Last Updated: November 21, 2025
Security Gates
| Gate | Purpose |
|---|---|
Static analysis
|
Catch vuln early |
Dependency scan
|
Fail on CVEs |
Policy
|
Require reviewers |
Commands
npm run lint
Lint before Upload
dependency-check
Fail on vulnerabilities
gh workflow dispatch
Trigger audited runs
Secrets
Use GitHub Secrets, avoid echoing tokens, and audit usage with token access logs.
💡 Pro Tip:
Rotate secrets, enforce `same-origin` actions, and gate merges on policy checks.