This document describes the security scanning tools configured for the Nexus codebase and how to use them.

Nexus uses a multi-layered security approach:

Requirements:

• Node.js 22+ (repo and some dependencies enforce engines)

npm install

npm run security:all

Checks for common security issues in JavaScript/TypeScript code during development.

# Run linting
npm run lint

# Auto-fix issues where possible
npm run lint:fix

What's detected:

• eval() usage
• dangerouslySetInnerHTML usage
• Command injection risks
• Weak cryptographic algorithms
• Insecure random number generation
• Path traversal risks

Built-in npm dependency vulnerability scanner.

# Check for vulnerabilities
npm run security:audit

# Auto-fix vulnerabilities
npm run security:audit:fix

Configuration: The audit runs at "high" severity level by default.

Advanced static analysis with community-curated security rules.

# Run semgrep with repository rules (semgrep.yml)
npm run security:semgrep

# Docker fallback (if semgrep is not installed locally)
npm run security:semgrep:docker

What's detected:

• Code injection vulnerabilities
• SQL injection
• Path traversal
• XXE vulnerabilities
• Hardcoded secrets
• And many more OWASP Top 10 issues

Scans for secrets accidentally committed to the repository.

# Run gitleaks
npm run security:gitleaks

# Docker fallback (if gitleaks is not installed locally)
npm run security:gitleaks:docker

What's detected:

• AWS access keys
• GitHub tokens
• Slack tokens
• Stripe API keys
• Private keys
• Database connection strings
• JWT tokens

A GitHub Actions workflow is configured at .github/workflows/security.yml.

For full CI/CD functionality, add these secrets to your GitHub repository:

The workflow will still run without secrets - some steps may be skipped or use local-only modes.

The workflow runs:

• On every push to main or develop
• On every pull request to main
• Weekly on Sunday at 2 AM
• Manually via workflow_dispatch

To add Snyk for enhanced dependency monitoring:

# Install Snyk CLI
npm install -g snyk

# Authenticate
snyk auth

# Test configuration
snyk test

# Add to CI/CD (uncomment in security.yml)
# Uses: snyk/actions/node@master

1. Run security scans before committing:

   npm run security:all

2. Use pre-commit hooks:

   npx husky install
   # or use semgrep's built-in hook
   npm run postinstall

3. Fix vulnerabilities promptly:

   npm run security:audit:fix

4. Review security findings regularly:

   • Check GitHub Security tab
   • Review PR security checks
   • Monitor dependency updates

For external platform audits (HTTP headers/TLS/artifact exposure), use the security-researcher preset.

Operational guardrails to avoid noisy loops:

• Retry policy is enforced by the runner; don’t repeat identical tool calls after retry=no.
• For exploratory shell_exec probes, make commands non-fatal (|| true) and emit explicit YES/NO output so expected misses don’t derail the run.

If you see npm WARN EBADENGINE (e.g. Node 18 on the VM), upgrade Node to 22+ before running scans.

npm install -g semgrep

# macOS
brew install gitleaks

# Linux
wget https://github.com/zricethezav/gitleaks/releases/download/v8.18.2/gitleaks_v8.18.2_linux_x64.tar.gz
tar -xzf gitleaks_v8.18.2_linux_x64.tar.gz
sudo mv gitleaks /usr/local/bin/

# Ensure TypeScript ESLint is properly installed
npm install

• 0 - Scan passed / No issues found
• 1 - Issues found (for most tools)
• 2 - Configuration error

If you find a security vulnerability, please:

1. Do NOT open a public GitHub issue
2. Email the maintainers directly
3. Or use GitHub's private vulnerability reporting

Last updated: February 2026