SecureAI documentation

SecureAI finds security weaknesses in AI systems across four phases — before you ship, while you test, at deployment, and at runtime. Use the CLI in your terminal and CI, and the dashboard to track what it finds.

Start hereQuickstartInstall, log in, and run your first scan in about five minutes.TerminalCLI referenceEvery command, flag, and exit code across the four phases.BrowserDashboard guideFindings, models, users, and reports — organised by role.AccessAuthenticationBrowser-based login, credential storage, and CI tokens.

Install the CLI

One command on macOS or Linux. The CLI is a single static binary and the download needs no account — you only need one to send results to a dashboard.

Terminal

curl -fsSL https://get.corelayersecurity.com/install.sh | sh

On Windows, or to download an archive directly and check it against its SHA-256 manifest, see Installation.

The four phases

Each phase answers a different question, and each has its own CLI command. They are independent — run the ones that fit your stage, in any order.

BUILD — secureai scan statically reads your prompts, tool definitions, and templates and reports risky patterns before anything runs. No model calls, no cost, safe on every commit.
TEST — secureai test sends adversarial payloads at a live endpoint and measures the attack success rate (ASR): how often an injection or jailbreak actually worked.
VALIDATE — secureai validate analyses a RAG pipeline descriptor or system prompt and produces a Security Deployment Score (SDS) out of 100.
RUNTIME — secureai runtime enforces context access policy, fingerprints behaviour to catch drift, and holds an agent inside its declared capability boundary.

What a run looks like

Terminal

$ secureai scan ./prompts

  BUILD — static risk scan
  14 files scanned · 18 findings · score 64/100

  CRITICAL  R-02  Instruction Override       prompts/system_prompt.md:12
  CRITICAL  R-05  Over-Permissive Tools      tools/exec.yaml:4
  HIGH      R-06  Sensitive Data Exposure    prompts/support.md:31
  …

  gate: fail-on=high → FAILED

Findings upload to your organisation's dashboard automatically, so the same run is visible to your security team without anyone copying output around. Pass --no-upload to keep a run local.

Who this is for

Developers building on LLMs — run scan locally and in CI, fix what it flags.
Security researchers — run the full four phases, triage findings, accept risk, and set severity in the dashboard.
Executives — read posture and compliance summaries without touching a terminal.
Organisation admins — invite people, manage roles, and control CLI access.

Standards mapping

Every finding carries an OWASP LLM Top 10 identifier, so results line up with whatever framework your organisation already reports against. See OWASP LLM Top 10.