# Installation Source: https://docs.amplify.security/install-console Install Console on Linux or macOS. ## Prerequisites * Linux or macOS (x86\_64 or arm64) * `curl` available in your `PATH` ## Install Open a terminal and run the following command to launch the installer: ```bash theme={null} curl -sSf https://get-console.amplify.security | bash ``` The installer will download the latest release of Console from GitHub, verify its integrity, install it under your current user at `~/.local/bin/console` (or under a separately configured XDG path), and update your `PATH` if necessary in your shell's rc file. To install a specific version, pass the version tag as an argument: `curl -sSf https://get-console.amplify.security | bash -s -- v1.2.3` After installation, open a new terminal session (or `source` your shell's rc file) so that the updated `PATH` takes effect. ## Configure API keys Console requires an Amplify API key, which you can obtain by going to [Profile > API keys](https://app.console.lab.amplify.security/console/profile/api-keys) from the web interface. Add the following to your `~/.bashrc` or `~/.zshrc`, then `source` the file or open a new terminal: ```bash theme={null} export AMPLIFY_API_KEY="" ``` ## Install the GitHub App Currently, in order to enable Console to access your organization's repositories on GitHub, you need to install the [Amplify Console GitHub App](https://github.com/apps/console-lab). To do so, visit the [install page](https://github.com/apps/console-lab/installations/select_target), select your organization, optionally select specific repositories to grant Console access to, and finally click Install. This should redirect you back to Console's web interface to complete setup. ## Start a session Once your environment is configured, change to a directory containing one of your projects and start Console: ```bash theme={null} cd ~/src/hello-world console ``` This opens an interactive chat session with the AI agent. Try asking it one of the following: * Find and resolve any vectors for XSRF/XSS attacks within this project. * Are there any exposed service endpoints in this project that shouldn't be? or anything else may be relevant for your project. # Introduction Source: https://docs.amplify.security/introduction Amplify Console is an agentic AI platform for security analysis. ## What is Console? Console is Amplify Security's agentic AI platform for security analysis. It runs as an interactive terminal application that uses AI agents to reason about your codebase, surface security findings, and help your team understand and remediate vulnerabilities. Console is currently in alpha, undergoing rapid development. Contact [support@amplify.security](mailto:support@amplify.security) if you would like to try it out and work with us to help our project come to fruition! ## How it works Console operates as an interactive chat session in your terminal. The AI agent has access to your connected repositories and Amplify platform data, allowing it to answer questions about your security posture, investigate specific findings, and guide remediation. ## Get started Install Console on Linux or macOS. # Enable Pull Request Comments Source: https://docs.amplify.security/legacy/guides/enable-comments A how-to for enabling Amplify comments on pull requests for projects currently running silent. ## Why am I not seeing comments on my Pull Requests? The Amplify platform allows for projects to run silently, meaning that while we are actively detecting vulnerabilities and generating code fixes for your project, we are not commenting on your Pull Requests. This is caused by not enabling commenting on the projects when they are added to the Amplify platform. Follow along with this guide to enable commenting for your projects. ## What comments can I expect Amplify to make on my Pull Requests? Amplify can be configured to make two different types of comments on your Pull Requests. The first type of comment is a notification that one or more vulnerabilities have been detected in the new code. The second type of comment is a notification that a code fix is available for a detected vulnerability. Amplify can also be configured to comment with "Approvals" on Pull Requests that have no detected vulnerabilities. ### Vulnerability notification Vulnerability notifications are made on Pull Requests when Amplify detects vulnerabilities in the new code. These notifications are enabled in the Amplify App by enabling `Merge Comments` for the project. Vulnerability Notification Vulnerability Notification ### Code fix notification Code fix notifications are made on Pull Requests when a Code Fix is available for a detected vulnerability. These notifications are enabled in the Amplify App by enabling `Merge Comments` for the project. Code Fix Notification Code Fix Notification ### Approval notification Approval notifications are made on Pull Requests when no vulnerabilities are detected in the new code. These notifications are enabled in the Amplify App by enabling `Merge Approvals` for the project. Approval Notification Approval Notification ## How to enable commenting To enable commenting, Sign in to the [Amplify App](https://app.amplify.security) and select `Projects` on the Navigation Bar. From the Projects page, you can enable commenting on your projects by selecting the appropriate options in the `Merge Comments` and `Merge Approvals` columns. Project Configuration Project Configuration Alternatively, Sign in to the [Amplify App](https://app.amplify.security), select `Projects` on the Navigation Bar, then select the `Settings` tab from the Project's page. From the Project's Settings you can enable commenting on your projects by selecting the appropriate options under **Integrations**. Project Settings Project Settings # Ignoring Vulnerabilities Source: https://docs.amplify.security/legacy/guides/ignoring-vulns A how-to for suppressing vulnerability notifications inline and by using an .amplifyignore file. There are times when you simply don't need to worry about a vulnerability. Testing code that only runs locally and never gets deployed and code which have potential vulnerabilities mitigated elsewhere, like in infrastructure, are two examples of these scenarios. Let's look at how to ignore these vulnerabilities on the Amplify platform. # What is an "Ignored" vulnerability? On the Amplify platform, and Ignored vulnerability is considered to be ***Acknowledged*** with ***Ignored*** given as the reason. Acknowledgement does not mean that the vulnerability is legitimate! Acknowledgement simply means that someone is aware that one or more security scanners flagged a particular piece of code as vulnerable but the vulnerability is not considered active or as truly positive. Acknowledged vulnerabilities do not trigger notifications and they do not display as prevented or merged vulnerabilities in Amplify's metrics. Acknowledged vulnerabilities, including those which have been ignored, may be viewed on the Vulnerabilities page under the **Acknowledged Vulns** tab. Acknowledged Vulns tab with two ignored vulnerabilities shown # How to Ignore a vulnerability There are two ways to ignore a vulnerability currently in the Amplify platform. The first is with a code comment on the vulnerable code line. The second is by using a `.amplifyignore` file. ## Ignoring with a code comment To ignore a vulnerability with a code comment, simply append a comment to the vulnerable line which contains the string `@amplify-ignore`. For example: ```tsx theme={null} models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) // @amplify-ignore ``` The `@amplify-ignore` code comment must be made on the vulnerable line as reported by Amplify. Commenting on the lines above or below the vulnerable line will not currently ignore the vulnerability. ## Ignoring with a `.amplifyignore` file To use a `.amplifyignore` file to ignore vulnerabilities, first create a file in the root of your project directly named `.amplifyignore`. This file mostly follows the familiar syntax of the well-known `.gitignore` file, for which the specification can be found in the [Git documentation](https://git-scm.com/docs/gitignore). The below section, **Pattern Format**, is for the most part verbatim to the Git documentation, but has been updated to reflect the `.amplifyignore` filename and omit patterns which reference relative paths, as Amplify only supports a `.amplifyignore` file in the root of the project. ### Pattern Format * A blank line matches no files, so it can serve as a separator for readability. * A line starting with # serves as a comment. Put a backslash ("`\`") in front of the first hash for patterns that begin with a hash. * Trailing spaces are ignored unless they are quoted with backslash ("`\`"). * An optional prefix "`!`" which negates the pattern; any matching file excluded by a previous pattern will become included again. It is not possible to re-include a file if a parent directory of that file is excluded. Git doesn't list excluded directories for performance reasons, so any patterns on contained files have no effect, no matter where they are defined. Put a backslash ("`\`") in front of the first "`!`" for patterns that begin with a literal "`!`", for example, "`\!important!.txt`". * The slash "`/`" is used as the directory separator. Separators may occur at the beginning, middle or end of the `.amplifyignore` search pattern. * If there is a separator at the end of the pattern then the pattern will only match directories, otherwise the pattern can match both files and directories. * For example, a pattern `doc/frotz/` matches `doc/frotz` directory, but not `a/doc/frotz` directory; however `frotz/` matches `frotz` and `a/frotz` that is a directory (all paths are relative from the `.amplifyignore` file). * An asterisk "`*`" matches anything except a slash. The character "`?`" matches any one character except "`/`". The range notation, e.g. `[a-zA-Z]`, can be used to match one of the characters in a range. Two consecutive asterisks ("`**`") in patterns matched against full pathname may have special meaning: * A leading "`*`" followed by a slash means match in all directories. For example, "`*/foo`" matches file or directory "`foo`" anywhere, the same as pattern "`foo`". "`*/foo/bar`" matches file or directory "`bar`" anywhere that is directly under directory "`foo`". * A trailing "`/**`" matches everything inside. For example, "`abc/**`" matches all files inside directory "`abc`", relative to the location of the `.gitignore` file, with infinite depth. * A slash followed by two consecutive asterisks then a slash matches zero or more directories. For example, "`a/**/b`" matches "`a/b`", "`a/x/b`", "`a/x/y/b`" and so on. * Other consecutive asterisks are considered regular asterisks and will match according to the previous rules. # GitHub Source: https://docs.amplify.security/legacy/integrations/github Secure your GitHub repositories with Amplify. ## Overview The Amplify GitHub App integrates the Amplify Security Platform with GitHub to secure your GitHub repositories and provide actionable security code fixes directly to developers in Pull Requests. The Amplify Security GitHub integration is currently in beta. Documentation and functionality may change frequently. View the Amplify Security GitHub App on the GitHub Marketplace. View the Amplify Security GitHub Action on GitHub. ## Components ### GitHub App The Amplify GitHub App installs in your GitHub organization and allows Amplify to make Requests to the GitHub API on behalf of your organization. Amplify uses these privileges to receive notifications about Pull Requests and GitHub Actions Workflows, and to commit security code fixes directly to your repositories when approved by a user. Amplify also has the ability to open Pull Requests and comment on Pull Requests to provide security feedback through the GitHub App. ### GitHub Action The Amplify GitHub Action is an action that runs configured security tools on your GitHub repository and sends security findings to the Amplify Platform. The Amplify GitHub Action is installed into the GitHub repositories added to the Github App when you approve the installation Pull Requests created by the Amplify Platform. ### Amplify Workflow The Amplify GitHub Actions Workflow is the workflow installed in any GitHub repositories added to the Amplify Platform. This Workflow runs the Amplify GitHub Action on every Pull Request and on every push to the repository's `main` or `develop` branch. ```yaml .github/workflows/amplify.yml theme={null} --- name: Amplify Security on: pull_request: {} workflow_dispatch: {} push: branches: ["main", "develop"] permissions: contents: read id-token: write jobs: amplify-security-scan: name: Amplify Security Scan runs-on: ubuntu-latest if: (github.event_name != 'pull_request' || github.repository_id == github.event.pull_request.head.repo.id) && github.actor != 'dependabot[bot]' steps: - name: Checkout uses: actions/checkout@v5 - name: Amplify Runner uses: amplify-security/runner-action@main ``` The Amplify Platform currently relies on the name of the Workflow to track and display GitHub Workflows correctly. Do not change the name of the Workflow. This restriction will be lifted soon. ## Configuration ### Scanning branches other than `main` or `develop` By default, this Amplify workflow runs on all Pull Requests and on every push to the repository's `main` or `develop` branch. To run on any additional branches, add them to the list of branches in `.github/workflows/amplify.yml`. For example, we will modify the section below to also execute on the `staging` branch. Note that the change in syntax from the above YAML is simply for readability. ```yaml .github/workflows/amplify.yml theme={null} --- name: Amplify Security on: pull_request: {} workflow_dispatch: {} push: # this is equivalent to '["main", "develop", "staging"]' branches: - main - develop - staging ``` # Hosted GitLab Source: https://docs.amplify.security/legacy/integrations/gitlab Secure your GitLab projects with Amplify. ## Overview The Amplify Security Platform integrates with GitLab's CI/CD infrastructure to secure your GitLab projects and provide actionable security code fixes directly to developers within their merge requests. The Amplify Security GitLab integration is currently in beta. Documentation and functionality may change frequently. View the Amplify Security GitLab Component on GitLab. ## Components ### GitLab Component Amplify provides a GitLab component that must be installed in a GitLab Pipeline for any GitLab projects added to the Amplify Platform. The following example pipeline configuration runs Amplify's Runner component on every merge request. Using the `main` branch will ensure you're always using the latest stable version of the component. Pre-release or experimental versions will never be in `main`. ```yaml .gitlab-ci.yml theme={null} --- stages: [test] include: - component: gitlab.com/amplify-security/components/runner@main ``` #### Specifying a component version If you want to specify a particular Amplify component version, you can use our semantic version tags instead of `main`. For example: ```yaml .gitlab-ci.yml theme={null} --- stages: [test] include: - component: gitlab.com/amplify-security/components/runner@0.1.0 ``` To find the latest tagged version, please refer to the [list of tags on GitLab](https://gitlab.com/amplify-security/components/-/tags). # Introduction Source: https://docs.amplify.security/legacy/introduction New to Amplify Security? Start here. Secure Software ## What is Amplify Security? Amplify Security is a cloud-native security platform that integrates industry leading security tools into your development workflow and provides automatically generated code fixes for security vulnerabilities. Amplify Security is currently in beta. Documentation and application functionality may change frequently. ## How Amplify secures your code Amplify Security runs configured security tools on codebases that have been added to Amplify using our [GitHub Action](https://github.com/amplify-security/runner-action) or [GitLab Component](https://gitlab.com/amplify-security/components/). Amplify notifies developers of new vulnerabilities directly in their pull/merge requests and provides code fixes when available. Official documentation for running Amplify Security on Bitbucket is coming soon! Our dedication to securing your code doesn't stop at identifying new vulnerabilities. The Amplify platform continuously runs configured security tools on your codebase and generates new code fixes as they become available for existing vulnerabilities. Once you've reviewed the available code fixes, you can open a PR to apply the fix within the Amplify platform. ## Developer first security Amplify is designed and built by developers, for developers. We're tired of security products that both get in the way and don't actually improve security just as much as you are. Our engineering team will never stop thinking about what developers actually need to develop secure code with zero reduction to velocity and without security theater. ## Core components All of the core components that you need to secure your code with Amplify are open source and available for review. View the Amplify Security GitHub App on the GitHub Marketplace. View the Amplify Security GitHub Action on GitHub. View the Amplify Security GitHub Action on GitHub. The Amplify Runner is open source and available to view on GitHub. The Amplify Runner Docker image is available on Docker Hub. Have a suggestion to improve our documentation? Contribute changes with a pull request to our [Docs](https://github.com/amplify-security/docs) repository on GitHub. # Quickstart Source: https://docs.amplify.security/legacy/quickstart Onboard your projects to Amplify in under 5 minutes. ## Overview We're going to walk you through the steps to onboard your projects to Amplify. The onboarding process is designed to be fully guided, so if you'd rather just follow along in the Amplify App and skip this guide, you can do that too. ### What to expect During onboarding you will: 1. Install the Amplify GitHub App. 2. Select which projects you want to onboard. 3. Approve the Pull Requests that Amplify will open for you in selected projects. These Pull Requests add the Amplify Security GitHub Actions Workflow. You will need permission to install a GitHub App for the organization you wish to secure with Amplify in order to complete this Quickstart guide. ## Quickstart ### Sign Up To get started, navigate to the Amplify App at or by using the Sign In button in the top right corner of this page. Sign Up Sign Up Select *Sign Up* to continue. Sign Up Providers Sign Up Providers Select *Sign up with GitHub* to continue. Support for GitLab and Bitbucket is coming soon! ### Authenticate with the Amplify GitHub App You will be redirected to GitHub to authenticate using the Amplify GitHub App. GitHub OAuth GitHub OAuth Select *Authorize Amplify* to continue. ### Install the Amplify GitHub App Once authenticated, you must install the Amplify GitHub App in the GitHub organization you want to secure with Amplify. Install App Install App Select *Redirect to GitHub to allow access to your organization* to continue. You will be redirected to GitHub. Install the GitHub Amplify App in the organization you want to secure. After installation, you will be redirected back to Amplify to continue the onboarding process. ### Accept terms & conditions You must accept the terms and conditions of the beta agreement to continue. Terms and Conditions Terms and Conditions ### Select projects to secure After authenticating with the Amplify GitHub App, you will be redirected back to the Amplify App to choose which projects you want to secure with Amplify. Select Projects Select Projects Select all projects you would like to secure with Amplify and select *Next*. ### Select security tools to run You will now be prompted to choose which security tools Amplify will run when scanning your projects. Select Tools Select Tools Select *Open Installation PRs* to continue. ### Approve installation PRs Amplify will now open Pull Requests in the selected projects to add the Amplify Security GitHub Actions workflow. You will need to approve these PRs to enable Amplify scanning in your projects. Approve PRs Approve PRs The Amplify App will automatically reflect the status of the PRs as they are merged. Merged PRs Merged PRs Select *Finish* to complete the onboarding process. # Using the Sample Repository Source: https://docs.amplify.security/legacy/sample-project Try out Amplify using our example repository with pre-existing vulnerabilities. ## Overview During setup, you may not have a vulnerable project to test Amplify with. To help you get started and quickly test out Amplify, we provide an example repository with preexisting vulnerabilities that you can add to your GitHub account. An example project based on Juice Shop, a Javascript web application for security testing. ## Usage From GitHub, go to [the new repository creation page](https://github.com/new). Under *Owner*, select the organization or user you added to Amplify, give a name to your example project, e.g. `my-vulnerable-project`, and create the repository. You can also select *Private* if you wish to keep it hidden. **For GitHub CLI users** To quickly perform this step, you can run the following command, replacing `ORGNAME`/`REPONAME` as needed: `gh repo create --private ORGNAME/REPONAME` Copy the example project and all its branches to your local machine. If using the command line, the following should suffice: ```bash theme={null} git clone --mirror https://github.com/amplify-security/amplify-example-project.git my-vulnerable-project ``` You'll now need to update your local copy of the example project to point to your own repository, and then sync your local copy to it. Using the command line, this can be done with the following commands: ```bash theme={null} cd my-vulnerable-project git remote set-url origin git@github.com:USERNAME/my-vulnerable-project.git git push --mirror origin ``` If you picked "Only select repositories" when installing the Amplify GitHub App, be sure to update the list of allowed repositories to include the new repository. [Click here for settings under your user account](https://github.com/settings/installations), otherwise go to `https://github.com/organizations/ORGNAME/settings/installations` for settings under an organization, replacing `ORGNAME` with your organization name. You can skip this if you selected "All repositories" during installation. If you're in the middle of setup, the repo should automatically show up in the list of projects to add. Otherwise, go to the *Projects* page and click *Add Project* to start the process. Visit your repository on GitHub and create a pull request or two from the example branches, such as `vulns/sql-injection`. Amplify will automatically scan the contents of your pull requests, report any vulnerabilities it finds, and provide code fixes when available. ## GitLab and Other Users If you're using GitLab or another platform, you can for the most part follow the above steps, substituting those using GitHub's web interface with the equivalent on your VCS platform. For succinctness, the following is a demonstration for GitLab, provided you've set up a new project on GitLab: ```bash theme={null} git clone --mirror https://github.com/amplify-security/amplify-example-project.git my-example-project cd my-example-project git remote set-url origin git@gitlab.com:USERNAME/my-example-project.git git push --mirror origin ```