security

DLC: Security Scan

Run security checks against the current project and create a GitHub issue with findings.

Before running, read ../dlc/references/ISSUE-TEMPLATE.md now for the issue format, and read ../dlc/references/REPORT-FORMAT.md now for the findings data structure.

Step 1: Detect Project Type

Scan the repository root for project indicators:

Indicator	Project Type	Primary Tool
package.json / package-lock.json / bun.lockb	Node.js	npm audit / bun audit
requirements.txt / pyproject.toml / Pipfile	Python	pip-audit
Cargo.toml	Rust	cargo audit
go.mod	Go	govulncheck
pom.xml / build.gradle	Java/Kotlin	dependency-check
Gemfile	Ruby	bundler-audit

If multiple indicators exist, treat as a monorepo and scan each.

Step 2: Run Security Tools

For each detected project type, run tools in this priority order. Use the first available tool; skip unavailable ones.

Dependency Audit

Select the tool based on availability (command -v), not exit codes — audit tools exit non-zero when vulnerabilities are found, which is a valid result to capture.

# Node.js — select by availability
if command -v npm >/dev/null 2>&1; then
  npm audit --json 2>/dev/null
elif command -v bun >/dev/null 2>&1; then
  bun audit 2>/dev/null
fi

# Python
command -v pip-audit >/dev/null 2>&1 && pip-audit --format=json 2>/dev/null

# Rust
command -v cargo-audit >/dev/null 2>&1 && cargo audit --json 2>/dev/null

# Go
command -v govulncheck >/dev/null 2>&1 && govulncheck ./... 2>/dev/null

Dependency Staleness

Check for packages significantly behind the latest stable release — these accumulate security patches without formal CVEs.

Select tools based on availability (command -v), not exit codes — staleness tools exit non-zero when outdated packages are found, which is a valid result to capture.