SecHound is a local-first CLI that scans the web app on localhost and the source next to it. Findings include the file and line to fix, not just a vulnerability name.

Does SecHound upload my source code?

Normal scans run locally and upload only redacted finding context. The optional Secure Coding Assistant sends only the source files shown for approval, after excluding sensitive files and redacting likely credentials.

How do I scan a localhost app?

Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.

What does a scan cover?

One command checks secrets, known-vulnerable npm packages, injection and XSS in source, leftover debug and empty catch blocks, N+1 queries, and localhost security headers.

Is there a free plan?

Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.

SecHound

Security scans for the app on localhost

SecHound is a CLI that reads your source, probes your dev server, and points you to the exact line to fix — before anything is public.

npx sechound

sechound.com

Overview

Welcome back, Alex

Manage scans from your local projects.

AI credit balance · Pro

142credits

View ledger →

API keys

Scans

Findings

Recent scans

View all

api-gateway
headers · localhost:4000
2 findings
marketing
secrets · localhost:3001
0 findings

Scan

checkout

localhost:3000 · completed · 1 high · 2 medium · 1 low

SQL injection

High

POST /api/orders/search · param q · app/api/orders/route.ts:47

~/checkout

CLI on localhost → findings on your dashboard

The report doesn't stop at the vulnerability name

SecHound correlates the HTTP finding with the source line that caused it, then explains the fix like a teammate would — not like a CVE feed.

sechound report · finding #2HIGH

SQL injection

POST /api/orders/search · param q

app/api/orders/route.ts

46 const q = await req.json()

47 db.query(`SELECT * FROM orders WHERE name LIKE '%${q}%'`)

48 return Response.json(rows)

Remediation

Bind q as a parameter. String interpolation into SQL is the sink — not the route itself.

Install once. Scan the app that's already running.

No agents to deploy. No tunnel. No staging URL required to start. Command details live in the CLI docs.

# 1 — get the CLI
$ npx sechound

# 2 — sign in (browser or API key)
$ sechound login
   Browser on sechound.com · or paste sechound_live_…

# 3 — scan localhost + source
$ sechound scan
   Next.js detected · http://localhost:3000
   4 findings synced to your dashboard

$ sechound report

One command. The whole review.

Security, quality, and performance in a single pass. No flags to pick.

$ sechound scan

  secrets         keys, tokens, committed .env
  dependencies   known-vulnerable npm packages
  code            injection, XSS, eval, weak JWT
  quality         empty catch, leftover debug, fragile patterns
  performance    N+1 queries, unbounded reads, sync I/O
  headers         localhost CSP / CORS if the app is up

localhost:3000 → disk → (optional) sanitized explain

Normal scans keep your source tree and secrets on your machine.

SecHound runs against the process you already have open. AI explanations receive redacted finding context. The optional coding assistant asks before sending selected, redacted source files and never includes env or credential files.

No public deploy required to start a scan.

For developers who would rather fix the bug than configure a scanner

If you're shipping a Next.js or Node app on localhost and don't want to stand up Burp, open a tunnel, or wait for a staging deploy just to see what's wrong — SecHound is for you.

Solo builders use it before a push. Small teams use it to catch auth and API mistakes early. It's opinionated on purpose: fewer knobs, clearer findings.

Pricing

Simple plans. Credits for AI.

Scanning stays local. Credits cover AI explanations. Free includes 10 credits/month; Pro is $20 for 150; Team is $40 for 375.

Free

$0forever

Try the CLI on a personal project.

✓Local scans (`sechound scan`)
✓10 AI credits / month
✓1 API key
✓7-day scan history

Pro

Popular

$20/month

For developers who scan every branch.

✓Local scans (`sechound scan`)
✓150 AI credits / month
✓5 API keys
✓90-day scan history

Team

$40/month

More credits, keys, and longer history.

✓Everything in Pro
✓375 AI credits / month
✓20 API keys
✓1-year scan history

Payments are processed by Paddle, our Merchant of Record. You have 30 days from purchase or renewal to request a full refund. See the Refund Policy.

Questions before you scan

What is SecHound?: SecHound is a local-first CLI that scans the web app on localhost and the source next to it. Findings include the file and line to fix, not just a vulnerability name.
Does SecHound upload my source code?: Normal scans run locally and upload only redacted finding context. The optional Secure Coding Assistant sends only the source files shown for approval, after excluding sensitive files and redacting likely credentials.
How do I scan a localhost app?: Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.
What does a scan cover?: One command checks secrets, known-vulnerable npm packages, injection and XSS in source, leftover debug and empty catch blocks, N+1 queries, and localhost security headers.
Is there a free plan?: Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.

Run a scan before your next deploy

npx sechound