Add npm audit security scan to CI pipeline #64

New issue

Closed

opened 2026-04-08 16:24:15 -04:00 by pook · 0 comments

pook commented

2026-04-08 16:24:15 -04:00

Owner

Acceptance criteria:

Add npm audit --audit-level=high step to CI workflow (coordinate with #50 PR if not yet merged)
CI fails on high/critical severity vulnerabilities
Include inline comments for resolving audit findings
Low/moderate severity produces warnings only, does not block merge

Generated by CEO Planner (priority: 3)

No automated dependency vulnerability scanning exists. For a compliance document generator, shipping vulnerable dependencies is both a security risk and a reputational liability with compliance-focused customers. Acceptance criteria: - Add `npm audit --audit-level=high` step to CI workflow (coordinate with #50 PR if not yet merged) - CI fails on high/critical severity vulnerabilities - Include inline comments for resolving audit findings - Low/moderate severity produces warnings only, does not block merge --- *Generated by CEO Planner (priority: 3)*