DOCUMENTATION

Run it

INSTALL

npx shadscan-vue
pnpm dlx shadscan-vue
npm install -D shadscan-vue

Requires Node 20.19 or newer. No global install is necessary.

PRIVACY

  • Never starts your application.
  • Never writes to your source files.
  • Never calls a model or any network service.
  • Never uploads source. There is no telemetry.

COMMANDS

  • shadscan-vue [path]

    Audit a project. Defaults to the current directory.

  • shadscan-vue --json

    Machine-readable report, schema version 1.

  • shadscan-vue --prompt

    Paste-ready remediation prompt for an agent.

  • shadscan-vue --category forms

    Run a single category.

  • shadscan-vue --fail-under 70

    Exit 1 below a threshold.

  • shadscan-vue rules

    Print the rule catalog as markdown or JSON.

  • shadscan-vue setup --pre-commit

    Install a git pre-commit hook.

CONTINUOUS INTEGRATION

- name: Audit UI fundamentals
  run: npx shadscan-vue --fail-under 70 --no-interactive

Exit codes are 0 when the scan completes within the threshold and 1 otherwise. The threshold also fails on an unassessed score or partial source coverage. 

- uses: vinayakkulkarni/shadscan-vue@v0
  with:
    fail-under: 70

The action writes the score, the category table, and every failing rule to the job summary, then applies the gate last so the summary survives a failing score.

AGENT HANDOFF

npx shadscan-vue --prompt | pbcopy

The prompt embeds the full JSON report inside a delimited block marked as untrusted data rather than instructions, so an agent treats findings as input, not commands.