security-scan

Run a static security scanner on the project's source directory to detect injection risks and missing auth in JavaScript and TypeScript. It searches for string-concatenated queries, hardcoded secrets, and exposed stack traces to produce prioritized JSON or human-readable reports.

Check for missing authentication middleware, missing permission checks, and string-concatenated database queries. A static security scanner detects these injection and auth risks along with hardcoded secrets and risky logging patterns to secure API endpoints and route handlers.

Yes, integrate the security scanner into a pre-merge CI job to validate code. It blocks merges containing critical or high severity findings like hardcoded secrets and missing auth, surfacing remediation recommendations to engineers during CI validation.

Yes, the scanner performs secrets and configuration checks to detect hardcoded credentials and risky logging patterns in API route handlers. It identifies sensitive data leaks and outputs JSON or human-readable reports with severity classification for fast remediation.

Use pattern-based static scanning on JavaScript route handlers and API endpoints to find missing permission middleware. The scanner identifies missing auth checks and produces a prioritized security report with severity classification for remediation.