mirror of
https://github.com/usestrix/strix.git
synced 2026-09-15 23:31:27 +00:00
59 lines
2.8 KiB
Text
59 lines
2.8 KiB
Text
---
|
|
title: "Introduction"
|
|
description: "Managed security testing without local setup"
|
|
---
|
|
|
|
Skip the setup. Run Strix in the cloud at [app.strix.ai](https://app.strix.ai).
|
|
|
|
## Features
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="No Setup Required" icon="cloud">
|
|
No Docker, API keys, or local installation needed.
|
|
</Card>
|
|
<Card title="Full Reports" icon="file-lines">
|
|
Detailed findings with remediation guidance.
|
|
</Card>
|
|
<Card title="Team Dashboards" icon="users">
|
|
Track vulnerabilities and fixes over time.
|
|
</Card>
|
|
<Card title="GitHub Integration" icon="github">
|
|
Automatic scans on pull requests.
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
## What You Get
|
|
|
|
- **Penetration test reports** — Validated findings with PoCs
|
|
- **Shareable dashboards** — Collaborate with your team
|
|
- **CI/CD integration** — Block risky changes automatically
|
|
- **Continuous monitoring** — Catch new vulnerabilities quickly
|
|
|
|
## Getting Started
|
|
|
|
1. Sign up at [app.strix.ai](https://app.strix.ai)
|
|
2. Connect your repository or enter a target URL
|
|
3. Launch your first scan
|
|
|
|
## Scan Local Source
|
|
|
|
Send a local working tree to the managed white-box scanner without connecting a source-control provider:
|
|
|
|
```bash
|
|
# Review the exact file manifest and capture source.archive_sha256. Nothing is uploaded.
|
|
strix cloud scans start --source . --dry-run --show-files --json
|
|
SOURCE_SHA256="<reviewed source.archive_sha256>"
|
|
|
|
# Repeat the same source-selection flags and approve that exact snapshot.
|
|
strix cloud scans start --source . --approve-sha256 "$SOURCE_SHA256" --wait
|
|
```
|
|
|
|
In a Git repository, Strix includes tracked files and untracked files that are not ignored. Hidden files, `.git`, symlinks, dependencies and build output, secret-like filenames, and nested archives are excluded by default. Use `.strixignore` or repeat `--exclude GLOB` for project-specific exclusions. `--include-hidden`, `--include-sensitive`, and `--include-archives` are explicit opt-ins.
|
|
|
|
The CLI limits individual files, total expanded bytes, archive bytes, and file count. For an agent or CI handoff, repeat the same `--source`, `--exclude`, and `--include-*` flags with `--approve-sha256`; Strix refuses the upload if the rebuilt archive differs from the reviewed digest. `--yes` is a one-invocation approval for the snapshot built at that moment, not a digest-bound two-step approval.
|
|
|
|
The temporary local archive is always removed. After a definitive launch rejection, Strix also deletes the staged remote upload. If a network error, server error, or interruption makes the launch outcome ambiguous, it retains the upload and reports its ID; check `strix cloud scans list` before retrying, then delete an unlinked upload with `strix cloud uploads delete UPLOAD_ID`.
|
|
|
|
<Card title="Try Strix Cloud" icon="rocket" href="https://app.strix.ai">
|
|
Run your first pentest in minutes.
|
|
</Card>
|