
| **Low**         | Difficult to exploit, limited impact         | Fix when convenient |
| **Informative** | Best practice suggestion                     | Consider improving  |

## Attack Vulnerabilities Summary

| Category              | Description                    | Typical Severity |
| --------------------- | ------------------------------ | ---------------- |
| **SQL Injection**     | User input in SQL queries      | Critical         |
| **XSS**               | Unsanitized output to browsers | High             |
| **Command Injection** | User input in system commands  | Critical         |
| **RCE**               | Remote code execution          | Critical         |
| **SSRF**              | Server-side request forgery    | High             |
| **Path Traversal**    | File access with user input    | High             |
| **IDOR**              | Direct object reference        | High             |
| **CSRF**              | Cross-site request forgery     | Medium           |
| **XXE**               | XML external entity injection  | High             |
| **Open Redirect**     | Redirect to untrusted URLs     | Medium           |

[Full list with details →](/security/attack-vulnerabilities)

## Compliance Issues Summary

| Category                   | Description                | Typical Severity |
| -------------------------- | -------------------------- | ---------------- |
| **Hardcoded Secrets**      | Credentials in source code | High             |
| **Weak Cryptography**      | Insecure algorithms        | Medium           |
| **Weak Randomness**        | Predictable random values  | Medium           |
| **Insecure Transport**     | Missing HTTPS/TLS          | Medium           |
| **Information Disclosure** | Sensitive data exposure    | Medium           |
| **Misconfiguration**       | Insecure settings          | Varies           |
| **Supply Chain Risk**      | Vulnerable dependencies    | Varies           |

[Full list with details →](/security/compliance-issues)

## Detection Confidence

Vidoc uses AI to validate findings, resulting in confidence levels:

| Confidence    | Meaning                                |
| ------------- | -------------------------------------- |
| **Confirmed** | AI validated the vulnerability exists  |
| **Likely**    | Strong indicators, needs manual review |
| **Possible**  | Potential issue, investigate further   |

## How Categories Are Assigned

```mermaid theme={null}
flowchart TB
    A[Issue Detected] --> B{Data Flow?}
    B -->|User Input| C[Attack Vulnerability]
    B -->|No User Input| D{Security Weakness?}
    D -->|Yes| E[Compliance Issue]
    D -->|No| F[Not Reported]
    C --> G[Severity Assessment]
    E --> G
```

## Related Pages

<CardGroup>
  <Card title="Attack Vulnerabilities" icon="skull" href="/security/attack-vulnerabilities">
    Exploitable security threats
  </Card>

  <Card title="Compliance Issues" icon="clipboard-check" href="/security/compliance-issues">
    Security weaknesses
  </Card>

  <Card title="Issues" icon="bug" href="/dashboard/issues">
    View findings in dashboard
  </Card>

  <Card title="How It Works" icon="lightbulb" href="/how-it-works">
    AI detection explained
  </Card>
</CardGroup>


# API Keys
Source: https://docs.vidocsecurity.com/settings/api-keys

Create and manage API keys for CLI and CI/CD integration

API keys authenticate the Vidoc CLI and API requests. Each key is scoped to a specific project.

## Creating an API Key

1. Go to your project
2. Navigate to **Settings** → **API Keys**
3. Click **"Create API Key"**
4. Enter a name (e.g., "CI/CD Pipeline", "Local Development")
5. Click **"Create"**
6. Copy the key immediately

<Warning>
  The API key is only shown once. Store it securely before closing the dialog.
</Warning>

## API Key Properties

| Property        | Description                           |
| --------------- | ------------------------------------- |
| **Name**        | Descriptive label for identification  |
| **Project**     | The project this key authenticates to |
| **Created**     | When the key was created              |
| **Last Used**   | Most recent API call with this key    |
| **Permissions** | All keys have full project access     |

## Using API Keys

### CLI Authentication

```bash theme={null}
# Interactive login
vidoc login
# Enter your API key when prompted

# Direct login
vidoc login your-api-key

# Environment variable (recommended for CI/CD)
export VIDOC_API_KEY=your-api-key
vidoc scan
```

### API Authentication

Include the key in the `Authorization` header:

```bash theme={null}
curl -H "Authorization: Bearer your-api-key" \
  https://api.vidocsecurity.com/v1/scan-workflows/start
```

## Managing API Keys

### View Keys

1. Go to **Settings** → **API Keys**
2. See all keys for the project
3. Check last used timestamps

### Revoke a Key

1. Find the key in the list
2. Click **"Revoke"**
3. Confirm revocation

<Warning>
  Revoking a key immediately invalidates it. CI/CD pipelines using the key will fail.
</Warning>

### Rotate Keys

To rotate a key:

1. Create a new key
2. Update your CI/CD pipelines with the new key
3. Verify scans work with the new key
4. Revoke the old key

## Best Practices

### Use Descriptive Names

Name keys by their purpose:

* `github-actions-prod`
* `gitlab-ci-staging`
* `local-dev-alice`

### One Key Per Purpose

Create separate keys for:

* Each CI/CD pipeline
* Each developer (for local development)
* Each environment

This allows granular revocation if a key is compromised.

### Secure Storage

| Environment        | Storage Method                        |
| ------------------ | ------------------------------------- |
| **GitHub Actions** | Repository Secrets                    |
| **GitLab CI**      | CI/CD Variables (masked)              |
| **Local**          | Environment variable or `vidoc login` |
| **Jenkins**        | Credentials plugin                    |

### Regular Rotation

Rotate keys periodically:

* Every 90 days for production
* After team member departure
* After any suspected compromise

## Permissions

All API keys have full access to their project:

* Start scans
* View issues
* Access scan results

Project-level permissions are managed through [Team Members](/settings/team-members).

## Rate Limits

API calls are rate-limited per project:

| Operation   | Limit          |
| ----------- | -------------- |
| Start scan  | 10 per minute  |
| Get status  | 100 per minute |
| List issues | 100 per minute |

Contact support if you need higher limits.

## Troubleshooting

### "Invalid API key"

1. Verify the key was copied correctly
2. Check for extra whitespace
3. Ensure the key hasn't been revoked
4. Verify you're using the right project's key

### "API key expired"

API keys don't expire automatically. If you see this error:

1. The key may have been revoked
2. Create a new key

### "Rate limit exceeded"

1. Reduce scan frequency
2. Check for duplicate CI/CD triggers
3. Contact support for limit increase

## Related Pages

<CardGroup>
  <Card title="CLI Authentication" icon="key" href="/cli/authentication">
    CLI login methods
  </Card>

  <Card title="CI/CD Integration" icon="gear" href="/cli/ci-cd">
    Pipeline setup
  </Card>

  <Card title="Team Members" icon="users" href="/settings/team-members">
    Manage access
  </Card>

  <Card title="API Reference" icon="code" href="/api/authentication">
    API documentation
  </Card>
</CardGroup>


# Team Members
Source: https://docs.vidocsecurity.com/settings/team-members

Invite team members and manage access to your project

Manage who has access to your Vidoc project and what they can do.

## Inviting Members

1. Go to **Settings** → **Team**
2. Click **"Invite Member"**
3. Enter their email address
4. Select a role
5. Click **"Send Invite"**

The invited user receives an email with instructions to join.

## Roles

| Role       | Permissions                            |
| ---------- | -------------------------------------- |
| **Owner**  | Full access, can delete project        |
| **Admin**  | Manage settings, members, integrations |
| **Member** | View/manage issues, run scans          |
| **Viewer** | Read-only access to issues             |

### Permission Details

| Action              | Owner | Admin | Member | Viewer |
| ------------------- | ----- | ----- | ------ | ------ |
| View issues         | ✅     | ✅     | ✅      | ✅      |
| Run scans           | ✅     | ✅     | ✅      | ❌      |
| Ignore issues       | ✅     | ✅     | ✅      | ❌      |
| Manage learnings    | ✅     | ✅     | ✅      | ❌      |
| Create API keys     | ✅     | ✅     | ❌      | ❌      |
| Manage integrations | ✅     | ✅     | ❌      | ❌      |
| Invite members      | ✅     | ✅     | ❌      | ❌      |
| Change roles        | ✅     | ✅     | ❌      | ❌      |
| Delete project      | ✅     | ❌     | ❌      | ❌      |

## Managing Members

### View Team

1. Go to **Settings** → **Team**
2. See all members and their roles
3. Check pending invitations

### Change Role

1. Find the member in the list
2. Click the role dropdown
3. Select new role
4. Confirm change

### Remove Member

1. Find the member in the list
2. Click **"Remove"**
3. Confirm removal

<Warning>
  Removed members immediately lose access. Any API keys they created remain active until revoked.
</Warning>

## Pending Invitations

### Resend Invite

1. Find the pending invitation
2. Click **"Resend"**
3. New email is sent

### Cancel Invite

1. Find the pending invitation
2. Click **"Cancel"**
3. Invitation is invalidated

## Single Sign-On (SSO)

<Info>
  SSO is available on Enterprise plans. Contact support to configure.
</Info>

Enterprise organizations can use:

* SAML 2.0
* Google Workspace
* Okta
* Azure AD

## Best Practices

### Use Appropriate Roles

* **Viewer** for stakeholders who only need to see issues
* **Member** for developers who need to run scans
* **Admin** for security team leads

### Regular Audits

1. Review team members quarterly
2. Remove inactive users
3. Verify roles are appropriate

### Offboarding

When a team member leaves:

1. Remove them from the project
2. Revoke any API keys they created
3. Review recent activity for their account

## Multiple Projects

Each project has its own team:

* Members must be invited to each project
* Roles are project-specific
* A user can be Admin in one project and Viewer in another

## Related Pages

<CardGroup>
  <Card title="Projects" icon="folder" href="/dashboard/projects">
    Manage projects
  </Card>

  <Card title="API Keys" icon="key" href="/settings/api-keys">
    Manage API keys
  </Card>

  <Card title="Dashboard Overview" icon="chart-line" href="/dashboard/overview">
    Navigate dashboard
  </Card>
</CardGroup>