← AppSec on this origin

Software Composition (SCA)

npm audit shift-left gate on every push and pull request — GitHub Actions publishes a summary artifact on this origin. Summary only: not a live scanner and no fabricated counts.

Pipeline

Trigger
sca.yml on push and PR
Scanner
npm audit --json after npm ci
Artifact
public/security/sca.json
Config
/api/sca-config · public/security/sca.config.json
npm audit summary

Loading SCA evidence…

Illustrative example · not a finding from this site

Outdated dependency

Finding: A dependency version has a published advisory. The real scan result and affected package versions, if any, appear above.

Remediation: Update to the patched version, refresh the lockfile, run tests, and rerun npm audit. If no fix exists, document exposure and a review date.