security-scan

To scan code changes for exposed secrets before a pull request, run this workflow to perform a scoped scan of recent git changes, detect hardcoded credentials, and output a blocking verdict if matches are found.

Checking for dependency vulnerabilities and auth issues pre-commit involves running a focused security spot-check that reviews high and critical CVEs while validating authentication behavior and user input handling on changed routes.

Yes, this security scan detects .env file leakage and hardcoded API keys by sweeping recent commits and producing a structured security report that blocks commits when exposed credentials are identified.

You can use this to verify input validation, parameterized data access, and file path traversal protections by applying a focused security spot-check specifically scoped to your modified API integrations and data storage routes.

A limitation of running a pre-PR dependency audit here is that it focuses strictly on high and critical CVEs using language-appropriate tooling for affected packages, rather than providing a comprehensive, low-severity historical analysis.

The security review workflow outputs its verdict for blocked commits by generating a structured security report that classifies changes as CLEAN, NEEDS ATTENTION, or BLOCKER based on the severity of detected vulnerabilities or exposed secrets.