DAST for Developers security that runs like a unit test
NightVision installs with brew, scans the app you just built, and returns request-level findings with retained HTTP evidence.
$ brew install nvsecurity/taps/nightvision $ nightvision login $ nightvision scan -t my-app
Runs where your tests run
A CLI, not a console
Install with Homebrew, log in once, and scan any running app from the terminal: localhost, a container, a staging URL. API scans complete in 10 to 15 minutes, quick enough to treat like a long test suite.
Findings in the PR view
SARIF surfaces findings in GitHub Security Alerts alongside your other checks. On supported source-discovered API scans, Code Traceback pins the finding to the file and line that defined the endpoint.
Scan from VS Code
The NightVision extension in the Visual Studio Marketplace creates targets, records logins, and runs scans without leaving the editor.
Your coding agent can run and read scans
Determinism on the finding, agents on the fix, humans on the merge. The open-source MCP server and Claude Code skills let your agent start scans, read request-level evidence, propose changes, and rescan; your repository's review controls still decide the merge. See NightVision for coding agents.
Findings you can verify before you fix
Reproduce it
Replay the exact exchange with one curl command, before and after your fix.
Understand it
Explain with AI walks through the finding; supported source-discovered API findings arrive pinned to a file and line you own.
Verify it
Playwright-recorded logins with vaulted credentials and TOTP/MFA; a login check gates every scan.
API discovery reads your source locally and generates an OpenAPI spec in under 20 seconds, so the routes your docs forgot get tested too.
DAST for developers: common questions
Do I need the security team before I can run a scan?
No. The trial is self-serve and onboarding an app takes 6-12 clicks, under a minute. When your security team adopts NightVision, your targets fold into the shared workspace.
How do I install NightVision?
brew install nvsecurity/taps/nightvision on macOS or Linux, a direct binary download, or the VS Code extension from the Visual Studio Marketplace.
What does a finding look like?
The request and response that triggered it, a one-command curl reproduction, and SARIF in the PR view. Supported source-discovered API findings add file and line. Not a PDF.
Can Claude Code or my coding agent run NightVision?
Yes, in early access, via the open-source MCP server and Claude Code skills. Agents propose changes and rescan; you review and merge.
Can it scan my local app fully authenticated?
Yes. Localhost scanning works from the CLI, and Playwright-recorded logins with auto-vaulted credentials and TOTP/MFA cover the authenticated app, gated by a login check.
Where do other roles fit?
See NightVision for security engineers, platform engineers, and security champions.
Run security like a unit test.
Start free, scan the app you are working on right now, and read the first finding in your own code.