> ## Documentation Index
> Fetch the complete documentation index at: https://docs.githits.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Scan

> Install githits-scan with Homebrew on macOS or Linux, or use prebuilt binaries or Cargo. Set an API token and preview your package files.

Install `githits-scan` to scan a repository from your terminal or CI. On macOS and Linux, use [Homebrew](#install-with-homebrew). On Windows, [download a prebuilt binary](#prebuilt-binaries) or [install with Cargo](#install-with-cargo).

You can also use prebuilt binaries or Cargo on macOS and Linux. For CI, use a [pinned version](https://docs.githits.com/scan/ci.md).

Scan is **Alpha**. These pages cover version 0.3.0.

## Install with Homebrew

On macOS or Linux, [install Homebrew](https://brew.sh) if you don't already have it, then run:

```bash theme={null}
brew install githits-com/tap/githits-scan
```

Homebrew provides prebuilt packages for macOS 15 on Apple Silicon and Linux x86\_64/ARM64. If a prebuilt package isn't available for your system, including Intel Macs, Homebrew builds Scan from source and installs the required build dependencies.

## Prebuilt binaries

1. Download your archive and `SHA256SUMS` from the same [v0.3.0 GitHub release](https://github.com/githits-com/githits-scan/releases/tag/v0.3.0).
2. Check the archive's checksum using the commands below.
3. Extract the archive and put `githits-scan` (or `githits-scan.exe`) in a directory on `PATH`.

| Operating system | Architecture | Archive |
| - | - | - |
| Linux | x86\_64 | [Download `.tar.gz`](https://github.com/githits-com/githits-scan/releases/download/v0.3.0/githits-scan-v0.3.0-x86_64-unknown-linux-gnu.tar.gz) |
| Linux | ARM64 | [Download `.tar.gz`](https://github.com/githits-com/githits-scan/releases/download/v0.3.0/githits-scan-v0.3.0-aarch64-unknown-linux-gnu.tar.gz) |
| macOS | Intel | [Download `.tar.gz`](https://github.com/githits-com/githits-scan/releases/download/v0.3.0/githits-scan-v0.3.0-x86_64-apple-darwin.tar.gz) |
| macOS | Apple Silicon | [Download `.tar.gz`](https://github.com/githits-com/githits-scan/releases/download/v0.3.0/githits-scan-v0.3.0-aarch64-apple-darwin.tar.gz) |
| Windows | x86\_64 | [Download `.zip`](https://github.com/githits-com/githits-scan/releases/download/v0.3.0/githits-scan-v0.3.0-x86_64-pc-windows-msvc.zip) |

Run the checksum command in the directory containing both downloads:

```bash Linux theme={null}
sha256sum --check --ignore-missing SHA256SUMS
```

```bash macOS theme={null}
shasum -a 256 --check --ignore-missing SHA256SUMS
```

```powershell Windows theme={null}
Get-FileHash -Algorithm SHA256 .\githits-scan-v0.3.0-x86_64-pc-windows-msvc.zip
```

On Linux and macOS, confirm that your archive is marked `OK`. On Windows, compare the hash with the matching archive entry in `SHA256SUMS`. Extract the archive after the checksum matches.

The binaries are built on Ubuntu 24.04, macOS 15, and Windows Server 2025. Older systems are not tested.

## Install with Cargo

You need Rust 1.99 or newer. Install the latest published version from [crates.io](https://crates.io/crates/githits-scan):

```bash theme={null}
cargo install githits-scan --locked
```

For a reproducible installation, pin the version:

```bash theme={null}
cargo install githits-scan --version 0.3.0 --locked
```

## Check the installation

After installing, run:

```bash theme={null}
githits-scan --version
```

For the pinned 0.3.0 release, the expected output is `githits-scan 0.3.0`. From your repository root, preview the package files Scan would upload:

```bash theme={null}
githits-scan detect
```

This step stays local and needs no token. Review the selection and the [upload privacy guidance](https://docs.githits.com/scan/overview.md#review-what-you-upload) before running an online analysis.

## Set up authentication

Sign in or create an account at [app.githits.com](https://app.githits.com). Create an API token in [Settings → Tokens](https://app.githits.com/settings/tokens), then set `GITHITS_API_TOKEN` in the shell that will run Scan.

In **Bash**, read the token without putting it in shell history. Keep shell tracing (`set -x`) disabled:

```bash theme={null}
printf 'GitHits API token: '
read -r -s GITHITS_API_TOKEN
printf '\n'
export GITHITS_API_TOKEN
```

Online commands read the token from `GITHITS_API_TOKEN`. Scan does not run credential commands or read the `githits` CLI's stored login.

In CI, inject the variable from your secret store. See [API authentication](https://docs.githits.com/api/authentication.md) for account and token guidance, and [Scan in CI](https://docs.githits.com/scan/ci.md) for a workflow. Local `detect` and [offline replay](https://docs.githits.com/scan/commands.md#offline-replay) need no token.

Next, [generate an SBOM, audit dependencies, or report licenses](https://docs.githits.com/scan/overview.md#start-with-a-local-preview).

## Uninstall

For a Homebrew installation:

```bash theme={null}
brew uninstall githits-scan
```

For a Cargo installation:

```bash theme={null}
cargo uninstall githits-scan
```

For an extracted binary, remove the executable you put on `PATH`. Scan has no daemon or installed background service.

Uninstalling leaves generated reports and repository configuration in place. Remove those separately if you no longer need them. Unset `GITHITS_API_TOKEN` in your shell or CI configuration, and revoke unused tokens in [token settings](https://app.githits.com/settings/tokens).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.