JSPM

A pre-commit security gate that automatically blocks vulnerable code before every git commit. Covers SAST · SCA · Misconfigurations · SQL Injection · Hardcoded Secrets and more.

  git commit  →  sec-gate scans  →  vulnerability?  →  BLOCKED ✗
                                 →  clean?          →  committed ✓

⚡ Quick Start

# Step 1 — Install globally (once per machine)
npm install -g sec-gate

# Step 2 — Hook into your repo (once per clone)
cd your-project
sec-gate install

# Step 3 — Commit as normal — scans run automatically
git commit -m "your changes"

That's it. No config needed. No extra tools to install. Everything is bundled.

🛡️ What gets scanned

Layer	Tool	What it catches
	Semgrep + AST rules	SQL injection, XSS, command injection, hardcoded secrets
	OSV-Scanner	Known CVEs in npm/pnpm/yarn dependencies
	govulncheck	Known CVEs in Go modules
	acorn AST walker	Prototype pollution, insecure random, eval injection

🔴 What blocked output looks like

sec-gate: scan started (staged files)
sec-gate: excluding 3 high-noise rule(s)
sec-gate: scanning src/services/payment.js (js) with owasp-top10 rules...

sec-gate: SECURITY FINDINGS (commit blocked):

- src/services/payment.js:40 [CRITICAL] [sql-injection-template-literal] (A03:2021 Injection)
  SQL query built with template literal interpolation.
  Use parameterized queries: sequelize.query(sql, { replacements: [...] })

- src/services/payment.js:82 [LOW] [insecure-object-assign] (A01:2021)
  Object.assign with potentially user-controlled data.

- package-lock.json [OSV:GHSA-r5fr-rjxr-66jc]
  lodash: vulnerable to Code Injection via _.template

🟢 What a clean commit looks like

sec-gate: scan started (staged files)
sec-gate: excluding 3 high-noise rule(s)
sec-gate: all checks passed — no vulnerabilities found by sec-gate
sec-gate: checks ran: SAST (3 files), SCA-node (package-lock.json)

🗂️ OWASP Top 10 (2021) Coverage

#	Category	Status
A01	Broken Access Control
A02	Cryptographic Failures
A03	Injection (SQL · XSS · CMD)
A04	Insecure Design
A05	Security Misconfiguration
A06	Vulnerable Components
A07	Authentication Failures
A08	Software Integrity Failures
A09	Security Logging Failures
A10	Server-Side Request Forgery

🔧 All Commands

sec-gate install        # Install/inject pre-commit hook (auto-detects husky, lefthook etc.)
sec-gate scan           # Scan all tracked files
sec-gate scan --staged  # Scan only staged files
sec-gate doctor         # Diagnose installation issues
sec-gate --version      # Print installed version
sec-gate --help         # Show help

🔕 Suppressing False Positives

Two formats supported — use whichever you prefer:

Short format (quick)

// sec-gate-disable: sql-injection-template-literal
const rawQuery = `SELECT * FROM payments WHERE status = '${status}'`;

Long format (recommended for PRs — shows reason)

// security-scan: disable rule-id: sql-injection-template-literal reason: status validated against enum
const rawQuery = `SELECT * FROM payments WHERE status = '${status}'`;

Suppress all rules on a line

// sec-gate-disable: *
dangerousLegacyFunction();

⚙️ Configuration (.sec-gate.yml)

Create this file in your project root to tune the scanner:

# .sec-gate.yml

# Block only on high/critical findings
severity_threshold: high

# Exclude specific rules globally
exclude_rules:
  - path-join-resolve-traversal
  - detect-non-literal-regexp

# Skip test and mock files
exclude_paths:
  - "**/__tests__/**"
  - "**/*.test.js"
  - "**/mocks/**"

# Toggle scanners
sca: true
custom_rules: true

🪝 Hook Manager Support

sec-gate install automatically detects your hook manager — no manual config needed:

Tool	Detection	Auto-injected
	.husky/ directory	✅ .husky/pre-commit
	package.json hooks	✅ prepended to command
	lefthook.yml	✅ priority 1 command
	package.json	✅ prepended to command
	.pre-commit-config.yaml	✅ local hook entry
	no manager	✅ .git/hooks/pre-commit

🔒 Supported Package Managers

🚨 Emergency Bypass

# Skip the scan for this commit only (emergency use only)
SEC_GATE_SKIP=1 git commit -m "emergency fix"

⚠️ This only skips the local pre-commit hook. CI will still catch it.

👥 Team Auto-Setup

Add to your project's package.json so every developer gets the hook automatically on npm install:

{
  "scripts": {
    "prepare": "sec-gate install"
  }
}

Then new developer onboarding is just:

npm install -g sec-gate   # once per machine
npm install               # installs hook automatically via prepare script

🏗️ How it works internally

git commit
    │
    ▼
pre-commit hook
    │
    ├── Load .sec-gate.yml config
    │
    ├── SAST ──► Semgrep (owasp-top10)
    │        ──► AST walker (acorn) — SQL injection, secrets, prototype pollution
    │
    ├── SCA  ──► osv-scanner (npm/pnpm/yarn lockfile)
    │        ──► govulncheck (go.mod)
    │
    ├── Apply inline suppressions (sec-gate-disable / security-scan: disable)
    │
    ├── Apply config filters (exclude_rules, exclude_paths, severity_threshold)
    │
    ├── Findings? → exit 1 → commit BLOCKED ✗
    └── Clean?   → exit 0 → commit proceeds ✓