dev-security

What problem does it solve?

Provides an automated, reproducible security audit of source code and dependencies to find SAST and SCA vulnerabilities, reduce false positives, and produce actionable remediation plans so teams can safely promote code to production.

Core Features & Use Cases

• Hybrid three-layer scanning: combines deterministic SAST tools (Semgrep, Bandit, Bearer) and SCA tools (npm audit, pip-audit, OSV, retire.js) with an AI security-review layer to validate findings and detect business-logic issues.
• Unified reporting: aggregates findings into specs/technical/security-report.md with CWE/CVE mapping, severity classification, Security Score calculation, and trend comparison to prior scans.
• Remediation workflow: suggests exact dependency upgrades or code fixes, supports an isolated worktree to apply fixes, re-scans modified files, and updates changelogs when fixes pass tests.
• Use Case: run a pre-release security gate for a Node.js or Python service to ensure no critical or high vulnerabilities advance to production.

Quick Start

Run a hybrid SAST and SCA scan on the repository and generate specs/technical/security-report.md with findings and suggested remediations.