securitylisted

# DLC: Security Scan Run security checks against the current project and create a GitHub issue with findings. Before running, **read [../dlc/references/ISSUE-TEMPLATE.md](../dlc/references/ISSUE-TEMPLATE.md) now** for the issue format, and **read [../dlc/references/REPORT-FORMAT.md](../dlc/references/REPORT-FORMAT.md) now** for the findings data structure. ## Step 1: Detect Project Type Scan the repository root for project indicators: | Indicator | Project Type | Primary Tool | |-----------|-------------|--------------| | `package.json` / `package-lock.json` / `bun.lockb` | Node.js | `npm audit` / `bun audit` | | `requirements.txt` / `pyproject.toml` / `Pipfile` | Python | `pip-audit` | | `Cargo.toml` | Rust | `cargo audit` | | `go.mod` | Go | `govulncheck` | | `pom.xml` / `build.gradle` | Java/Kotlin | `dependency-check` | | `Gemfile` | Ruby | `bundler-audit` | If multiple indicators exist, treat as a monorepo and scan each. ## Step 2: Run Security Tools For each detected project type, run tools in this priority order. Use the first available tool; skip unavailable ones. ### Dependency Audit Select the tool based on availability (`command -v`), not exit codes — audit tools exit non-zero when vulnerabilities are found, which is a valid result to capture. ```bash # Node.js — select by availability if command -v npm >/dev/null 2>&1; then npm audit --json 2>/dev/null elif command -v bun >/dev/null 2>&1; then bun audit 2>/dev/null fi # Python command -v pip-audit