CI/CD Integration

Run automated security scans on every deploy. Just one token — no service keys needed.

How it works

1. Create a project
   Add your app in the Supaguard dashboard
2. Copy your token
   Find it in Project Settings → CI/CD
3. Add to your pipeline
   One curl call — fails the build if score drops

Quick Start

Trigger a scan with a single curl call. Replace YOUR_PROJECT_TOKEN with the token from your project settings.

curl -s -X POST \
  https://sdvginmpveophtabkxhm.supabase.co/functions/v1/trigger-scan \
  -H "Content-Type: application/json" \
  -d '{
    "token": "YOUR_PROJECT_TOKEN",
    "threshold": 50
  }'

Response (pass)

{ "score": 82, "passed": true, "report_url": "..." }

Response (fail) — HTTP 422

{ "score": 35, "passed": false, "report_url": "..." }

Safe by design: Your project token only triggers scans for the linked project. No database credentials, service keys, or user sessions are needed.

GitHub Actions

Add this workflow to .github/workflows/supaguard.yml. It scans on every push to main and weekly on Monday mornings.

name: Supaguard Security Scan

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1' # Every Monday at 6 AM UTC

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Run Supaguard Scan
        id: scan
        run: |
          RESPONSE=$(curl -sf -X POST \
            "https://sdvginmpveophtabkxhm.supabase.co/functions/v1/trigger-scan" \
            -H "Content-Type: application/json" \
            -d '{
              "token": "${{ secrets.SUPAGUARD_TOKEN }}",
              "threshold": 50
            }')

SCORE=$(echo "$RESPONSE" | jq -r '.score // empty')
          PASSED=$(echo "$RESPONSE" | jq -r '.passed // empty')
          REPORT=$(echo "$RESPONSE" | jq -r '.report_url // empty')

echo "score=$SCORE" >> "$GITHUB_OUTPUT"
          echo "report=$REPORT" >> "$GITHUB_OUTPUT"
          echo "Security Score: $SCORE/100"

if [ "$PASSED" = "false" ]; then
            echo "::error::Security score ($SCORE) is below threshold"
            exit 1
          fi

- name: Comment on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '**Supaguard Security Scan:** Score ${{ steps.scan.outputs.score }}/100 — [View Report](${{ steps.scan.outputs.report }})'
            })

Required secret:
SUPAGUARD_TOKEN— your project token from Supaguard settings

Shell Script

A standalone script for any CI system (GitLab CI, CircleCI, Jenkins, etc.). Exits with code 1 if the score is below the threshold.

#!/usr/bin/env bash
set -euo pipefail

# Supaguard CI/CD Security Scan
# Usage: SUPAGUARD_TOKEN=... ./supaguard-scan.sh [threshold]

TOKEN="${SUPAGUARD_TOKEN:?Set SUPAGUARD_TOKEN env var with your project token}"
THRESHOLD="${1:-50}"

echo "Running Supaguard scan..."

RESPONSE=$(curl -sf -X POST \
  "https://sdvginmpveophtabkxhm.supabase.co/functions/v1/trigger-scan" \
  -H "Content-Type: application/json" \
  -d "{
    \"token\": \"$TOKEN\",
    \"threshold\": $THRESHOLD
  }")

SCORE=$(echo "$RESPONSE" | jq -r '.score // empty')
PASSED=$(echo "$RESPONSE" | jq -r '.passed // empty')
PROJECT=$(echo "$RESPONSE" | jq -r '.project // empty')
REPORT=$(echo "$RESPONSE" | jq -r '.report_url // empty')

if [ -z "$SCORE" ]; then
  echo "Error: Could not parse scan result"
  echo "$RESPONSE" | jq . 2>/dev/null || echo "$RESPONSE"
  exit 1
fi

echo "Project:  $PROJECT"
echo "Score:    $SCORE/100 (threshold: $THRESHOLD)"
echo "Report:   $REPORT"

if [ "$PASSED" = "false" ]; then
  echo "FAIL: Score is below threshold"
  exit 1
fi

echo "PASS: Score meets threshold"
exit 0

Usage:
SUPAGUARD_TOKEN=abc123... ./supaguard-scan.sh 70

Security Badge

Display your security score on your README or docs site. The badge auto-updates after each scan. Find your token in Project Settings.

Markdown

HTML

<a href="https://supaguard.pro">
  <img src="https://sdvginmpveophtabkxhm.supabase.co/functions/v1/badge?token=YOUR_PROJECT_TOKEN" alt="Supaguard Security Score" />
</a>

Badge styles

Shield (default)

Flat

API Reference

POST``/functions/v1/trigger-scan

Request body

Response