npx @wardix/cli · one step in CI

See your app the way attackers do.

The shipped bundle is the real attack surface. Wardix reads it first — every APK and IPA, every release, straight from the pipeline.

Scan a build→ Book a demo

No agent, no SDK, no source upload — the binary is deleted when the scan ends.

release.yml — wardix gate live

3 new·1 fixed·41 persisting exit 1 only when this build introduced new findings at or above your threshold exit 1

findings anchored to OWASP MASVS MASTG CWE SARIF 2.1 — the standards your auditors already read

01 · Why the bundle

Attackers don't read your repo. They read your release.

The shipped artifact is rarely analyzed

Multiple teams merge into one bundle. What actually ships — after bundling, codegen and config injection — is the thing nobody inspects.

Pentests are snapshots; you ship weekly

An audit once a year describes a build from months ago. Every release between audits ships on trust.

Extraction is automated now

A leaked key was never worth six hours of manual reverse engineering. Automated across ten thousand store apps, it is.

02 · The release gate

One verdict, where the release decision already happens.

No new dashboard to babysit. The scan returns pass, warn or fail to the pipeline — and the rule is yours to set.

pass nothing new — ship it exit 0

warn new medium or low — visible, not blocking exit 0

fail new critical or high — blocked before the store exit 1

Dismiss a finding once and it stays dismissed — carried into GitHub code scanning as a suppression.

# .github/workflows/security.yml
- uses: wardixio/wardix-scan-action@v1
  with:
    artifact: build/app-release.apk
    baseline: previous-release
    fail-on: new-critical
    token: ${{ secrets.WARDIX_KEY }}

# fastlane/Fastfile
lane :release do
  build_app
  wardix_scan(
    artifact: "app-release.ipa",
    fail_on: "new-critical"
  )
end

// eas.json
"build": {
  "production": {
    "hooks": {
      "postBuild": "npx @wardix/cli scan"
    }
  }
}

also runs in fastlane, Expo EAS, Bitrise, GitLab CI and CircleCI

45s

median scan

checks per bundle

binaries retained

100%

of releases gated

Attackers automate. So should you.

Connect one app and your next build becomes the baseline. Every release after it gets a diff and a verdict.

Scan a build→ Book a demo

no card · first scan becomes the baseline · wardix.io