Skip to content
MopokeHQMopokeHQMopokeHQ Docs

Introduction

MopokeHQ finds the security holes in your apps and tells you which to fix first. It checks your code, the packages it uses and your live websites, ranks every problem by how urgent it really is, follows each fix until it is live, and keeps the proof for audits and clients.

These docs cover setup, configuration and day-to-day use. If you are new, read this page, then the setup guide for where your code lives.

How it works

Section titled “How it works”
  1. A scan runs in your own CI. The mopoke CLI runs on your runners, from the public scanner image gitlab.boosoft.com.au:5050/mopokehq/scanner:1. It lists the packages your app uses (an SBOM), checks the code for security bugs, looks for committed secrets, checks infrastructure files and licences, and sends the results to MopokeHQ over HTTPS with a token you control. No source code leaves the runner (the one exception is merge request diffs, for projects that turn on code review), and MopokeHQ never connects into your network, so a self-managed GitLab, Gitea or Forgejo behind a firewall works as is.
  2. MopokeHQ matches and keeps matching. Every package list it holds is checked against security notices as they are published, so a hole announced tonight is matched against last month’s build without a new scan. Matching covers npm and Composer (Packagist) packages, plus PHP and Node.js runtime releases. Other ecosystems (Go, Python, Ruby and more) are listed in the SBOM but not matched yet.
  3. Deploy reports say what is live. A one-line CI step (or a GitLab deployment webhook) tells MopokeHQ which commit is running in which environment. A problem in a deployed build is confirmed live; a fix closes on its own only once MopokeHQ sees it deployed.
  4. One ordered list. Each problem gets a priority (P1, P2 or P3) and a deadline. The Now screen groups them by fix, so one upgrade that closes twelve problems across five repositories is one line. See Priorities and deadlines.
  5. Proof. Every decision, alert and fix goes into an append-only, hash-chained evidence log, and evidence packs map it to ISO 27001, SOC 2 and Essential Eight. See Evidence.

Three ways in

Section titled “Three ways in”

Your code and its packages

Section titled “Your code and its packages”

Add the scan to your CI. Pick the guide for where your code lives:

Where your code lives What you add What you get today
GitLab (gitlab.com or self-managed) One include line Scans, merge request comments, the merge gate, fix merge requests, deployment webhooks
GitHub One workflow file Scans and the merge gate in the job log. The native app (pull request comment, gate check, fix pull requests) is coming soon.
Gitea and Forgejo One workflow file Scans and the merge gate in the job log
Any other CI (Bitbucket Pipelines, Jenkins, Woodpecker and others) One job that runs the scanner image Scans and the merge gate in the job log

Every guide starts with a CI token: see Tokens and keys.

Your live websites

Section titled “Your live websites”

Add a site’s address and MopokeHQ checks it from the outside every day: HTTPS settings, security headers and what a first page load exposes. Prove you own the host to turn on deeper weekly scans (open ports, known holes, a web app scan). All scanner traffic comes from one address you can allowlist. See External scanning.

Package installs

Section titled “Package installs”

Point npm, pnpm, Composer and Docker at registry.mopokehq.com and every install goes through MopokeHQ’s proxy first: known malicious packages are blocked, brand-new releases wait out a cooldown, and suspicious ones are held for review. See Supply chain.

Words used in these docs

Section titled “Words used in these docs”
Word Meaning
Repository What a scan covers: a Git repository, or one app inside a monorepo.
Project A group of repositories you talk about as one thing, such as a client’s product. A new repository starts as a project of its own.
Advisory A published security notice about a package or runtime version.
Exposure One advisory affecting one repository, on a branch or in a deployed environment.
Action One fix on the Now screen, such as “Upgrade axios to 1.8.2”, covering every repository that needs it.
Finding A result from the code, secrets, infrastructure, licence or container scanners, listed on the Issues page.
P1, P2, P3 Priority. P1 is urgent and alerts at once; P2 and P3 go into digests. See Priorities and deadlines.
Lilly MopokeHQ’s AI. She writes plain notes and suggestions; she never closes a problem, silences a P1 or sends anything to a client on her own. See Lilly.

Where to go next

Section titled “Where to go next”

Questions the docs don’t answer: [email protected].