repo_analyze and repo_security_plan report no security tooling in this repo. CI currently runs typecheck/test/build only.
For a harness that executes untrusted code, recommended additions:
- Secrets: gitleaks (
gitleaks/gitleaks-action@v2)
- SAST: semgrep (
config: auto) or CodeQL; plus eslint-plugin-security
- SCA:
npm audit --audit-level=high and/or osv-scanner
npm audit --omit=dev currently shows 0 vulnerabilities, so this is preventive rather than urgent.
repo_analyze and repo_security_plan report no security tooling in this repo. CI currently runs typecheck/test/build only.
For a harness that executes untrusted code, recommended additions:
gitleaks/gitleaks-action@v2)config: auto) or CodeQL; pluseslint-plugin-securitynpm audit --audit-level=highand/or osv-scannernpm audit --omit=devcurrently shows 0 vulnerabilities, so this is preventive rather than urgent.