Docs

Vulnerabilities

A live dependency audit: npm audit run across every package.json surface in the repo, grouped by severity. A surface is a directory with its own lockfile, so the repo root and any workspace (such as website/ or installer/) are each scanned. It is computed on demand, never a hand-maintained list.

Where to find it

  • Localhost: /vulnerabilities.html
  • API: GET /api/vulnerabilities (add ?fresh=1 to force a re-scan)
  • Navigation: AI Security in the sidebar, then Vulnerabilities under All tools, in the Vulnerabilities group

What it does for you

One current view across every workspace.The scan discovers each audit surface (the root plus any workspace with its own lockfile) and runs npm audit per surface, so a monorepo's website and installer are covered, not just the root. Findings are grouped by severity, and a production-only total is computed alongside the full total.
Un-scannable surfaces are reported, not hidden.A surface with no package-lock.json, or one that cannot reach the registry, is reported as un-scannable rather than silently failing the page. The scan runs asynchronously so it never blocks the server; the tab shows a scanning state and refreshes when the result lands.

Built vs. planned

Multi-surface discovery, the per-surface npm audit --json parse, severity grouping, the production-only total, and the on-demand re-scan ship today, backed by lib/vuln-scan.mjs and served through lib/routes/vulnerabilities.mjs. The tab also shows a copyable CI snippet you paste into a workflow file. For the per-dependency risk model (what each dependency is and what a compromise would mean) see the Dependencies tab; this tab is the live audit.

Last updated