Security scanning and CI thresholds

Choose coverage and a failure threshold

Use quick, standard, or deep scan depth. For a release check, select a severity threshold and allow enough time for the requested coverage. Errors, timeouts, unreadable reports, and partial scans fail a configured gate.

• --fail-on accepts low, medium, high, or critical and includes findings at that severity or above.
• TLS, certificate, header, DNS, endpoint, and software advisory signals remain separate in the report.
• security.txt validation checks Contact and Expires, detects expired or malformed policies, and excludes HTML fallback pages.

telesis check https://your-service.example --type=security --mode=local \
  --scan-depth=deep --fail-on=high --timeout=60s --output=json

Filter and export findings

Open a service's security details, search by finding text, evidence, or remediation, and combine the search with a severity filter. Export findings downloads the visible set as JSON.

The export includes titles, severity, evidence, remediation, and reference links. Clear filters to export all findings from the displayed report.

Read reports through MCP

security_scan accepts url, depth, and timeout_seconds. It returns the graded report with _status, _url, and _duration_ms. For cloud history, use get_security_trend with an explicit service_id; trigger_security_scan schedules a scan for an existing check_id.

Extend coverage behind login

Use native Playwright assertions to check login, access controls, and session-cookie attributes in an application you operate. Inject local TELESIS_TEST_* secrets by name instead of embedding credentials in scripts or monitor definitions.