Self-serve demo

Try the local-first workflow in five minutes.

Run CS Code against a demo Docker Compose app, generate release evidence locally, inspect the buyer pack and preview metadata upload without sending source code.

Install CLI View sample PDF Check data handling

Local demo commands

no source upload

cp .env.example .env
./scripts/bootstrap-local.sh
./scripts/install-local-scanners.sh
export PATH="$PWD/.tools/bin:$PATH"
source .venv/bin/activate
cscode doctor
cscode pack examples/demo-compose-app-v2 --product "Demo App" --version "2.0.0" --output-root tmp/demo-cli --exclude ".env"
cscode evidence tmp/demo-cli/release-pack-demo-app-2.0.0
cscode upload --dry-run tmp/demo-cli/release-pack-demo-app-2.0.0

Clone and install

Install the CLI dependencies in a local Python environment.

Run doctor

Check Python, Docker, Syft, Grype and output-directory readiness.

Generate packs

Scan demo v1 and v2 locally and create release evidence packs.

Review the diff

Open the update-diff report to see changed ports, env vars, endpoints and components.

Dry-run upload

Preview the exact metadata-only payload before any dashboard upload.

Proof points

The demo proves the trust boundary before it asks for anything.

The strongest first impression is not a dashboard login. It is watching the CLI produce useful evidence locally, then seeing the exact upload allowlist.

Local output

Release manifest, services, ports, exclusions, env vars, endpoints, SBOM summary, vulnerability summary and evidence pack are generated on your machine.

No source upload

The scan, pack, evidence and diff commands do not contact the SaaS dashboard.

Dry-run boundary

`cscode upload --dry-run` shows exactly what standard metadata upload would send.

Optional dashboard

Dashboard history is useful, but the CLI remains useful without it.

Good beta fit

Use the self-serve demo first, then request access if the evidence format matches your buyer pain.

CS Code is best for vendors and consultants dealing with security review delays, on-prem installs, restricted environments, SBOM requests, vulnerability reporting and release-to-release change evidence.