1. Install
Download the CS Code CLI, verify checksums, install Syft/Grype for real SBOM and vulnerability scanning, then run doctor.
curl -fsSL https://cs-code.com/downloads/cli/cscode-linux-x86_64 -o cscode
chmod +x cscode
./cscode doctorDocumentation
Run CS Code locally, prove the boundary, then decide whether to use the dashboard.
A practical guide for private-beta users evaluating release evidence packs for restricted software deployments.
Install CLIDownload the private-beta binary or Python package.Try locallyRun the demo scanner path without uploading source code.Sample packInspect the buyer-facing output and update diff.SecurityReview exactly what is processed, uploaded and excluded.Private betaRequest controlled access for a real pilot.
2. Scan Locally
Generate release evidence on the machine or CI runner where the source already lives. Use --exclude for sensitive paths.
cscode pack ./my-app --product "My Product" --version "1.2.3" --exclude ".env" --exclude "secrets/**"3. Export Evidence
Create HTML, PDF, Markdown, ZIP, update diffs and checksum manifests without using the SaaS dashboard.
cscode evidence release-pack-my-product-1.2.3
cscode export release-pack-my-product-1.2.3 --format pdf
cscode checksums release-pack-my-product-1.2.3 --verify4. Upload Metadata
Preview the exact payload first. Standard upload excludes source code, project files, raw scanner reports and release ZIPs.
cscode upload --dry-run release-pack-my-product-1.2.3
cscode auth login --api-url https://app.cs-code.com --token <CLI_TOKEN>
cscode upload release-pack-my-product-1.2.3CLI quickstart
Download, verify, install scanner dependencies and run `cscode doctor`.
Scan exclusions
Default sensitive-file exclusions, `.cscodeignore` and repeated `--exclude` flags.
Evidence pack contents
Release summary, SBOM, vulnerabilities, endpoints, env vars, exclusions, diff and checksums.
Metadata upload
Dry-run first, upload summary metadata only, optional evidence PDF by explicit flag.
CI/CD usage
Use non-interactive mode and severity/policy thresholds in GitHub Actions or Azure DevOps.
Troubleshooting
Docker permissions, port conflicts, scanner availability and missing vulnerability database.
Trust boundary
The docs should answer the uncomfortable questions first.
Security-conscious buyers need to know what is scanned, what is excluded, what is uploaded, and how they can verify the release pack they received.
The CLI can run with no CS Code account.
Raw source code is not uploaded by default.
Real .env files and key material are excluded from scanner inventory by default.
Use .cscodeignore and repeated --exclude flags for project-specific exclusions.
Excluded files are listed in excluded-files.json and excluded-files.md.
Optional evidence PDF upload requires an explicit flag and confirmation.
Commercial model
Easy to try locally. Paid when evidence becomes a team workflow.
Free
Local CLI scan, pack, evidence export, diff and checksum verification.
Paid
Dashboard release history, RBAC, CLI tokens, metadata upload, audit, approvals, billing controls and CI workflows.
Enterprise
Pro capabilities with self-hosted deployment, custom retention and limits, contractual support and dedicated onboarding.
Ready for a controlled pilot?
Try the local path first. If the pack format fits your buyer review, request private beta access and upload metadata only when you are comfortable with the boundary.