dependency-audit

name	dependency-audit
description	Scan ArtStroy npm/bun dependencies for known vulnerabilities. Ranks CVEs by CVSS severity, creates vuln-fix issues with deadlines, and verifies fixes post-deploy. Run monthly and on any new dependency addition.

Dependency Audit

ArtStroy publishes OWASP articles. Having unpatched dependencies with public CVEs is ironic and unacceptable.

When to Run

• Monthly (scheduled by Security Auditor)
• After any PR that adds or updates dependencies (chore(deps) PRs)
• When security-digest skill surfaces a CVE affecting the npm/Bun ecosystem
• Before any major version upgrade

Running the Audit

cd D:/QA_A/artstroy  # or on the server

# Primary: Bun's built-in audit
bun audit

# Supplemental: npm audit (catches additional advisories)
npm audit --audit-level=moderate

# For deeper scanning with CVE details
npx better-npm-audit audit

Capture the full output including CVE IDs, severity, and affected packages.

Severity Classification and SLAs

CVSS Score	Severity	Response SLA
9.0–10.0	Critical	1 hour — immediate action
7.0–8.9	High	7 days
4.0–6.9	Medium	30 days
0.1–3.9	Low	Next scheduled maintenance

For Critical and High: create a vuln-fix issue immediately. Do not wait for the monthly report.

vuln-fix Issue Format

Create issue with label vuln-fix, security, assigned to Security Auditor (who triages):

## vuln-fix: {CVE-ID} — {package}@{version}

**Severity**: Critical / High / Medium / Low
**CVSS Score**: {score}
**Attack Vector**: Network / Adjacent / Local / Physical
**Attack Complexity**: Low / High

**Affected package**: `{package-name}@{current-version}`
**Safe version**: `{fixed-version}` or `{workaround}`

**Description**: {2–3 sentence description of the vulnerability}

**Reproduction**: {only if public PoC exists — educational context}

**Fix**:
```bash
bun update {package-name}
# or
bun add {package-name}@{safe-version}

Verification: After update, run bun run build to confirm no breaking changes.

Deadline: {date based on SLA}

---

Detected by dependency-audit on {date}

## Triage Decision Tree

After creating the issue:

1. **Is this in a direct dependency?** → assign to Frontend Engineer (update the dep, verify build passes)
2. **Is this in a devDependency?** → lower risk; assign to Frontend Engineer with lower priority
3. **Is this in a transitive dependency?** → may need `overrides` in `package.json`; assign to Frontend Engineer
4. **Does the fix require breaking changes?** → assign to CTO for architectural decision before fixing
5. **Is there no fix available?** → escalate to CTO with risk assessment; document in decisions.md

## Audit Report Format

Monthly report posted as issue comment to the root company issue:

```markdown
## Dependency Audit — {YYYY-MM-DD}

**Total vulnerabilities found**: {count}
- Critical: {count}
- High: {count}
- Medium: {count}
- Low: {count}

**vuln-fix issues created**: {count} (links)

**Already resolved since last audit**: {count}

**Packages needing attention**: {list packages where no auto-fix exists}

**Audit command**: `bun audit` + `npm audit`
**Next scheduled audit**: {date + 30 days}