security-scanning

Automating dependency audits and SAST for a Node.js codebase involves running npm audit and static analysis during CI/CD builds. This Skill triggers those checks automatically across backend, frontend, and orchestrator components to identify vulnerable packages and code vulnerabilities.

Detecting credential leaks in git history during daily maintenance is best handled by automated git secret scans. This Skill performs daily static analysis and secrets scanning to proactively find exposed credentials across the entire codebase.

Yes, this security scanning works with multiple components including backend, bridge, frontend, orchestrator, and cowork-mcp. It evaluates Node.js dependencies and applies static analysis across all these distinct parts of the stack.

Yes, you can run npm audit and open-port validation automatically on a daily schedule. The Skill executes daily security checks, logs the findings, and triggers alerts for any high-risk vulnerabilities or open ports detected.

Static analysis matters for preventing vulnerabilities in continuous integration because it identifies security flaws and credential leaks before deployment. Integrating SAST directly into build pipelines ensures proactive risk management across the codebase.

You should not rely solely on automated SAST and secret detection when dealing with complex logic vulnerabilities or runtime attacks. Automated scanning is limited to identifying static patterns, known vulnerable packages, and hardcoded credentials.