Run locally. Review carefully.

Commands below describe the v0.2.0 workflow for an approved executable. Public installation packages are not available yet. ./repository is a placeholder for a repository you are authorized to assess.

Before installation

Once an approved release is available, choose the binary for your OS and architecture: Windows, macOS, or Linux; amd64 or arm64. Verify the published checksum and publisher identity, review the distribution terms, and use a least-privilege environment. Checksums alone do not authenticate the publisher.

Scan and export evidence

Run qs version first and record the version. Default scanning selects all six languages and direct local dependency declarations. all-local adds recognized lockfiles; it does not resolve a complete dependency graph.

qs version
qs scan ./repository
qs scan ./repository --dependencies all-local --format json --output report.json
qs scan ./repository --format sarif --output report.sarif
qs scan ./repository --min-severity high --fail-on-severity high

Read the report before acting

Check coverage.complete and warnings before describing an inventory as complete within its supported scope.
Review each finding in its protocol, deployment, and data-lifecycle context. Source presence is not proof of runtime use.
Store reports privately. Do not put customer reports or repository contents into this website’s inquiry form.
Use --fail-on-severity high only when you intentionally want findings to affect the process exit status.

Exit codes

0: Scan completed; still inspect coverage and warnings.
1: An explicitly configured severity policy matched; the report was written first.
2: Invalid command, option, pattern, or configuration.
3: Cancellation, root/report/internal failure, or safety-limit abortion; a partial report may be available.

Discuss a repository assessment