Scanning

Start a scan, choose what it checks and what fails the build, and know what happens when things take long or go wrong.

Run your first scan

$ valiqai scan? This End-to-End scan reserves 2 credits (you have 140). Start? YesStarted End-to-End scan cmh2x8k1p0003 of https://staging.northstar.appReserved 2 credits; unused credits come back when it finishes.Results: https://www.valiqai.com/runs/cmh2x8k1p0003Scan is running…  4 of 18 tests done · 0 problems so far · 1 min 10s  12 of 18 tests done · 2 problems so far · 3 minfailed: 3 open problems (1 blocker, 2 high) · score 64Found 1 blocker (failing on blocker and above).

Without valiqai.json, pass the address (valiqai scan https://staging.example.com), or, in a terminal, pick one of your verified domains when asked.

In a terminal it says what the scan reserves and asks before starting; --yes skips the question, and CI never asks. It prints a link to the results as soon as the scan starts, then a line each time more tests finish. The last line says why it passed or failed, and the exit code follows from it.

Add --open to open the scan in your browser, or --no-wait to start it and get your terminal back: it prints the link and exits 0.

Choose a scan

--type picks one of the two scans you can start in ValiqAI. The default is e2e, or scan.type in valiqai.json.

A scan reserves its credits when it starts and gives back what it didn't use when it finishes. Your first End-to-End scan is free.

A security scan only sends your chatbot attack prompts when you add --chatbot-consent, which says you're allowed to security-test it. Without it, ValiqAI finds the chatbot but leaves it alone. When chatbot scans aren't available yet, a security scan runs as End-to-End, costs what End-to-End costs, and the CLI says so before it starts.

Choose what fails the build

--fail-on sets the lowest severity that fails the build. The default is blocker.

Only open problems count. A problem someone dismissed in ValiqAI is reported, but doesn't fail the build.

Busy workspaces, retries and timeouts

• One scan at a time per workspace. If another scan is still running (another pull request's pipeline, say), scan waits for it, up to --timeout, and says which scan it's waiting for.
• No double billing. In CI, each job attempt sends one Idempotency-Key, so a retried request, or a step retried inside the same job, gets the scan already started instead of a second one. "Re-run job" starts a new scan, as you'd expect. Outside CI you can pass your own with --idempotency-key.
• Timeouts stop the scan. A scan still running at --timeout is stopped, so it doesn't keep holding the workspace, and its unused credits are released. Add --on-timeout keep to leave it running instead.
• Cancelling the job stops the scan. When your CI cancels the job, the CLI stops its scan. In a terminal, Ctrl-C asks first.

Waiting, following and stopping

• --no-wait starts the scan, prints its link and exits 0, for a pipeline that shouldn't wait.
• valiqai scans watch <id> follows a scan that's already running, with the same progress, exit codes and reports as valiqai scan. At its --timeout it stops waiting but leaves the scan running.
• valiqai scans cancel <id> stops one. Its unused credits come back.

Protected staging sites

Before a scan starts, ValiqAI checks whether the address is behind protection: HTTP basic auth, Vercel Deployment Protection, Cloudflare Access or Netlify password protection. A scan of it would only see the login wall, so it's refused with what was found (VQ711), and no credits are held.

Scanning through that protection isn't available yet. Until it is, point the scan at a deployment without it, like a preview with protection turned off for the scan.

Exit codes

Look up results

These read what's already in ValiqAI. Each takes --json, and exits 0 when it works and 1 when it doesn't.

$ valiqai scansID          SITE                   STATUS   SCORE  OPEN           STARTED     FROMcmh2x8k1p0  staging.northstar.app  Failed   64     3 · 1 blocker  2 h ago     GitHub · maincmh2w1a9q4  staging.northstar.app  Passed   91     none           1 d ago     CLI