@wardix/cli

Upload a mobile build (.apk / .ipa) to Wardix from CI and gate the pipeline on what this build introduced — new security and privacy findings. Persisting findings (known from previous builds) and findings you dismissed in the dashboard never re-break the build.

WARDIX_KEY=wdx_ak_… npx @wardix/cli scan app-release.apk --wait --fail-on high

How it works

1. The CLI asks the Wardix API for a one-time signed upload URL and PUTs your binary straight to storage — it never transits Wardix's scan servers twice, and it is deleted after analysis (findings are kept, binaries never).
2. The scan runs (static analysis + diff against your previous build).
3. With --wait, the CLI polls until the scan completes and prints a delta-first report: NEW findings first, severity-sorted, each with a deep link into the dashboard.
4. The exit code applies the gate: non-zero only when new, non-dismissed findings meet --fail-on.

Setup

Mint an upload key on your app space's page in the dashboard and store it as a CI secret. A key is scoped to one space: scans land there, and the key can read nothing else.

Usage

wardix scan <path-to.apk|.ipa> [options]

  --fail-on <severity>  critical | high | medium | low | info | none   (default: high)
  --wait                poll until done, print the report, apply the gate
  --json                machine-readable output
  --sarif <file>        write SARIF 2.1.0 for code scanning (requires --wait)
  --timeout <seconds>   max wait with --wait                           (default: 600)

| Exit code | Meaning | |---|---| | 0 | pass — no new findings at or above --fail-on (or upload accepted without --wait) | | 1 | gate failed — this build introduced findings at or above --fail-on | | 2 | scan failed or timed out | | 3 | usage / auth error |

Environment: WARDIX_KEY (required), WARDIX_API_URL, WARDIX_APP_URL (overrides for self-hosted/dev).

CI snippets

GitHub Actions

- name: Wardix security gate
  run: npx @wardix/cli scan app/build/outputs/apk/release/app-release.apk --wait --fail-on high
  env:
    WARDIX_KEY: ${{ secrets.WARDIX_KEY }}

On GitHub, prefer the Wardix Scan action — it wraps this with a sticky PR comment and optional SARIF upload to code scanning.

GitLab CI

wardix:
  stage: test
  image: node:20
  script:
    - npx @wardix/cli scan app-release.apk --wait --fail-on high
  variables:
    WARDIX_KEY: $WARDIX_KEY

Bitrise

- script@1:
    title: Wardix security gate
    inputs:
      - content: npx @wardix/cli scan $BITRISE_APK_PATH --wait --fail-on high

Docs

Full documentation: https://wardix.io/docs/

Development

pnpm install
pnpm build      # tsc → dist/
pnpm test       # vitest
pnpm docs:gen   # regenerate reference sections in wdx-landing/docs/ from src/spec.ts + wdx-server's OpenAPI