SecHound is a local-first CLI that scans the web app on localhost and the source next to it. Findings include the file and line to fix, not just a vulnerability name.

Does SecHound upload my source code?

Normal scans run locally and upload only redacted finding context. The optional Secure Coding Assistant sends only the source files shown for approval, after excluding sensitive files and redacting likely credentials.

How do I scan a localhost app?

Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.

What does a scan cover?

One command checks secrets, known-vulnerable npm packages, injection and XSS in source, leftover debug and empty catch blocks, N+1 queries, and localhost security headers.

Is there a free plan?

Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.

Docs

Scan the app on localhost. Fix the line it points to.

SecHound is a CLI for Next.js and Node apps. It reads source, probes the local server, and syncs a report to your dashboard — without uploading the repo during a normal scan.

Install

Use npx for a one-off run, or install the CLI globally if you scan often.

# one-off
$ npx sechound

# global
$ npm install -g sechound
$ sechound scan

Sign in

The CLI needs an account so reports can sync to the dashboard. Sign in with Google in the browser, or paste an API key from sechound.com/api-keys.

$ sechound login
   Browser on sechound.com · or paste sechound_live_…

$ sechound login --key
$ sechound logout

Scan a local app

Run the scan from the project root. SecHound detects Next.js, Express, Fastify, Vue, React, Nuxt, or Node.js from package.json, then probes localhost ports 3000, 3001, 5173, 8080, 5000, and 4000 if a server is already up.

$ sechound scan
   Next.js detected · http://localhost:3000
   4 findings synced to your dashboard

What a scan covers

One command. No flags to pick. Security, quality, and performance in a single pass.

secrets: API keys, tokens, and committed .env files
dependencies: Known-vulnerable packages in package-lock
code: SQL/command injection, XSS, eval, weak JWT handling
quality: Empty catch blocks, leftover debug, fragile patterns
performance: N+1 queries, unbounded reads, sync I/O
headers: CSP, CORS, and related headers if localhost is up

Reports and the dashboard

Each finding includes severity, rule, file, line, and a remediation note. After a scan, open the dashboard or print the last report in the terminal.

$ sechound report

Local-first privacy

Normal scans keep the source tree on your machine. Synced reports store finding metadata — rule IDs, paths, line numbers, severity, and redacted evidence. The optional Secure Coding Assistant lists the relevant source files it selected and asks before sending redacted snippets. Environment files and credential files are excluded.

Plans and AI credits

Local scans are included on every plan. Credits are spent when you explain a finding or apply an AI fix, and stronger models spend more. See pricing for Free (10 credits/month), Pro ($20 / 150), and Team ($40 / 375).

CI

Set SECHOUND_API_KEY in the environment instead of running sechound login. The CLI never writes that key to disk. Point it at another API host with SECHOUND_API_URL when you need to.

Command reference

Command	What it does
sechound	Interactive session
sechound scan	Scan the current folder and sync the report
sechound code	Propose secure, approved AI code changes
sechound code "..."	Start with a specific coding request
sechound report	Print the last report from your account
sechound login	Sign in with the browser or an API key
sechound login --key	Paste a sechound_live_ key
sechound logout	End this machine’s CLI session

FAQ

What is SecHound?: SecHound is a local-first CLI that scans the web app on localhost and the source next to it. Findings include the file and line to fix, not just a vulnerability name.
Does SecHound upload my source code?: Normal scans run locally and upload only redacted finding context. The optional Secure Coding Assistant sends only the source files shown for approval, after excluding sensitive files and redacting likely credentials.
How do I scan a localhost app?: Run npx sechound, sign in with Google or an API key, then sechound scan in the project folder. The CLI detects the framework and probes common local ports.
What does a scan cover?: One command checks secrets, known-vulnerable npm packages, injection and XSS in source, leftover debug and empty catch blocks, N+1 queries, and localhost security headers.
Is there a free plan?: Yes. Local scans are free. The Free plan includes 10 AI credits per month. Pro is $20/month for 150 credits; Team is $40/month for 375.