• Agents
  • Docs
  • Pricing
  • Blog
Log in
Get started

Security for apps built with AI. Paste a URL, get a report, fix what matters.

Product

  • How it works
  • What we find
  • Pricing
  • Agents
  • MCP Server
  • CLI
  • GitHub Action

Resources

  • Blog
  • Docs
  • FAQ
  • Glossary

Security

  • Supabase Security
  • Next.js Security
  • Lovable Security
  • Cursor Security
  • Bolt Security

Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Imprint
© 2026 Flowpatrol. All rights reserved.
CLI

Security scans
from your terminal.

Install the CLI. Probe any URL. Get a report in seconds — no browser, no dashboard, just your terminal.

terminal
npx @flowpatrol/cli probe https://myapp.com
Get startedSee install options
Install

Pick your package manager.
One command.

npm install -g @flowpatrol/cli

Works on macOS, Linux, and WSL. Node 18+, Python 3.10+, or Homebrew.

Commands

Three commands.
That's the whole CLI.

flowpatrol probe <url>

Quick check in ~30 seconds. Hits the basics — headers, exposed endpoints, common misconfigs. Shows findings inline.

terminal
$ flowpatrol probe https://myapp.vercel.app

  Probing https://myapp.vercel.app...

  FINDINGS

  critical  Missing rate limiting on /api/auth/login
            Allows brute-force attacks on user credentials.

  high      Sensitive data in server error response
            Stack trace leaks internal file paths on 500 errors.

  medium    CORS allows any origin
            Access-Control-Allow-Origin set to *.

  low       Missing Content-Security-Policy header

  Done in 28s. 1 critical, 1 high, 1 medium, 1 low.
Workflows

Fits your workflow.
Not the other way around.

Scripting

Pipe JSON output into jq. Aggregate findings across targets. Build your own dashboards.

flowpatrol scan https://app1.com --format json | jq '.findings[] | select(.severity == "critical")'

CI/CD

Combine with the GitHub Action for automated PR checks. Block merges on critical findings.

# .github/workflows/security.yml
- name: Security scan
  run: flowpatrol scan ${{ env.PREVIEW_URL }} --fail-on critical

Debugging

Use --verbose to see exactly what gets checked. Every request, every test, every finding explained.

flowpatrol probe https://myapp.com --verbose
Output

Your format.
Your rules.

Human-readable for debugging. JSON for pipelines. SARIF for GitHub code scanning. Use --format to pick.

terminal
$ flowpatrol report fp_scan_a8f3c1

  IDOR on GET /api/users/:id
  Severity: critical | CWE-639

  What we found:
    Authenticated as user A, requested user B's profile.
    Server returned user B's full record.

  How to fix:
    Add authorization check — verify req.user.id
    matches the requested :id parameter.
Human
Read findings right in your terminal
JSON
Pipe into jq, feed into scripts, store in S3
SARIF
Upload to GitHub code scanning automatically
~30s
probe completes
quick check, real findings
3 formats
human, JSON, SARIF
use what fits your workflow
0 config
npx and go
no YAML, no setup files

Try it now.
One line. No sign-up required.

terminal
npx @flowpatrol/cli probe https://myapp.com
Read the docsSee all integrations