vc-security

Invoke the audit with a scope glob such as src/api/**/*.ts or the keyword full for the entire codebase. The audit scans all in-scope files, categorizes findings by STRIDE and OWASP, and outputs a severity-ranked report table.

Add the --fix flag to apply fixes iteratively, sorted from Critical to Low severity. Each fix is verified with a test or lint guard and committed separately; use --iterations N to cap the number of fix attempts.

It runs pnpm audit for Node.js, pip-audit for Python, govulncheck for Go, bundle audit for Ruby, mvn dependency-check for Java, and cargo audit for Rust. The appropriate tool is selected based on the detected stack.

Yes, it scans for high-confidence patterns including AWS keys, GitHub tokens, Stripe keys, Slack tokens, private keys, and JWTs, plus medium-confidence generic patterns. Matches in test files, examples, and placeholder values are excluded to reduce false positives.

Skip the audit for purely cosmetic changes like CSS or copy edits where no user-facing code or data handling is involved. It is designed for releases, auth or payment feature additions, and periodic compliance reviews.

The fix loop runs a guard (tests or lint) after every change. If the guard fails, the process stops immediately and reports the failure instead of proceeding to the next finding, preventing cascading regressions.