Connect your repository
Follow these steps to get CloseBug scanning your code in under 2 minutes.
Install the GitHub App
Grant CloseBug read access to your repositories. It receives push webhooks and queues a full scan on every commit.
Install the CloseBug CLI
The CLI provides local Ring 1 checks and the CI/CD gate command. Install it globally with npm:
$ npm install -g closebug
# Or use npx for a one-time run:
$ npx closebug init
Initialize your repository
Run closebug init inside your repo. It installs a pre-push hook and creates a .closebug.yml config file.
$ cd your-repo
$ closebug init
[1/3] PASS Pre-push hook installed .githooks/pre-push
[2/3] PASS Git hooks path configured core.hooksPath = .githooks
[3/3] PASS Config file created .closebug.yml
Each teammate on the project should run closebug init once after cloning.
Commit the config and push
Commit the generated files so all teammates share the same config. The push triggers your first full scan.
$ git add .githooks/pre-push .closebug.yml
$ git commit -m "chore: add CloseBug security scanning"
$ git push
# CloseBug queues a full scan automatically via webhook
(Optional) Add the CI/CD gate
Block merges on CRITICAL or HIGH findings using the closebug gate command in your CI workflow:
# .github/workflows/security.yml
- name: CloseBug gate
env:
CLOSEBUG_SERVER_URL: ${{ secrets.CLOSEBUG_SERVER_URL }}
CLOSEBUG_API_KEY: ${{ secrets.INTERNAL_API_KEY }}
run: |
# On a PR, github.sha is a merge commit that is never scanned
closebug gate \
--repo "${{ github.repository }}" \
--sha "${{ github.event.pull_request.head.sha || github.sha }}" \
--skills sast,deps \
--block-on CRITICAL,HIGH
All set — check the dashboard
After your first push, findings appear in the dashboard within a minute. The scan covers SAST, dependencies, secrets, IaC, supply chain, and AI model discovery.
Open Dashboard