Sniff & Fix

Scan API for build pipelines

Check your own site after each deploy and stop a release that makes the score worse.

Get an API token

What you need

• A Starter, Pro or Ultimate plan and an API token from Account › API tokens (Starter up to 2 active tokens, Pro 10, Ultimate 25). The token is shown once; we store only a hash. Revoke it there at any time.
• The site added to your dashboard and ownership verified (DNS TXT record or file). The API only scans sites in your own account.

Run a scan

curl -sS -X POST https://sniffpup.com/api/v1/scan \
  -H "Authorization: Bearer $SNIFFPUP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-app.com", "minScore": 80}'

Body fields:

• url or projectId: which of your sites to scan.
• minScore (0–100, default 70): the check fails when the score is lower.
• failOn (optional: critical, high, medium or low): also fail when any issue at that severity or worse is found.

A scan takes up to about a minute. When it runs you get HTTP 200 with passed true or false:

{
  "scanId": "6f1c…",
  "site": "your-app.com",
  "score": 86,
  "minScore": 80,
  "failOn": null,
  "passed": true,
  "reasons": [],
  "counts": { "critical": 0, "high": 0, "medium": 1, "low": 2, "info": 0 },
  "findings": [{ "id": "…", "severity": "medium", "title": "Missing Content-Security-Policy header" }],
  "reportUrl": "https://sniffpup.com/scan/6f1c…",
  "scannedAt": "2026-10-24T20:30:00.000Z"
}

The response lists issue titles only. Details, evidence and fix prompts are in the report at reportUrl, behind your sign-in.

GitHub Actions example

Save the token as a repository secret named SNIFFPUP_TOKEN, then:

# .github/workflows/sniffpup.yml
name: SniffPup check
on:
  deployment_status:
jobs:
  sniff:
    if: github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    steps:
      - name: Scan the live site
        env:
          SNIFFPUP_TOKEN: ${{ secrets.SNIFFPUP_TOKEN }}
        run: |
          res=$(curl -sS -X POST https://sniffpup.com/api/v1/scan \
            -H "Authorization: Bearer $SNIFFPUP_TOKEN" \
            -H "Content-Type: application/json" \
            -d '{"url": "https://your-app.com", "minScore": 80, "failOn": "high"}')
          echo "$res" | jq '{score, passed, reasons, reportUrl}'
          test "$(echo "$res" | jq -r .passed)" = "true"

Errors and limits

• Errors look like {"error": {"code": "…", "message": "…"}}: invalid_token (401), plan_required (403, the plan doesn't include the API), site_not_verified (403), site_not_found (404), bad_request (400), rate_limited (429, with Retry-After).
• API scans share your plan's daily scan limit and per-site pacing, plus up to 30 calls an hour per token. Each scan checks as many pages of your verified site as your plan does.
• It's the same passive scan as the dashboard: it reads what your live site serves to any visitor. A passing score means we didn't find those issues, not that none exist.

Use it from your AI coding tool

The same token also connects Claude Code, Cursor and other AI coding tools to SniffPup, so they can scan your site and fix what it finds. Set it up

Slack and Discord alerts

On Solo and up, open Slack or Discord alerts under a site in your dashboard and paste a Slack incoming webhook or a Discord channel webhook. When monitoring finds new serious issues we post the site, the issue titles and a report link, never keys or evidence. Use Send test to check it, and Turn off to remove it. The webhook address is stored encrypted and never shown in full again.