Distributed binaries

Last updated: Oct 27, 2026

Fluid Attacks has native binaries for security scanning that run directly on your machine or CI runner without Docker. Each binary is a single self-contained executable that you install one time and run in all environments.

How it works

All the binaries use the same installation model: a one-line installer downloads the pre-compiled binary for your platform and puts it in a directory on your PATH.

Each binary supports at least one of these execution modes:

• Quick scan — give a path or an image directly on the command line for an immediate scan with no configuration. Available in ss and cs.
• Config-driven scan — give a YAML configuration file for full control of paths, output format, and scan behavior. Available in all binaries. This is the only mode that dast_api supports.

Authenticate

When you authenticate, the platform attributes the scan to your Fluid Attacks group. On a CI runner, all Fluid Attacks scanners authenticate each run with a Group token. You can give the token as a short-lived token from OpenID Connect (use --group, with nothing stored) or as a long-lived INTEGRATES_API_TOKEN secret.

If you run a binary on your own machine, sign in through your browser one time. You do not have to use a token.

For the setup, read Authentication.

Supported platforms

Installation

Run the one-line installer of the binary that you want. By default, it installs to /usr/local/bin. If you cannot write to that directory (frequent on macOS), install to a directory that your user owns:

mkdir -p ~/.local/bin
curl -fsSL <installer-url> | INSTALL_DIR=~/.local/bin sh

Then make sure ~/.local/bin is on your PATH:

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

For the installer URL and platform notes of each binary, read its page.

Pipeline gating

To block a CI/CD pipeline when the scanner finds vulnerabilities or secrets, use strict mode. You can set it in the configuration file of all binaries:

strict: true

cs and ss also accept --strict on the CLI when scanning without a config:

cs scan --strict alpine:3.17
ss scan /path/to/project --strict

When strict mode is enabled, the scanner exits with code 1 if it detects findings. This makes most CI/CD systems mark the job as failed and block the pipeline.

Common troubleshooting

Permission denied

The installer cannot write to /usr/local/bin, because only the root user can write to this directory. Use a directory that your user can write to:

mkdir -p ~/.local/bin
curl -fsSL <installer-url> | INSTALL_DIR=~/.local/bin sh

Then make sure ~/.local/bin is on your PATH:

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

tar: could not chdir to '/usr/local/bin'

The install directory does not exist or you do not have access to it. Create it before you run the installer:

mkdir -p /usr/local/bin
curl -fsSL <installer-url> | sh

Or use a custom directory:

mkdir -p ~/.local/bin
curl -fsSL <installer-url> | INSTALL_DIR=~/.local/bin sh

<binary>: command not found

The install directory is not on your PATH. Add it:

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

Replace <installer-url> with the URL of the binary that you installed (ss, cs or dast_api) and <binary> with its name. For the installer URLs, read the page of each binary.