How do the SuperClue API and account security work?
CI/CD pipelines call the SuperClue REST API with an API key. People sign in with a password, optional TOTP two-factor codes and a token that expires after 24 hours. What each person can do is set by one of 4 roles.
How do I run scans from CI/CD?
Create an API key in the app and send it in the X-API-Key header to POST /api/cicd/scan. New keys are stored as a hash, and you can hold up to 20 keys.
- Ready-made snippets exist for GitHub Actions and GitLab CI.
- A CI scan runs the 10-rule basic SAST, or a basic DAST that checks 6 security headers, the Server banner, HTTPS and the TRACE method.
- A CI scan does not run the full 350-module scanner.
- Each CI scan costs 9.52 credits.
For issue trackers, webhooks and SIEM export, see integrations.
How does sign-in work?
- Passwords are hashed with bcrypt.
- Sign-in issues a JWT that expires after 24 hours.
- After 5 failed attempts, the account is locked for 15 minutes.
How does two-factor sign-in work?
You can turn on TOTP two-factor sign-in with any authenticator app that reads a QR code. When you set it up, SuperClue gives you 8 backup codes. Each backup code works once.
What can each role do?
Access is role-based. There are 4 roles and 26 permissions in total.
| Role | What it can do |
|---|---|
| Owner | All 26 permissions, including team, settings, integrations and deleting scans. |
| Admin | The same 26 permissions as Owner. |
| Analyst | Run scans, work findings, create reports and compliance assessments, and export. No deleting scans, team or settings management. |
| Viewer | Read only: scans, findings, reports, compliance, threat data and analytics. |
Request access, then set up two-factor sign-in.
Request access