ck:security-scan

Secret scanning uses regex-based pattern matching to locate hardcoded API keys, tokens, passwords, and database credentials in your codebase. It flags high-confidence risks in configuration files and source code while leaving files unchanged.

Dependency review checks package and audit outputs to surface vulnerable third-party dependencies by severity. It applies to Node.js, Python, Go, and Rust repositories during audits and release reviews.

Unsafe pattern analysis flags common OWASP-relevant issues including SQL injection, XSS, command injection, path traversal, and dangerous dynamic execution. It matches insecure code patterns to identify these security vulnerabilities.

Release security audits combine secret detection, dependency review, and unsafe code pattern analysis to catch leaked credentials and risky dependencies. This pre-release review prevents incidents and identifies release blockers.

Targeted scanning supports dependency-only or secret-only passes without running the full audit. You can focus the security scan specifically on exposed credentials or vulnerable dependencies as needed.

Static security analysis leaves your source files unchanged during scanning. The process reads codebases to detect secrets, dependency issues, and unsafe patterns without modifying any repository contents.