Getting started

insecur is experimental and prelaunch. There is no public sign-up yet, and the hosted service is not approved for valuable production secrets. Local Mode runs the development loop with no account.

Installation

The insecur CLI is the supported way to work with insecur from a terminal, a coding agent, or CI. Install it with a one-line script, verify the binary, then log in.

Install on macOS or Linux

curl -fsSL https://insecur.cloud/install.sh | sh

The script it runs is install.sh; open it in your browser to read exactly what it does before piping it to a shell.

What the installer does

Install the GitHub CLI first. The insecur install scripts use gh attestation verify and refuse to install without it.

The install scripts (install.sh, install.ps1) download the platform binary, SHA256SUMS, and signed provenance bundle from the published cli-v* GitHub Release. They verify the checksum and require a valid GitHub build attestation signed by this repository's CLI release workflow. A corrupted, substituted, or unattested binary never lands on your machine.

The binary is placed in:

Platform	Install destination
macOS, Linux	`~/.local/bin`
Windows	`%LOCALAPPDATA%\insecur\bin`

Make sure the install destination is on your PATH. If insecur --version fails right after install, add the directory to PATH and open a new shell.

Installer overrides

Set these environment variables before running the script to change what gets installed and where.

Variable	Purpose
`INSECUR_CLI_VERSION`	Pin a release tag, for example `cli-v0.2.0`. Defaults to the latest release.
`INSECUR_INSTALL_DIR`	Override the install destination directory.
`INSECUR_INSTALL_BASE_URL`	Override the base URL the binary and checksums are fetched from.

Example, pinning a version and directory:

export INSECUR_CLI_VERSION=cli-v0.2.0
export INSECUR_INSTALL_DIR="$HOME/bin"
curl -fsSL https://insecur.cloud/install.sh | sh

Verify the install

Confirm the binary runs:

insecur --version

After you log in, confirm your identity and scope:

insecur whoami

whoami returns metadata only: your principal, memberships, and resolved scope. It never prints a secret value.

Crash reporting

Crash reporting is on by default for unexpected CLI failures. Reports are metadata-only: they never include your argv, environment, or any secret value. They exist to make real bugs fixable.

Turn crash reporting off in any of these ways:

insecur --no-crash-reports whoami

export INSECUR_CRASH_REPORTS=off

insecur config set crash-reports off

Next step

With the CLI installed and verified, continue to the quickstart to log in, resolve your scope, and complete your first value loop.