Quickstart
Index a repository, look around, and scan it for vulnerabilities.
This assumes the binaries are installed and your license is activated (inkdex license status shows it).
Index the repository
cd my-project
inkdex init # creates .inkdex/ and adds it to .gitignore
inkdex index # reads the code, resolves calls, records security factsIn a terminal you see each phase and how long it took. The next inkdex index only reads what changed.
Scan it
inkdex-vuln scanCRITICAL VULN-SQLI SQL injection (CWE-89, proven)
app/db.py:21 in app.db.find_user
GET /users (app/routes.py:12) reaches cursor.execute unsanitized
HIGH VULN-PATH Path traversal (CWE-22, proven)
app/files.py:9 in app.files.read_upload
POST /upload (app/routes.py:30) reaches open unsanitized
2 findings: 1 critical, 1 highinkdex-vuln scan . --update does both steps at once: it indexes (or updates the index), then scans.
Look around
inkdex routes # every entry point: HTTP routes, CLI commands, jobs
inkdex routes --unauthenticated # the ones with no authentication found
inkdex sec flows --unsanitized --trace # data flows from sources to sinks, step by step
inkdex callers app.db.find_user # who calls a function
inkdex search '*password*' --kind fn # find symbols by nameKeep the result
inkdex-vuln scan --format sarif -o inkdex.sarif # for GitHub code scanning and other SARIF tools
inkdex-vuln scan --json > findings.json # for your own scriptsTo look closer at one finding, or set aside one you reviewed:
inkdex-vuln finding <fingerprint> # why it is there, with the code of each step
inkdex-vuln ignore <fingerprint> -r "why" # kept in .inkdex-vuln.tomlNext
- Scanning: every option of
scan, how to read a finding. - CI/CD: run it on every push and fail the build on what matters.
- Exploring the index: what you can ask the index.