Skip to content
0sec0sec

Getting Started

Install

Section titled “Install”

Install the verified release binary with one command, build from source, or run the container image.

Terminal window
# Verified release binary (macOS Apple Silicon / Linux x64/arm64)
curl -fsSL https://raw.githubusercontent.com/0sec-labs/0sec/main/install.sh | bash
export PATH="$HOME/.0sec/bin:$PATH"
0sec --help          # or just: 0 --help


# Source
git clone https://github.com/0sec-labs/0sec.git
cd 0sec
corepack enable
pnpm install --frozen-lockfile
pnpm build
node packages/cli/dist/index.js --help


# Docker
docker run --rm ghcr.io/0sec-labs/0sec:latest --help

Add the export line to your shell profile to make the release binary available in future shells.

Set a model key

Section titled “Set a model key”

0sec is bring-your-own-model. Export one provider key, then pin the matching model with --model when several keys are present.

Terminal window
export OPENROUTER_API_KEY="sk-or-..."   # one key, many model families
# or a direct provider:
export ANTHROPIC_API_KEY="sk-ant-..."
export OPENAI_API_KEY="sk-..."
export Z_AI_API_KEY="..."               # glm-5.3
export QWEN_API_KEY="..."               # qwen3.8-max

0sec routes --model (or 0SEC_MODEL) to its matching provider. If the runtime is misconfigured it stops with an error instead of running a broken scan. See API Keys for the full provider list and ChatGPT Codex / Azure setup.

First scan

Section titled “First scan”

Every live network target needs a scope file. The CLI refuses an unscoped live target before it makes a request.

Terminal window
echo '{"in_scope":["your-app.com"]}' > scope.json


0sec scan --target https://your-app.com/api/chat --scope ./scope.json

This maps the attack surface, launches targeted attacks, reproduces each finding, and writes a report. With Docker, mount the scope file and pass its container path:

Terminal window
docker run --rm -v "$PWD/scope.json:/work/scope.json:ro" -e OPENROUTER_API_KEY \
  ghcr.io/0sec-labs/0sec:latest scan \
  --target https://your-app.com --scope /work/scope.json

Key scenarios

Section titled “Key scenarios”

Pentest a web app

Section titled “Pentest a web app”

Shell-first: the agent gets bash and standard tooling to probe for CORS, SSRF, XSS, SQLi, SSTI, exposed files, and more.

Terminal window
0sec scan --target https://your-app.com --mode web --scope ./scope.json

Audit a package

Section titled “Audit a package”

Downloads and installs the package into a temp dir (never executes it), runs static analysis, then an AI review.

Terminal window
0sec audit lodash
0sec audit requests --ecosystem pypi
0sec audit alpine:3.20 --ecosystem oci

Review a codebase

Section titled “Review a codebase”
Terminal window
0sec review ./my-app                       # local directory
0sec review https://github.com/user/repo   # clones automatically

Control scan depth

Section titled “Control scan depth”
DepthTest casesTime
quick~15~1 min
default~50~3 min
deep~150~10 min
Terminal window
0sec scan --target https://api.example.com/chat --scope ./scope.json --depth deep

No sandbox by default

Section titled “No sandbox by default”

In the open-source CLI the bash tool runs commands directly on your host, guarded only by a timeout, scope-URL checks, and a scanner blocklist — there is no container or VM isolation. Run it from a disposable VM, or use the container image as your operating environment. (Per-scan sandboxing is a managed-platform feature, tracked in issue #193.)

Next steps

Section titled “Next steps”