Commands

The binary is installed as devguard. Every command exits with 0 on success and a non-zero code on failure.

Global flags

Global flags are read by every command.

devguard login

devguard login [--org <organizationId>]

Verifies an API key and stores it for the target url in ~/.devguard/config.json. The key comes from --key, then DEVGUARD_API_KEY, then a hidden prompt. Keys are stored per url, so a login for a local instance and a login for production coexist. A key that does not start with dvg_ is rejected before any request is made.

After verifying, login lists your organizations with their ids and stores a default organization for the url. The default is chosen in this order: --org (id or slug), an already stored default, the only membership when there is exactly one, otherwise an interactive picker (in a terminal only). When nothing is picked, login still succeeds; set organization: in the configuration, pass --org, or re-run login.

devguard init

devguard init [--force]

Interactive wizard that writes a first configuration file. It runs only in a terminal; in CI, commit a devguard.yml instead. It writes to the path given by --config (default devguard.yml) and refuses to overwrite an existing file unless --force is set.

The wizard signs in when no key is stored for the target url, picks an organization in the same order as login, proposes an npm-audit collector when a package-lock.json is present and a uses: scan collector when a supported scanner is installed, and then accepts any number of custom command collectors. It binds only to evidence records that already exist; it never creates one. It also offers to add the .devguard/ staging folder to your .gitignore.

devguard scan

devguard scan --evidence <shortId> [--scanner <id>] [--expires <duration>] [--org <organizationId>] [--allow-secrets]

Runs an installed vulnerability scanner and pushes its report into one evidence record, without a configuration file.

The report uploads under the collector name scan-<scanner> with a 30 minute timeout and replaces that collector's previous file. When a devguard.yml is present, its organization: is read; nothing else in the file is used.

devguard evidence validate

devguard evidence validate

Read-only preflight. It parses the configuration, checks that every uses: scan collector has an installed scanner, verifies the key, and confirms that every referenced evidence record resolves in the organization. It prints one line per record, runs no collector commands, and uploads nothing.

devguard evidence push

devguard evidence push [--dry-run] [--allow-secrets]

The whole pipeline: runs every collector, scans each artifact for secrets, uploads, and supersedes that collector's previous file. It prints one line per collector and exits non-zero when any collector fails. A failed collector uploads nothing; its previous file stays in place.

Connection and organization

Connection settings resolve highest first:

1. The --url and --key flags.
2. DEVGUARD_API_URL and DEVGUARD_API_KEY.
3. The login keystore (~/.devguard/config.json).
4. https://app.devguard.ch.

The organization resolves highest first:

1. The --org flag.
2. organization: in the configuration file.
3. The default stored by devguard login for the resolved url.

For push, validate, and scan the value must be the organization id. The slug is accepted only by login and init. devguard login prints the id.

Environment variables