ianalloway Security Scanner
Scan your projects for security vulnerabilities in dependencies and common code issues.
Dependency Scanning
NPM Projects
Check for known vulnerabilities in npm packages:
npm audit
Get JSON output for parsing:
npm audit --json | jq '{vulnerabilities: .metadata.vulnerabilities, total: .metadata.vulnerabilities.total}'
Fix automatically where possible:
npm audit fix
Python Projects
Check Python dependencies with pip-audit:
pip install pip-audit && pip-audit
Or use safety (requires free API key from https://safetycli.com/):
pip install safety && safety check
Check requirements.txt directly:
pip-audit -r requirements.txt
Code Security Checks
Find Hardcoded Secrets
Search for potential API keys and secrets:
grep -rn "api_key\|apikey\|secret\|password\|token" --include="*.js" --include="*.ts" --include="*.py" --include="*.env" .
Find Dangerous Functions
Check for potentially dangerous code patterns:
# JavaScript/TypeScript - eval usage
grep -rn "eval(" --include="*.js" --include="*.ts" .
# Python - exec/eval usage
grep -rn "exec(\|eval(" --include="*.py" .
# SQL injection risks
grep -rn "execute.*%s\|execute.*f\"" --include="*.py" .
Check for Debug Code
Find debug statements that shouldn't be in production:
grep -rn "console.log\|debugger\|print(" --include="*.js" --include="*.ts" --include="*.py" .
Environment Security
Check for Exposed .env Files
find . -name ".env*" -not -path "*/node_modules/*" -not -path "*/.git/*"
Verify .gitignore
Ensure sensitive files are ignored:
cat .gitignore | grep -E "\.env|secret|credential|\.pem|\.key"
Docker Security
Scan Docker Images
Using Trivy (install: https://trivy.dev/):
trivy image your-image:tag
Check Dockerfile Best Practices
# Check for root user
grep -n "USER root" Dockerfile
# Check for latest tag
grep -n "FROM.*:latest" Dockerfile
Quick Security Audit
Run a quick audit on a project:
# For npm projects
echo "=== NPM Audit ===" && npm audit 2>/dev/null || echo "Not an npm project"
# Check for secrets
echo "=== Potential Secrets ===" && grep -rn "password\|secret\|api_key" --include="*.js" --include="*.py" --include="*.ts" . 2>/dev/null | head -20
# Check for .env files
echo "=== Environment Files ===" && find . -name ".env*" -not -path "*/node_modules/*" 2>/dev/null
GitHub Security Features
Enable Dependabot
Create .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
Security Policy Template
Create SECURITY.md in your repo to establish responsible disclosure guidelines.
Resources
Tips
- Run security scans in CI/CD pipelines
- Set up Dependabot for automatic dependency updates
- Use pre-commit hooks to catch secrets before commit
- Review third-party dependencies before adding them
- Keep dependencies updated regularly