dep-auditlisted

**Version**: 1.0 **Created**: 2026-03-21 **Last Updated**: 2026-03-21 **Authors:** Ömer Ufuk --- # /dep-audit — Dependency Vulnerability Audit ## When to Use Invoke `/dep-audit` when: - Before any release to verify no known vulnerabilities ship - After updating `go.mod` / `go.sum` or `package.json` / `package-lock.json` - When triaging a new CVE advisory affecting your tech stack - As part of routine security hygiene (weekly or per-sprint) - After adding a new third-party dependency --- ## Prerequisites Install the scanning tools: ```bash # govulncheck (Go vulnerability scanner — official Go team tool) go install golang.org/x/vuln/cmd/govulncheck@latest # trivy (multi-language vulnerability scanner) brew install trivy # or: https://aquasecurity.github.io/trivy/ # Verify installations govulncheck --version 2>/dev/null || echo "govulncheck not installed" trivy --version 2>/dev/null || echo "trivy not installed" ``` > **Note**: `npm audit` is built into Node.js and requires no separate installation. --- ## Invocation ```bash /dep-audit ``` --- ## Behavior ### Step 1: Go Module Integrity Verify that downloaded modules match their checksums in `go.sum`: ```bash go mod verify ``` A verification failure indicates a tampered or corrupted module -- treat as **CRITICAL**. ### Step 2: Go Vulnerability Check Scan Go dependencies for known vulnerabilities: ```bash govulncheck ./... ``` govulncheck is authoritative for Go. It checks not just whether a vulnerable mo