Security Hub
A terminal-driven security command center for running static analysis, dependency audits, secret scans, and full security sweeps — all from a single command-line interface with structured block output.
Overview
Security Hub is TotalApp's primary interactive security terminal. It renders every result as a structured block — summary line at the top, expandable steps below — so you always see what ran, what passed, and what needs attention without scrolling through raw terminal noise.
Security Hub shares the same terminal infrastructure as Dev Hub Terminal. Commands are parsed and dispatched to security-specific handlers; output is rendered using RunBlock, PipeBlock, and SelectBlock components for a consistent experience.
Terminal vs Audit
Security Hub is the command interface — you type commands, results appear in structured blocks. Security Audit is the log viewer — it shows the history of all past scans with filtering and detail panels. Use both together: run scans in Security Hub, review history in Security Audit.
Quick Start
- Switch to Security mode from the header mode switcher, or enable Security Hub via Settings → App Modes → Manage Screens.
- Click Security Hub in the sidebar.
- Type a command in the input at the bottom of the terminal and press Enter.
- Results appear as a structured block. Click any step row to expand its detail output.
# Runs SAST-style analysis on the target file
Commands
| Command | Description | Block type |
|---|---|---|
security-analysis <file> | Static analysis on a single file — checks for injection vectors, insecure patterns, hardcoded credentials | RunBlock |
full-audit | Project-wide security sweep: SAST, dependency CVE check, secret scan, and header analysis in one pipeline | PipeBlock |
check-dependencies | Scan the current project's dependency manifest for known CVEs (npm, pip, cargo) | RunBlock |
scan-secrets <path> | Search for accidentally committed secrets, API keys, and tokens in the given path | RunBlock |
check-headers <url> | Fetch the URL and validate HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) | RunBlock |
analyze-permissions <file> | Review IAM or permission definitions in the target file for privilege escalation paths | RunBlock |
run-pentest-sim <target> | Simulated penetration test steps against the target — safe, no real payloads sent | PipeBlock |
help | List all available Security Hub commands | TextBlock |
clear | Clear the terminal output | — |
Pipeline commands
Prefix any command with pipe to chain it with the previous result:
Command history
Use ↑ / ↓ arrow keys to navigate command history. History is preserved for the current session.
Block Output Types
RunBlock
Multi-step sequential scan. Each step shows a status icon (pending → running → done / error) and can be expanded to show its raw output. The overall status banner rolls up all step results.
PipeBlock
Chained pipeline of multiple scans. Steps execute in sequence and output flows from one stage to the next. Used for full-audit and run-pentest-sim.
SelectBlock
Interactive menu that appears mid-command when Security Hub needs you to choose a scan profile, target environment, or severity threshold before continuing.
TextBlock
Plain text output for informational commands like help and simple one-shot queries that don't produce structured scan data.
UI Walkthrough
Terminal area
The main body of Security Hub is a scrollable block list. Each scan result appears as a card with:
- A status banner (green = all passed, red = findings detected) at the top of the block.
- Step rows showing individual check names, statuses, and duration.
- An expand arrow on each step row to reveal raw output.
- A copy button (icon-only, top-right) to copy the full block output to clipboard.
Input bar
The input bar sits pinned to the bottom of the screen. It shows the current prompt symbol (sec$), a text input, and a Run button. Press Enter or click Run to execute.
Abort
While a scan is running, the Run button changes to an Abort button. Click it to cancel the in-progress scan cleanly.
Settings
- Terminal font size — Adjust in Settings → Terminal → Font size.
- Compact block view — Collapse step details by default in Settings → Terminal → Block behaviour → Compact mode.
- AI engine — Security Hub's AI-assisted analysis commands route through your selected writer engine (Settings → Terminal → Writer Engine).
AI Assistant
Alongside the terminal, the Workflow Analysis tab of Security Hub shows an overview panel with an overall security score, a threat severity breakdown, and prioritized recommendations. Click the vertical AI Assistant tab on the right edge of the screen (or the Sparkles toggle) to open a chat panel that reads this overview data. Because it's a score/KPI panel rather than a record list, the assistant is scoped to dashboard-style capabilities only — it narrates and explains the numbers already shown, it does not run scans or edit findings (use terminal commands like full-audit for that):
- Executive summary — a plain-language readout of the overall score, grade, and the most urgent open findings by name.
- Root cause & anomaly detection — when a sub-score (code, AI I/O, dependency) is dragging down the overall score, the assistant explains which findings in that category are responsible.
- Recommendations — prioritizes the open findings into a concrete action plan (fix critical first, then high), referencing the actual recommendation text and locations.
Every reply can be saved with the Save as Report button, which stores it in My Reports under a title derived from your question and the current month/year. The panel respects the Writer Engine selected in Settings → Agentic (Local CLI, Hosted API, Local LLM, or Ollama) — Ollama and other local/in-browser engines run entirely on your own machine and never proxy through the server.
FAQ
full-audit runs all major checks in a single PipeBlock pipeline — SAST, dependency CVE, secret scan, and header validation. Individual commands let you focus on one check type at a time, which is faster when you know exactly what you're looking for.full-audit, scan-secrets) to actually run a scan.