Scan your code
in one minute.

Trojan runs on your machine and reports security issues in plain English. This guide gets you from zero to your first report — no security background needed.

Install & run

You don't need an account. From the root of any project, run:

$ npx trojan scan

Trojan detects your stack automatically and scans secrets, dependencies and code. Prefer a window over a terminal? Install the desktop app and point it at a folder:

# macOS
$ brew install --cask trojan

# Windows / Linux
curl -fsSL https://trojancli.com/install.sh | sh

Supported: JavaScript / TypeScript, Python, Go, Ruby, Rust, Java, PHP and more. Node 18+ required for the CLI.

Understanding results

Every finding answers three questions in plain language: what is wrong, why it matters, and the exact fix. Here's a typical entry:

Severity levels

Trojan ranks every finding on five levels — by how likely it is to be exploited and how much damage it would do. Work top to bottom; stop when it's safe to ship.

Config file

Drop a trojan.config.json at your project root to set defaults. Everything is optional.

{
  "minSeverity": "medium",
  "scan": ["secrets", "deps", "code"],
  "ignore": ["vendor/**", "*.min.js"]
}

Ignoring findings

Sometimes a finding is a false positive or an accepted risk. Silence a single line with a comment — Trojan records who ignored it and why:

// trojan-ignore: test fixture, not a real key
const SAMPLE_KEY = "AKIA...EXAMPLE";

CI/CD Pro

Fail a build when a scan finds anything above your threshold. Trojan exits non-zero so your pipeline stops. Here's a GitHub Actions step:

- name: Trojan security scan
  run: trojan ci --output trojan.sarif
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: trojan.sarif

CI mode and private org rules require a Pro plan. See pricing →

Pre-commit hook

Block commits that introduce Critical or High severity findings. Install from your project root:

trojan hook install

This writes a pre-commit hook that runs a fast, headless scan before each commit. If Critical or High findings are detected, the commit is blocked. To remove:

trojan hook uninstall

CLI commands

FAQ