Run a read-only local security audit before release

Capability overview

How can I use project security audit in DevDock?

Run a read-only local scan for exposed secrets, tracked credential files, private keys, escaping symlinks, and dependency lockfile gaps.

The baseline audit works across every registered folder, including projects with no detected language or framework, and does not upload source code.

Findings include severity, rule, file location, and remediation while intentionally withholding matched secret values.

Detected package-manager advisory commands complement the universal scan with current ecosystem vulnerability data.

What it finds

What the baseline scan reports

Run audit in the project's Security section scans every registered folder and sorts findings by severity:

• Critical: private key material, and tokens in formats DevDock recognizes: AWS access keys, GitHub and GitLab tokens, Slack tokens, and Stripe live secret keys.
• High: possible hardcoded secrets, where a name such as password, secret, api_key, access_token or client_secret is given a literal value; sensitive files such as environment files, credential stores and private keys that are tracked by Git; and a registered folder that cannot be read.
• Medium: symbolic links that point outside the project.
• Low: a package.json, composer.json, Gemfile, go.mod, pubspec.yaml, mix.exs or Podfile without its lockfile.

Reading results

Findings you can act on without showing the secret

The results show counts for Critical & high and Medium, plus Files inspected and Folders covered. Filter by severity and review the highest-severity items first. Each finding gives its rule, the file and line, and a suggested fix, and it opens in Visual Studio Code at that line. The matched value is never displayed.

Placeholder values and template files such as .env.example are not reported as secrets. A local .env file that Git does not track is expected to hold credentials, so its values are not reported as hardcoded secrets. When the scan is clear, the Security section shows Baseline scan is clear and reminds you that this does not prove the project is free of vulnerabilities.

Dependency advisories

Add current vulnerability data

The baseline scan checks files; it has no vulnerability database. The Dependency advisory scanners panel lists the audit commands DevDock detected for the project, such as Audit dependencies for Node projects and composer audit for PHP. These tools contact their package registries for current advisories, and their runs are kept in Run History.

Audit all dependencies on Today runs the detected audit commands across projects. If no scanner is detected for your stack, the panel says so, and a Pro custom command whose name includes audit can add your ecosystem's advisory tool to the list.

Scope and limits

How the scan runs

The audit reads files and does not change them or upload them. It covers folders with no detected technology too. It skips version-control data, dependency folders and build output, does not follow symbolic links, and skips binary files and files larger than 1 MB. The report shows when it finished, how long it took, and how many items were skipped.

A scan stops after 25,000 files or 500 findings, and the report then says the result limit was reached so you can fix findings and scan again. The security audit is included in DevDock Free.

In the workflow

How to use it

1. Open Security

   Choose Security from the project's Tools menu and select Run audit.

2. Start with the top severity

   Filter to Critical and High findings and open each one at its file and line.

3. Fix and rescan

   Remove or rotate the exposed value, untrack sensitive files, add missing lockfiles, then choose Run again.

4. Check dependencies

   Run the listed dependency advisory scanners, or Audit all dependencies on Today for every project.

Useful in practice

When to use it

Related manual

Local project security audits and dependency checks

Run DevDock's read-only local security audit, understand each finding, complement it with ecosystem advisory scanners, and respond without exposing secrets.

Direct answers

Questions about project security audit.