SecureNow CLI

# Set default app key
securenow config set defaultApp sk_live_abc123

# Get a config value
securenow config get apiUrl

# Show all config
securenow config get

# Show config file paths
securenow config path

# List all apps
securenow apps list

# Create an app linked to specific hosts
securenow apps create my-api --hosts api.example.com,www.example.com

# Set a default app for other commands
securenow apps default sk_live_abc123

# Discover subdomains
securenow apps discover --domain example.com

# List last 10 traces
securenow traces list --app sk_live_abc --limit 10

# Inspect a specific trace
securenow traces show abc123-def456

# Run AI analysis on a suspicious trace
securenow traces analyze abc123-def456

# What is failing in production, grouped (8.18)
securenow logs errors --app <app-key> --env production --since 6h

# Last 2 hours of ERROR logs
securenow logs list --app sk_live_abc --minutes 120 --level ERROR

# Show logs for a specific trace
securenow logs trace abc123-def456

# Verbose output with trace/span IDs
securenow logs list --app sk_live_abc --verbose

# What is waiting, for one app (8.19)
securenow review list --search my-app

# Tune the rule first, then close everything it caused
securenow alerts rules change <rule-id> "ignore 404s from our uptime monitor"
securenow review group 1 --outcome rule_tuning --reason "Guard added in the new version" --preview
securenow review group 1 --outcome rule_tuning --reason "Guard added in the new version" --yes

# One read-only pass with Claude Code: you get a plan
claude "$(npx securenow agent prompt patrol)"

# Every 30 minutes, allowed to act on one app (crontab)
*/30 * * * * claude -p "$(npx -y securenow@latest agent prompt patrol --search my-app --confirm-writes)" --allowedTools "mcp__securenow"

# Describe the detection in English (8.16): checked against your app's data, created in test mode
securenow alerts rules from-text "one IP failing 10 sign-ins in 5 minutes" --app <app-key>

# Or create one from SQL. Scope app keys with __USER_APP_KEYS__ and return an "ip" column.
securenow alerts rules create \
  --name "Auth: magic-link brute force" \
  --sql @rule.sql \
  --apps <app-key> \
  --severity high \
  --nlp "single IP flooding /api/auth/signin or /api/auth/callback"

# See every run, and ask why it stayed quiet for an address (8.17)
securenow alerts rules runs <rule-id>
securenow alerts rules why <rule-id> --ip 203.0.113.50 --since 2h

# Change it in plain English (8.18)
securenow alerts rules change <rule-id> "raise the threshold to 20 failed sign-ins"

# Create a rule for a specific path and method
securenow fp create --path /api/webhook --method POST --reason "Legit traffic"

# AI-generate conditions from a description
securenow fp ai-fill "Health check from uptime monitor"

# Dry-run conditions against real traces
securenow fp dry-run --conditions '[{"field":"path","operator":"equals","value":"/health"}]'

# Mark an IP as false positive from a notification
securenow fp mark notif_abc123 203.0.113.1 --reason "Internal scanner"

# Quick lookup (shorthand)
securenow ip 185.220.101.1

# Full lookup with JSON output
securenow ip lookup 185.220.101.1 --json

# See what requests came from this IP
securenow ip traces 185.220.101.1

# Start an investigation (prints the conversation id)
securenow forensics chat --app <app-key> "Which accounts had failed logins and then a successful one?"

# Follow up: the chat remembers the accounts, IPs and traces it found
securenow forensics chat --conversation <id> "What else did those IPs do after logging in?"

# Pick up a conversation someone started in the dashboard, interactively
securenow forensics chat --conversation <id>

# List conversations, or print one
securenow forensics conversations
securenow forensics conversations <id>

# One question, no memory
securenow forensics "Top 10 paths with 500 errors" --app <app-key>

securenow firewall enable --env production

# Would a POST to /api/auth/register from this address be blocked in production?
securenow firewall test-ip 203.0.113.50 --path /api/auth/register --method POST --env production

# What did the firewall stop in the last hour?
securenow firewall hits --since 1h
securenow firewall hits --since 24h --action rate_limited

# Block one address everywhere, for a day
securenow blocklist add 198.51.100.77 --duration 24h --reason "Scraper"

# Block a range on one route and method, in production only
securenow blocklist add 203.0.113.0/24 --route /api/auth/register --mode exact --method POST \
  --env production --duration 24h --reason "Signup flood"

securenow blocklist list
securenow blocklist unblock <id> --reason "Attack over"

# 5 login attempts per minute per IP, in plain English
securenow ratelimit from-text "rate limit POST /api/auth/login to 5 attempts per minute per IP" --yes

# 600 requests per minute per API key
securenow ratelimit add --route /api/v1 --mode prefix --limit 600 --window 1m --header x-api-key

# 10 exports per minute per signed-in session, for 24 hours
securenow ratelimit add --route /api/notes/export --mode exact --method GET \
  --limit 10 --window 1m --cookie connect.sid --duration 24h

securenow ratelimit test 192.0.2.50 --path /api/auth/login --method POST
securenow ratelimit list --env production

securenow trusted add 198.51.100.10 --label "Uptime monitor"