Rebel Verified · for developers

Don't just build it. Prove it.

Scan → fix → rescan → verified. Findings become actions; rescans prove completion.

Get a free API key — 3 scans/mo, no card GitHub Marketplace ↗

terminal

$ rebel scan ./my-repo
  ✖ 2 high   ✖ 5 medium   • 3 low
  → findings saved as actions

$ rebel scan --guided   # walk through fixes
$ rebel scan ./my-repo  # rescan
  ✔ 7 resolved · 0 new · 3 unchanged

Free API key

Start in under a minute.

Enter your email to get an API key (rbk_…). It's shown once, so copy it and store it somewhere safe, like a password manager or a GitHub secret.

or with curl

curl -X POST https://api.rebeltechlabs.io/v1/signup \
  -H "content-type: application/json" \
  -d '{"email":"you@you.com"}'

# → {"apiKey":"rbk_..."}

CLI

From terminal to verified.

The CLI runs rule checks across your repo and ranks each finding by severity. Guided mode takes you through fixes one at a time. When you rescan, Rebel Verified shows what you resolved.

cli

rebel login rbk_...        # authenticate
rebel scan ./my-repo       # severity-ranked findings
rebel scan --guided        # step-by-step guided fixes
rebel upgrade developer    # move to the Developer plan

authentication

# Authenticated requests use your account's key
Authorization: Bearer $REBEL_API_KEY

Base URL
https://api.rebeltechlabs.io

Store once. Authenticate securely.

Save the one-time key before leaving signup. Copy it into a trusted password manager. Treat it like a password: anyone with the key can make requests as your account.
Keep it out of source code. For deployed apps, use your server's secret manager. For GitHub Actions, save it as a repository or environment secret named REBEL_API_KEY and reference secrets.REBEL_API_KEY, as shown below. Never expose it in browser code, localStorage, public environment variables, URLs, screenshots or logs. If using a local .env file, exclude it from Git before adding the key; .gitignore does not remove secrets already committed.
Send it only to the API over HTTPS. Signup does not need a key. Protected endpoints use the Authorization header with Bearer followed by your key, not a query parameter. Call them from your terminal, trusted CI or server—not a public frontend.

Bash · temporary terminal session

# Paste at the hidden prompt, not into command history
read -r -s -p "Rebel API key: " REBEL_API_KEY
printf '\n'
export REBEL_API_KEY

# Run requests or authenticate the CLI in this session
rebel login "$REBEL_API_KEY"

# Clear the session variable when finished
unset REBEL_API_KEY

authenticated request · before clearing the variable

curl -X POST https://api.rebeltechlabs.io/v1/badge \
  -H "Authorization: Bearer $REBEL_API_KEY" \
  -H "content-type: application/json" \
  -d '{"repo":"owner/name"}'

Use a trusted machine: environment variables and command arguments are not a secret vault. Avoid shell tracing (set -x), curl verbose/trace output and CI debugging that could reveal headers. Clearing the variable does not remove credentials saved by CLI login. If a key is exposed, treat it as compromised and arrange revocation and replacement before using a new key; deleting the visible copy is not enough.

Verification API

Rebel Verified API endpoints
Method	Endpoint	What it does
POST	/v1/scans	Body {repo}. Returns finding fingerprints and severity-ranked findings.
POST	/v1/scans/:id/rescan	Classifies each finding as resolved, new or unchanged, and marks the scan verified when nothing remains.
POST	/v1/scans/:a/compare/:b	Diff between two scans.
POST	/v1/fixes	Creates a fix preview for review.
POST	/v1/fixes/:id/approve	After approval, opens a real fix pull request on your repo.
POST	/v1/badge	Body {repo}. Returns a badgeUrl (SVG) for your README.

Every fix pull request is previewed and needs your approval before it opens. How much of a fix is automated depends on the rule; review each PR before merging.

GitHub Action

Verification on every pull request.

Add your key as a repository secret named REBEL_API_KEY. The Action reports findings as workflow annotations and fails the check when findings remain.

View Action repo ↗GitHub Marketplace ↗

.github/workflows/rebel-verified.yml

name: Rebel Verified
on: [pull_request]
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: RebelTechLabsInc/rebel-verified-action@v1
        with:
          api-key: ${{ secrets.REBEL_API_KEY }}

Verified badge

Show it in your README.

Request a badge for your repo and paste the SVG link into your README. It starts as pending, then shows your open findings, and changes to verified when a rescan comes back clean.

badge

curl -X POST https://api.rebeltechlabs.io/v1/badge \
  -H "Authorization: Bearer $REBEL_API_KEY" \
  -H "content-type: application/json" \
  -d '{"repo":"owner/name"}'

# → {"badgeUrl":"https://…/badge.svg"}
# README: ![Rebel Verified](badgeUrl)

Pricing

Start free. Scale when you're ready.

All prices in USD per month.

Free

$0/mo

3 scans / month

No card required

Developer

$29/mo

25 scans / month

Fix previews, fix PRs, scan compare

Team

$99/mo

150 scans / month

Deeper scan layers

Business

$299/mo

500 scans / month

Overage pricing

Already scanning? Scan history, comparisons and upgrades are in your dashboard.

Open dashboard ↗

Found a bug?

Include what happened, what you expected and steps to reproduce. Remove API keys, credentials and private code from your report.

Submit a Bug