# Security

URL: https://docs.hanzo.ai/docs/cli/security

> The `hanzo security` commands.

Also for this capability: [API](https://docs.hanzo.ai/docs/openapi/security) · **CLI** · [MCP](https://docs.hanzo.ai/docs/mcp-tools/security) · [SDKs](https://docs.hanzo.ai/docs/sdks)

Secret scanning for your code: submit sources, get findings, masked never raw.

[API reference →](https://docs.hanzo.ai/docs/openapi/security)

```bash
hanzo security scans list
```

Every command takes `--json` for the raw response and `--help` for its own flags. Sign in once with `hanzo auth login`; the commands below use that session, and the org they act in is the one it carries.

| Command                 | What it does                                                                                         |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
| `hanzo security health` | Reports that the scanning subsystem is serving and how many secret-detection rules the engine holds. |
| `hanzo security rules`  | The secret-detection catalog the engine scans with.                                                  |

### Findings

| Command                            | What it does                                                                                                                                                                            |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo security findings get <id>` | Returns a single finding: which rule fired, where (path and line), the masked preview and the SHA-256 fingerprint of the secret — the raw secret is not stored and cannot be read back. |
| `hanzo security findings list`     | The org's findings — rule, severity, path, line, masked preview and fingerprint — newest first, across scans or within one.                                                             |

### Scans

| Command                                                                           | What it does                                                                                                                                                         |
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo security scans create --files '[{"content":"<content>","path":"<path>"}]'` | Runs the detection engine over a batch of files and answers 201 with the scan summary: how many files were read, how many findings fired, and the tally by severity. |
| `hanzo security scans get <id>`                                                   | Returns one scan together with every finding on it, so the detail view is one round-trip rather than a list call per scan.                                           |
| `hanzo security scans list`                                                       | The org's scan history, newest first, each as the same summary the submission answered — files read, findings fired, tally by severity.                              |