reflex-hosting-cli 0.1.66__tar.gz → 0.1.67a2__tar.gz

{reflex_hosting_cli-0.1.66 → reflex_hosting_cli-0.1.67a2}/.gitignore

@@ -1,5 +1,10 @@
 **/.DS_Store
 **/*.pyc
+**/__pycache__/
+.pytest_cache/
+.ruff_cache/
+**/.ruff_cache/
+.mypy_cache/
 assets/external/*
 dist/*
 examples/
@@ -21,4 +26,7 @@ reflex.db
 node_modules
 package-lock.json
 *.pyi
-.pre-commit-config.yaml
+.pre-commit-config.yaml
+.claude/.worktrees
+.claude/settings.local.json
+CLAUDE.local.md

{reflex_hosting_cli-0.1.66 → reflex_hosting_cli-0.1.67a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: reflex-hosting-cli
-Version: 0.1.66
+Version: 0.1.67a2
 Summary: Reflex Hosting CLI
 Author-email: Nikhil Rao <nikhil@reflex.dev>, Alek Petuskey <alek@reflex.dev>
 Maintainer-email: Simon Young <simon@reflex.dev>, Khaleel Al-Adhami <khaleel@reflex.dev>

reflex_hosting_cli-0.1.67a2/news/6556.feature.md

@@ -0,0 +1 @@
+Added a `--service-account` flag to `reflex deploy --gcp`, letting Cloud Run services run as a least-privilege per-service service account instead of the project's default compute SA.

reflex_hosting_cli-0.1.67a2/news/6557.feature.md

@@ -0,0 +1 @@
+Added `--max-instances`, `--allow-unauthenticated/--no-allow-unauthenticated`, `--env KEY=VALUE`, and `--envfile` flags to `reflex deploy --gcp`, letting you cap Cloud Run autoscaling, deploy a private service, and set environment variables at deploy time.

reflex_hosting_cli-0.1.67a2/news/6632.feature.md

@@ -0,0 +1 @@
+Added `reflex cloud scan`, which uploads your app source for a Reflex-aware security review and reports security and logic flaws. Supports `--json` output and a `--fail-on` severity gate for CI.

{reflex_hosting_cli-0.1.66 → reflex_hosting_cli-0.1.67a2}/src/reflex_cli/utils/hosting.py

@@ -1456,6 +1456,135 @@ def create_deployment(
     return response.json()
 
 
+class SecurityReviewError(ResponseError):
+    """Raised when a security review request fails."""
+
+
+_SECURITY_REVIEW_PREFIX = "/api/v1/agents/security-review"
+
+
+def _security_review_detail(response: Any) -> str:
+    """Extract a human-readable ``detail`` from a failed review response.
+
+    Args:
+        response: The error response from the security review API.
+
+    Returns:
+        The server-provided detail, or a generic fallback if the body is not
+        a JSON object with a ``detail`` field.
+
+    """
+    try:
+        return str(response.json()["detail"])
+    except (ValueError, TypeError, KeyError):
+        return "internal server error"
+
+
+def submit_security_review(zip_bytes: bytes, client: AuthenticatedClient) -> str:
+    """Submit a zipped app for security review.
+
+    Uploads the archive straight to object storage via a presigned URL, then
+    submits the stored object for review.
+
+    Args:
+        zip_bytes: The zipped app source to review.
+        client: The authenticated client.
+
+    Returns:
+        The id of the submitted job, to be polled with ``get_security_review``.
+
+    Raises:
+        NotAuthenticatedError: If the token is not valid.
+        SecurityReviewError: If any step of the submission fails.
+
+    """
+    import httpx
+
+    if not isinstance(client, AuthenticatedClient):
+        raise NotAuthenticatedError("not authenticated")
+
+    auth = authorization_header(client.token)
+
+    # 1. Ask the API for a presigned URL to upload the archive directly.
+    upload_url_response = httpx.post(
+        urljoin(
+            constants.Hosting.HOSTING_SERVICE,
+            f"{_SECURITY_REVIEW_PREFIX}/jobs/upload-url",
+        ),
+        json={"content_length": len(zip_bytes), "content_type": "application/zip"},
+        headers=auth,
+        timeout=constants.Hosting.TIMEOUT,
+    )
+    try:
+        upload_url_response.raise_for_status()
+    except httpx.HTTPStatusError as ex:
+        raise SecurityReviewError(_security_review_detail(ex.response)) from ex
+    upload = upload_url_response.json()
+
+    # 2. Upload the bytes to storage. The presigned URL pins the content length
+    #    and type, so send the returned headers verbatim and let httpx derive
+    #    Content-Length from the body — setting it manually breaks the signature.
+    put_response = httpx.put(
+        upload["url"],
+        content=zip_bytes,
+        headers=upload.get("headers", {}),
+        timeout=120,
+    )
+    try:
+        put_response.raise_for_status()
+    except httpx.HTTPStatusError as ex:
+        raise SecurityReviewError("failed to upload app source for review") from ex
+
+    # 3. Submit the uploaded object for review.
+    response = httpx.post(
+        urljoin(constants.Hosting.HOSTING_SERVICE, f"{_SECURITY_REVIEW_PREFIX}/jobs"),
+        json={"key": upload["key"]},
+        headers=auth,
+        timeout=constants.Hosting.TIMEOUT,
+    )
+    try:
+        response.raise_for_status()
+    except httpx.HTTPStatusError as ex:
+        raise SecurityReviewError(_security_review_detail(ex.response)) from ex
+    return response.json()["job_id"]
+
+
+def get_security_review(job_id: str, client: AuthenticatedClient) -> dict[str, Any]:
+    """Poll a previously submitted security review job.
+
+    Args:
+        job_id: The id returned by ``submit_security_review``.
+        client: The authenticated client.
+
+    Returns:
+        The job status payload: ``status`` is one of ``pending``, ``complete``
+        or ``error``; ``result`` holds the review once ``complete``.
+
+    Raises:
+        NotAuthenticatedError: If the token is not valid.
+        SecurityReviewError: If the server returns an error.
+
+    """
+    import httpx
+
+    if not isinstance(client, AuthenticatedClient):
+        raise NotAuthenticatedError("not authenticated")
+
+    response = httpx.get(
+        urljoin(
+            constants.Hosting.HOSTING_SERVICE,
+            f"{_SECURITY_REVIEW_PREFIX}/jobs/{job_id}",
+        ),
+        headers=authorization_header(client.token),
+        timeout=constants.Hosting.TIMEOUT,
+    )
+    try:
+        response.raise_for_status()
+    except httpx.HTTPStatusError as ex:
+        raise SecurityReviewError(_security_review_detail(ex.response)) from ex
+    return response.json()
+
+
 def stop_app(app_id: str, client: AuthenticatedClient):
     """Stop a running application.
 

{reflex_hosting_cli-0.1.66 → reflex_hosting_cli-0.1.67a2}/src/reflex_cli/v2/deployments.py

@@ -14,6 +14,7 @@ from reflex_cli.utils import console
 from reflex_cli.v2.apps import apps_cli
 from reflex_cli.v2.gcp import deploy_command as gcp_deploy_command
 from reflex_cli.v2.project import project_cli
+from reflex_cli.v2.scan import scan_command
 from reflex_cli.v2.secrets import secrets_cli
 from reflex_cli.v2.vmtypes_regions import vm_types_regions_cli
 
@@ -69,6 +70,10 @@ hosting_cli.add_command(
     gcp_deploy_command,
     name="deploy",
 )
+hosting_cli.add_command(
+    scan_command,
+    name="scan",
+)
 for name, command in vm_types_regions_cli.commands.items():
     # Add the command to the hosting CLI
     hosting_cli.add_command(command, name=name)

{reflex_hosting_cli-0.1.66 → reflex_hosting_cli-0.1.67a2}/src/reflex_cli/v2/gcp.py

@@ -7,12 +7,15 @@ referenced with ``gcloud builds submit --config=...``) — the user's project
 tree is never modified. The script reads its parameters from environment
 variables (GCP_PROJECT, GCP_REGION, SERVICE_NAME, AR_REPO, VERSION,
 CLOUD_RUN_CPU, CLOUD_RUN_MEMORY, CLOUD_RUN_MIN_INSTANCES,
-REFLEX_CLOUDBUILD_YAML).
+CLOUD_RUN_MAX_INSTANCES, CLOUD_RUN_ALLOW_UNAUTHENTICATED,
+CLOUD_RUN_SERVICE_ACCOUNT, REFLEX_CLOUDBUILD_YAML,
+REFLEX_ENV_VARS_FILE).
 """
 
 from __future__ import annotations
 
 import contextlib
+import json
 import os
 import re
 import shutil
@@ -41,9 +44,15 @@ ENV_VERSION = "VERSION"
 ENV_CPU = "CLOUD_RUN_CPU"
 ENV_MEMORY = "CLOUD_RUN_MEMORY"
 ENV_MIN_INSTANCES = "CLOUD_RUN_MIN_INSTANCES"
+ENV_MAX_INSTANCES = "CLOUD_RUN_MAX_INSTANCES"
+ENV_ALLOW_UNAUTHENTICATED = "CLOUD_RUN_ALLOW_UNAUTHENTICATED"
+ENV_SERVICE_ACCOUNT = "CLOUD_RUN_SERVICE_ACCOUNT"
 # Path to the Cloud Build config file written by the CLI. The rewritten
 # deploy script references it as ``--config="${REFLEX_CLOUDBUILD_YAML}"``.
 ENV_REFLEX_CLOUDBUILD_YAML = "REFLEX_CLOUDBUILD_YAML"
+# Path to a YAML file with user-supplied env vars. When set, the deploy
+# script passes it to ``gcloud run deploy --env-vars-file=...``.
+ENV_REFLEX_ENV_VARS_FILE = "REFLEX_ENV_VARS_FILE"
 
 # Pattern for the start of the `gcloud builds submit` invocation in the
 # Reflex deploy script. We rewrite that whole multi-line command to use
@@ -162,6 +171,38 @@ DEPLOY_ENV_ALLOWLIST = frozenset({
     type=click.IntRange(min=0),
     help="Minimum number of Cloud Run instances to keep warm (sets CLOUD_RUN_MIN_INSTANCES). Set to 0 to scale to zero.",
 )
+@click.option(
+    "--max-instances",
+    "max_instances",
+    default=100,
+    show_default=True,
+    type=click.IntRange(min=1),
+    help="Maximum number of Cloud Run instances during autoscaling (sets CLOUD_RUN_MAX_INSTANCES). Caps cost under traffic spikes.",
+)
+@click.option(
+    "--allow-unauthenticated/--no-allow-unauthenticated",
+    "allow_unauthenticated",
+    default=True,
+    show_default=True,
+    help="Whether to make the Cloud Run service publicly reachable (sets CLOUD_RUN_ALLOW_UNAUTHENTICATED). Use --no-allow-unauthenticated for internal / IAP-fronted services; callers will then need a roles/run.invoker IAM binding.",
+)
+@click.option(
+    "--service-account",
+    "service_account",
+    default=None,
+    help="IAM service account email the Cloud Run service runs as (sets CLOUD_RUN_SERVICE_ACCOUNT). If omitted, Cloud Run uses the project's default compute SA. The deploying principal needs roles/iam.serviceAccountUser on the target SA.",
+)
+@click.option(
+    "--envfile",
+    default=None,
+    help="Path to a .env file. Loaded into the Cloud Run service as env vars. Takes precedence over --env.",
+)
+@click.option(
+    "--env",
+    "envs",
+    multiple=True,
+    help="Environment variable to set on the Cloud Run service: <key>=<value>. Repeat for multiple, e.g. --env K1=V1 --env K2=V2. Plain Cloud Run env vars — visible to anyone with roles/run.viewer; for sensitive values use Secret Manager separately.",
+)
 @click.option(
     "--source",
     "source_dir",
@@ -199,6 +240,11 @@ def deploy_command(
     cpu: str,
     memory: str,
     min_instances: int,
+    max_instances: int,
+    allow_unauthenticated: bool,
+    service_account: str | None,
+    envfile: str | None,
+    envs: tuple[str, ...],
     source_dir: str,
     token: str | None,
     interactive: bool,
@@ -226,6 +272,13 @@ def deploy_command(
     if not gcp_project:
         console.error("--gcp-project is required when using --gcp.")
         raise click.exceptions.Exit(2)
+    if max_instances < min_instances:
+        console.error(
+            f"--max-instances ({max_instances}) must be >= --min-instances ({min_instances})."
+        )
+        raise click.exceptions.Exit(2)
+
+    parsed_envs = _parse_envs(envfile=envfile, envs=envs)
 
     authenticated_client = hosting.get_authenticated_client(
         token=token, interactive=interactive
@@ -262,6 +315,21 @@ def deploy_command(
 
     dockerfile, deploy_script = _request_manifest(authenticated_client.token)
 
+    # If the user asks for a private service, abort when the fetched script
+    # doesn't reference CLOUD_RUN_ALLOW_UNAUTHENTICATED. Without that backend
+    # support the deploy would silently use the script's hard-coded
+    # --allow-unauthenticated, producing a public service when the user
+    # explicitly asked for a private one — a silent privacy flip we'd rather
+    # fail loud on.
+    if not allow_unauthenticated and ENV_ALLOW_UNAUTHENTICATED not in deploy_script:
+        console.error(
+            "The Reflex backend's deploy script doesn't yet recognize "
+            f"{ENV_ALLOW_UNAUTHENTICATED} — without it, --no-allow-unauthenticated "
+            "would be silently ignored and the service would deploy as PUBLIC. "
+            "Upgrade the Reflex backend, or remove --no-allow-unauthenticated."
+        )
+        raise click.exceptions.Exit(1)
+
     source_path = Path(source_dir).resolve()
     if not source_path.is_dir():
         console.error(f"Source directory does not exist: {source_path}")
@@ -284,7 +352,14 @@ def deploy_command(
         ENV_CPU: cpu,
         ENV_MEMORY: memory,
         ENV_MIN_INSTANCES: str(min_instances),
+        ENV_MAX_INSTANCES: str(max_instances),
+        ENV_ALLOW_UNAUTHENTICATED: "true" if allow_unauthenticated else "false",
     }
+    if service_account is not None:
+        if not service_account:
+            console.error("--service-account cannot be an empty string.")
+            raise click.exceptions.Exit(2)
+        deploy_env[ENV_SERVICE_ACCOUNT] = service_account
 
     console.info("Received deploy manifest from Reflex.")
     console.print("")
@@ -306,6 +381,8 @@ def deploy_command(
         "tempfile; your source directory is not modified."
     )
 
+    env_vars_yaml = _format_env_vars_yaml(parsed_envs) if parsed_envs else None
+
     if dry_run:
         console.print("")
         console.print("cloudbuild.yaml contents:")
@@ -317,6 +394,12 @@ def deploy_command(
         console.print("─" * 60)
         console.print(dockerfile)
         console.print("─" * 60)
+        if env_vars_yaml is not None:
+            console.print("")
+            console.print(f"env-vars file contents ({len(parsed_envs)} variable(s)):")
+            console.print("─" * 60)
+            console.print(env_vars_yaml)
+            console.print("─" * 60)
         console.info("Dry run — nothing staged or executed.")
         return
 
@@ -328,15 +411,21 @@ def deploy_command(
             console.warn("Aborted by user.")
             raise click.exceptions.Exit(1)
 
-    with _temp_cloudbuild_yaml(cloudbuild_yaml) as cloudbuild_path:
+    with contextlib.ExitStack() as stack:
+        cloudbuild_path = stack.enter_context(_temp_cloudbuild_yaml(cloudbuild_yaml))
+        env_overrides = {
+            **deploy_env,
+            ENV_REFLEX_CLOUDBUILD_YAML: str(cloudbuild_path),
+        }
+        if env_vars_yaml is not None:
+            env_vars_path = stack.enter_context(_temp_env_vars_yaml(env_vars_yaml))
+            env_overrides[ENV_REFLEX_ENV_VARS_FILE] = str(env_vars_path)
+
         exit_code = _run_deploy_script(
             bash_path=bash_path,
             script=deploy_script,
             cwd=source_path,
-            env_overrides={
-                **deploy_env,
-                ENV_REFLEX_CLOUDBUILD_YAML: str(cloudbuild_path),
-            },
+            env_overrides=env_overrides,
         )
     if exit_code != 0:
         console.error(f"Deploy script exited with status {exit_code}.")
@@ -563,6 +652,85 @@ def _temp_cloudbuild_yaml(contents: str):
             path.unlink()
 
 
+@contextlib.contextmanager
+def _temp_env_vars_yaml(contents: str):
+    """Write the env-vars YAML to a tempfile and yield its path; always clean up.
+
+    Args:
+        contents: The YAML body to write (one ``KEY: "value"`` line per env var).
+
+    Yields:
+        The path to the written tempfile.
+
+    """
+    fd, path_str = tempfile.mkstemp(prefix="reflex-env-vars-", suffix=".yaml")
+    path = Path(path_str)
+    try:
+        with os.fdopen(fd, "w") as fh:
+            fh.write(contents)
+        yield path
+    finally:
+        with contextlib.suppress(FileNotFoundError):
+            path.unlink()
+
+
+def _parse_envs(envfile: str | None, envs: tuple[str, ...]) -> dict[str, str]:
+    """Resolve --envfile + --env into a single dict of env vars.
+
+    Mirrors the precedence of the existing `reflex deploy` / `reflex secrets
+    update` flow: when both are provided, --envfile wins and --env is
+    discarded with a warning. Empty values are preserved as empty strings;
+    keys defined without a value in the envfile (``FOO`` with no ``=``)
+    become empty strings rather than ``None``.
+
+    Args:
+        envfile: Path to a .env file, or None.
+        envs: Tuple of ``KEY=VALUE`` strings from repeated --env flags.
+
+    Returns:
+        Dict of env var name → string value. Empty when neither input is set.
+
+    """
+    from reflex_cli.utils import hosting
+
+    if envfile and envs:
+        console.warn("--envfile is set; ignoring --env")
+
+    if envfile:
+        try:
+            from dotenv import dotenv_values  # pyright: ignore[reportMissingImports]
+        except ImportError:
+            console.error(
+                'The `python-dotenv` package is required for --envfile. Run `pip install "python-dotenv>=1.0.1"`.'
+            )
+            raise click.exceptions.Exit(1) from None
+        return {
+            k: (v if v is not None else "") for k, v in dotenv_values(envfile).items()
+        }
+
+    if envs:
+        return hosting.process_envs(list(envs))
+
+    return {}
+
+
+def _format_env_vars_yaml(envs: dict[str, str]) -> str:
+    """Format env vars as YAML for gcloud ``--env-vars-file``.
+
+    Uses ``json.dumps`` per value so any string — quotes, backslashes,
+    newlines, unicode — is encoded safely. JSON strings are valid YAML, so
+    the output round-trips through gcloud's YAML loader.
+
+    Args:
+        envs: Dict of env var name → string value.
+
+    Returns:
+        YAML body with one ``KEY: "value"`` line per env var.
+
+    """
+    return "".join(f"{k}: {json.dumps(v)}\n" for k, v in envs.items())
+
+
 def _run_deploy_script(
     bash_path: str,
     script: str,

reflex_hosting_cli-0.1.67a2/src/reflex_cli/v2/scan.py

@@ -0,0 +1,262 @@
+"""The `reflex cloud scan` command: a Reflex-aware security review."""
+
+from __future__ import annotations
+
+import io
+import json
+import os
+import time
+import zipfile
+from pathlib import Path
+from typing import Any
+
+import click
+
+from reflex_cli import constants
+from reflex_cli.utils import console
+from reflex_cli.utils.exceptions import NotAuthenticatedError
+
+# Directory names whose contents are dependencies or build artifacts, never
+# app source. Mirrors the server-side code-map loader so the upload stays
+# small instead of shipping bytes the reviewer will discard.
+_SKIP_DIRS = frozenset({
+    ".git",
+    ".mypy_cache",
+    ".next",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".venv",
+    ".web",
+    "__pycache__",
+    "build",
+    "dist",
+    "node_modules",
+    "venv",
+})
+
+# The reviewer skips files larger than this, so there is no point uploading
+# them. Matches the server's per-file cap.
+_MAX_FILE_BYTES = 1_000_000
+# The submission endpoint rejects archives above this size.
+_MAX_ZIP_BYTES = 50 * 1024 * 1024
+
+_POLL_INTERVAL_SECONDS = 3.0
+_POLL_TIMEOUT_SECONDS = 600.0
+
+# Severities ordered from most to least serious, for sorting and gating.
+_SEVERITY_ORDER = ("critical", "high", "medium", "low")
+_SEVERITY_RANK = {severity: rank for rank, severity in enumerate(_SEVERITY_ORDER)}
+# Rich styles for the severity badge — a bold, padded, reverse-video label so
+# findings stand out at a glance.
+_SEVERITY_STYLE = {
+    "critical": "bold white on red",
+    "high": "bold red",
+    "medium": "bold yellow",
+    "low": "bold cyan",
+}
+
+
+def _zip_app_source(directory: Path) -> bytes:
+    """Zip the app source under ``directory`` for security review.
+
+    Args:
+        directory: The app root to scan.
+
+    Returns:
+        The zipped source as bytes.
+
+    Raises:
+        Exit: If no reviewable files are found or the archive is too large.
+
+    """
+    buffer = io.BytesIO()
+    file_count = 0
+    with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED) as archive:
+        for root, dirs, files in os.walk(directory):
+            # Prune skip dirs in place so os.walk never descends into them —
+            # node_modules/.web alone hold tens of thousands of files.
+            dirs[:] = [name for name in dirs if name not in _SKIP_DIRS]
+            root_path = Path(root)
+            for name in files:
+                path = root_path / name
+                if not path.is_file():
+                    continue
+                if path.stat().st_size > _MAX_FILE_BYTES:
+                    continue
+                archive.write(path, path.relative_to(directory).as_posix())
+                file_count += 1
+
+    if not file_count:
+        console.error(f"No reviewable source files found in {directory}.")
+        raise click.exceptions.Exit(1)
+
+    data = buffer.getvalue()
+    if len(data) > _MAX_ZIP_BYTES:
+        console.error(
+            f"Project source is too large to scan (over {_MAX_ZIP_BYTES // (1024 * 1024)} MB). "
+            "Remove large files or move them into an ignored directory."
+        )
+        raise click.exceptions.Exit(1)
+    return data
+
+
+def _print_violations(result: dict[str, Any]) -> None:
+    """Render a security review result to the console.
+
+    Args:
+        result: The ``SecurityReviewResult`` payload from the server.
+
+    """
+    from rich.markup import escape
+
+    # Disable Rich's auto-highlighter throughout so only the explicit styles
+    # below apply — otherwise it recolours line numbers, paths and punctuation.
+    violations = result.get("violations", [])
+    summary = result.get("summary")
+    if summary:
+        console.print(f"[bold]Summary:[/bold] {escape(summary)}", highlight=False)
+
+    if not violations:
+        console.success("No issues found.")
+        return
+
+    console.rule("[bold]Security review findings[/bold]")
+    for violation in sorted(
+        violations,
+        key=lambda item: _SEVERITY_RANK.get(
+            item.get("severity", "low"), len(_SEVERITY_ORDER)
+        ),
+    ):
+        severity = violation.get("severity", "low")
+        style = _SEVERITY_STYLE.get(severity, "bold")
+        location = violation.get("file_path", "?")
+        if violation.get("line") is not None:
+            location = f"{location}:{violation['line']}"
+        console.print(
+            f"[{style}] {escape(severity.upper())} [/] "
+            f"[bold cyan]{escape(violation.get('rule_id', ''))}[/bold cyan] "
+            f"[dim]({escape(violation.get('category', ''))})[/dim]  "
+            f"[dim underline]{escape(location)}[/dim underline]",
+            highlight=False,
+        )
+        console.print(f"  {escape(violation.get('message', ''))}", highlight=False)
+        if recommendation := violation.get("recommendation"):
+            console.print(
+                f"  [green]Fix:[/green] {escape(recommendation)}", highlight=False
+            )
+        console.print("")
+
+    # Colour the tally by the worst severity present (there is at least one).
+    worst = min(
+        _SEVERITY_RANK.get(v.get("severity", "low"), len(_SEVERITY_ORDER) - 1)
+        for v in violations
+    )
+    count_style = _SEVERITY_STYLE[_SEVERITY_ORDER[worst]]
+    console.print(
+        f"[{count_style}] Found {len(violations)} issue(s). [/]", highlight=False
+    )
+
+
+@click.command(name="scan")
+@click.argument(
+    "directory",
+    required=False,
+    default=".",
+    type=click.Path(exists=True, file_okay=False, path_type=Path),
+)
+@click.option("--token", help="The authentication token.")
+@click.option(
+    "--fail-on",
+    type=click.Choice([*_SEVERITY_ORDER, "none"]),
+    default="low",
+    help="Exit non-zero if a violation at or above this severity is found. "
+    "Use 'none' to always exit 0.",
+)
+@click.option(
+    "--loglevel",
+    type=click.Choice([level.value for level in constants.LogLevel]),
+    default=constants.LogLevel.INFO.value,
+    help="The log level to use.",
+)
+@click.option(
+    "--json/--no-json",
+    "-j",
+    "as_json",
+    is_flag=True,
+    help="Whether to output the result in JSON format.",
+)
+@click.option(
+    "--interactive/--no-interactive",
+    "-i",
+    is_flag=True,
+    default=True,
+    help="Whether to use interactive mode.",
+)
+def scan_command(
+    directory: Path,
+    token: str | None,
+    fail_on: str,
+    loglevel: str,
+    as_json: bool,
+    interactive: bool,
+):
+    """Run a Reflex-aware security review over your app source.
+
+    Uploads the app source under DIRECTORY (the current directory by default)
+    and reports security and logic flaws specific to Reflex apps.
+    """
+    from reflex_cli.utils import hosting
+
+    console.set_log_level(loglevel)
+
+    try:
+        authenticated_client = hosting.get_authenticated_client(
+            token=token, interactive=interactive
+        )
+
+        zip_bytes = _zip_app_source(directory)
+
+        with console.status("Uploading app source..."):
+            job_id = hosting.submit_security_review(
+                zip_bytes=zip_bytes, client=authenticated_client
+            )
+
+        deadline = time.monotonic() + _POLL_TIMEOUT_SECONDS
+        payload: dict[str, Any] = {}
+        with console.status("Scanning..."):
+            while True:
+                payload = hosting.get_security_review(
+                    job_id=job_id, client=authenticated_client
+                )
+                if payload.get("status") != "pending":
+                    break
+                if time.monotonic() >= deadline:
+                    console.error("Security review timed out. Try again later.")
+                    raise click.exceptions.Exit(1)
+                time.sleep(_POLL_INTERVAL_SECONDS)
+    except NotAuthenticatedError as err:
+        console.error("You are not authenticated. Run `reflex login` to authenticate.")
+        raise click.exceptions.Exit(1) from err
+    except hosting.SecurityReviewError as err:
+        console.error(f"Security review failed: {err}")
+        raise click.exceptions.Exit(1) from err
+
+    if payload.get("status") == "error":
+        console.error(f"Security review failed: {payload.get('error')}")
+        raise click.exceptions.Exit(1)
+
+    result = payload.get("result") or {}
+
+    if as_json:
+        console.print(json.dumps(result))
+    else:
+        _print_violations(result)
+
+    if fail_on != "none":
+        threshold = _SEVERITY_RANK[fail_on]
+        if any(
+            _SEVERITY_RANK.get(violation.get("severity", "low"), len(_SEVERITY_ORDER))
+            <= threshold
+            for violation in result.get("violations", [])
+        ):
+            raise click.exceptions.Exit(1)