Quickstart

The shortest path from “I just installed Pencheff” to “I have a real finding in front of me” — one page per scan kind. Pick whichever asset class matches what you’re hardening today; every page finishes in under 10 minutes.

URL scan (DAST)LLM red team Repo scan SBOM generation Compliance mapping

What you need first

The Pencheff CLI (pip install pencheff) or an account on app.pencheff.com or an MCP-capable IDE (Cursor, Continue, Cline, Zed). All three drive the same engine.
For URL scans — written authorization to test the target. The CLI and API both reject scans without a consent_payload.
For LLM scans — an API key for the model under test, plus an optional moderation key (e.g. OpenAI Moderation) for the judge step.
For repo scans — a GitHub App install, a fine-grained PAT, or a public GitHub URL.

One depth: Deep

There’s no profile to pick — every security scan runs the full Deep assessment across every target kind:

Target kind	What Deep runs
URL scan	Full OWASP Top 10 + active scanner, auto-engagement, attack chains, threat model (60+ min)
LLM scan	The full red-team payload library (250 payloads) across all 10 OWASP LLM modules
Repo scan	Every scanner + extended rule packs + IaC + secrets

The API and CLI still accept a profile field (quick, standard, deep, plus the legacy names engage, compliance, api-only, cicd, sca, iac, supply-chain, network-va, hackme, compliance-full) for backward compatibility, but every value except load is coerced to deep at the runner — new integrations can omit it. profile: "load" is the one exception: a separate opt-in load/performance test, not a security scan.

Once you have a finding, Compliance mapping is the same flow for every target kind.

Going further

When you outgrow the rapid path, switch to the Tutorials section. Each tutorial walks an end-to-end scenario (auth-gated app, SPA crawl, CI gating, model drift A/B, audit-ready compliance bundle) and finishes with a runnable artefact you can ship to a customer.

Core concepts URL scan (DAST)