From aaae1a76efa7b2183020abc493354ba5c4abd826 Mon Sep 17 00:00:00 2001
From: mohammad junayd <111487869+m-jay21@users.noreply.github.com>
Date: Mon, 14 Sep 2026 18:14:51 +0400
Subject: [PATCH] docs(install): put STRIX_INSTALL_SKIP_VERIFY on bash, not
 curl

Env vars before curl do not reach the piped bash process, so the
documented override never skipped verification (#1267).
---
 docs/quickstart.mdx | 2 +-
 scripts/install.sh  | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/quickstart.mdx b/docs/quickstart.mdx
index b0349dd3..e5c834b8 100644
--- a/docs/quickstart.mdx
+++ b/docs/quickstart.mdx
@@ -20,7 +20,7 @@ description: "Install Strix and run your first security scan"
     Sigstore provenance before extracting. To skip those checks (not recommended):
 
     ```bash
-    STRIX_INSTALL_SKIP_VERIFY=1 curl -sSL https://strix.ai/install | bash
+    curl -sSL https://strix.ai/install | STRIX_INSTALL_SKIP_VERIFY=1 bash
     ```
   </Tab>
   <Tab title="pipx">
diff --git a/scripts/install.sh b/scripts/install.sh
index 1c3dc73b..c6f98e5e 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -143,7 +143,8 @@ abort_unverified() {
     if [[ -x "$INSTALL_DIR/strix" || -x "$INSTALL_DIR/strix.exe" ]]; then
         echo -e "${MUTED}Existing Strix installation left unchanged.${NC}"
     fi
-    echo -e "${RED}Re-run with STRIX_INSTALL_SKIP_VERIFY=1 to override (at your own risk).${NC}"
+    echo -e "${RED}Re-run with: curl -sSL https://strix.ai/install | STRIX_INSTALL_SKIP_VERIFY=1 bash${NC}"
+    echo -e "${MUTED}(at your own risk)${NC}"
     exit 1
 }