Getting Started

You don't need to be a security expert. Doorman explains everything it finds in plain English. Just run one command and it tells you exactly what to fix, why it matters, and how to fix it — often automatically. If you're building with AI tools like Claude, Cursor, or Copilot, Doorman is your safety net before you ship.

Prerequisites #

• Node.js 18+ — Doorman runs on Node. Check your version with node --version.
• No account, API key, or configuration required.

Quick Start #

Run a scan on your current directory with a single command:

npx getdoorman check

Or scan a specific path:

npx getdoorman check ./src

Doorman automatically detects your tech stack, selects the right rules, and scans your code. No configuration needed.

Understanding the Output #

After a scan completes, you'll see a report with three key sections:

Safety Score

A score from 0 to 100 indicating how safe your code is to ship. Scores above 70 are generally considered safe.

Score: 82/100 — SAFE TO LAUNCH

Findings by Category

Issues are grouped into 10 categories:

• Security — Vulnerabilities like SQL injection, XSS, auth issues
• Performance — N+1 queries, missing caching, bundle size
• Reliability — Missing error handling, race conditions
• Cost — Wasteful API calls, missing caching for paid services
• Compliance — GDPR, PCI, HIPAA violations
• Data — Data leaks, missing encryption, PII exposure
• Dependencies — Known vulnerabilities, outdated packages
• Infrastructure — Misconfigurations, exposed ports
• Quality — Code smells, complexity, dead code
• Deployment — Missing health checks, unsafe defaults

Severity Levels

Each finding has a severity level:

Fixing Issues #

Doorman finds the problems. Your AI fixes them. Run doorman fix to generate a prompt you can paste into Claude, Codex, or Cursor.

Fix critical issues:

npx getdoorman fix critical

Fix critical + high:

npx getdoorman fix high

Fix everything:

npx getdoorman fix all

If you're already in Claude Code or Cursor, just run the command — Doorman detects your environment and outputs the prompt directly. Your AI sees it and starts fixing.

Or just tell your AI:

"Run npx getdoorman check and fix the critical issues"

Your AI runs the scan, sees the results, and fixes them. That's it.

Pre-Commit Hook #

Set up a git pre-commit hook so Doorman runs before every commit:

npx getdoorman init

This creates a .doormanrc config file and installs a pre-commit hook. The hook blocks commits if the safety score falls below the configured threshold.

Configuration #

While Doorman works with zero config, you can customize it with a .doormanrc file in your project root:

{
  "preset": "recommended",           // Which rule set to use (recommended, strict, or minimal)
  "minScore": 70,                     // Fail if safety score drops below this
  "categories": [                     // Which categories to scan (remove any you don't need)
    "security",
    "performance",
    "reliability",
    "cost"
  ],
  "severity": "medium",              // Only show medium+ issues (hides low and info)
  "ignore": [                         // Rules to skip (add rule IDs here)
    "SEC-XSS-003",
    "PERF-CACHE-002"
  ],
  "paths": {
    "include": ["src/", "lib/"],      // Only scan these folders
    "exclude": ["test/", "vendor/"]   // Skip these folders
  }
}

Presets

Next Steps #

• CLI Reference — Full documentation for all 9 commands
• Rule Reference — Browse all 2,508 rules
• CI/CD Integration — Set up automated scanning in your pipeline
• Detection Methodology — How the 4-layer engine works