Capability overview
What does project security audit do in DevDock?
Run a read-only local scan for exposed secrets, tracked credential files, private keys, escaping symlinks, unsafe permissions, and dependency lockfile gaps.
The baseline audit works across every registered folder, including projects with no detected language or framework, and does not upload source code.
Findings include severity, rule, file location, and remediation while intentionally withholding matched secret values.
Detected package-manager advisory commands complement the universal scan with current ecosystem vulnerability data.
In the workflow
Review the workspace
See its folders, health, saved commands, and recent activity from one overview.
DevDock keeps the project, registered folder, working directory, execution target, and retained output connected so the same task remains understandable later.
Useful in practice
Where this capability earns its place.
Related manual
Local project security audits and dependency checks
Run DevDock's read-only local security audit, understand each finding, complement it with ecosystem advisory scanners, and respond without exposing secrets.
The guide covers run the universal local audit, know what the baseline checks, understand the privacy boundary, read the audit limits correctly, respond to secret findings, fix filesystem and dependency findings, run dependency advisory scanners. It is the best next step when you want to move from the product overview into a repeatable setup.
Read the guideDirect answers
Questions about project security audit.
What does project security audit do in DevDock?
Run a read-only local scan for exposed secrets, tracked credential files, private keys, escaping symlinks, unsafe permissions, and dependency lockfile gaps. The baseline audit works across every registered folder, including projects with no detected language or framework, and does not upload source code. Findings include severity, rule, file location, and remediation while intentionally withholding matched secret values. Detected package-manager advisory commands complement the universal scan with current ecosystem vulnerability data.
Does DevDock replace the terminal?
No. It provides a repeatable control surface for common project workflows and can still open a registered folder in a terminal, Visual Studio Code, or File Explorer.
Does project detection run repository code?
No. Detection reads a bounded set of manifests and marker files. It does not execute package managers, build tools, project scripts, or network requests.