Dependency Audit

Most of your attack surface is code you didn't write. This scan finds dependencies with known CVEs (the published ones — a database lookup, not analysis). The trap is reacting to the severity number alone: a 9.8 in a dev-only test runner is not a 9.8 in your shipped runtime. Triage by reachability first, severity second.

When to run

• Before a release (a tagged version is what gets audited).
• On a schedule (new CVEs land against deps you already shipped — yesterday's clean is today's stale).
• After adding or bumping any dependency.

Run it — one ecosystem at a time, then the cross-cutting scanner

# Node / TS — runtime only first (what you actually ship), then everything.
npm audit --omit=dev          # the deps that ship in `npm install --omit=dev`
npm audit                     # + dev/build tooling

# Rust
cargo audit                   # reads Cargo.lock against the RustSec advisory DB