Keep the evidence with your code

Files you can use elsewhere

The test runner produces CTRF test results. Security scans produce JSON, Markdown, and a standalone HTML evidence report in the local output directory. SQLite stores immutable scans, source relationships, test contracts, and verification executions.

.qa/security/security-report.html
.qa/security/security.db
.qa/security/regressions/<test-id>.json
.qa/security/regressions/<test-id>.spec.js
.qa/security/code-report.json
.qa/security/web-report.json

Run in your own CI

Install the package and required browsers, keep your provider key in the CI secret store, and run the same commands you use locally. Make the CLI exit status part of your job result.

norybot run
norybot scan code --path ./src --skip-triage

Pro includes two device activations, for example a workstation and a stable CI runner. Plan activation handling before using ephemeral runners. An unreachable licensing service denies paid scans; there is no offline grace period.