Step 1
Install the public CLI
Install the latest npm release globally. The package and executable are both named cognium-dev.
terminalbash
npm install -g cognium-dev cognium-dev --version
Step 2
Scan application source
Cognium detects supported languages from file extensions. Start with high and critical security findings while learning the output.
your projectbash
cd your-project cognium-dev scan ./src --exclude-tests --severity high
To try a public intentionally vulnerable application instead, clone WebGoat and scan it locally:
public examplebash
git clone --depth 1 https://github.com/WebGoat/WebGoat.git /tmp/webgoat cognium-dev scan /tmp/webgoat --exclude-tests --severity high
Step 3
Read the finding
Each security finding identifies the rule, CWE, severity, file and sink line. A taint trace shows how untrusted input reached the sensitive operation.
detailed outputbash
cognium-dev scan ./src --severity critical,high --verbose
- Confirm the source is attacker-controlled.
- Inspect the sink, such as a SQL query or command executor.
- Check whether a recognized sanitizer is present on the path.
Step 4
Export machine-readable results
SARIF works with GitHub Code Scanning and other compatible review tools. JSON is useful for custom automation.
reportsbash
cognium-dev scan ./src --format sarif --output results.sarif --severity high cognium-dev scan ./src --format json --output results.json
Step 5
Share project configuration
Generate cognium.config.json, then commit it when local and CI scans should use the same includes, exclusions, passes, suppressions, and severity settings.
configurationbash
cd your-project cognium-dev init