DocsSecurity

Security Guide

Lunx ships an 8-command native security pipeline built into the Rust compiler core. Zero additional npm dependencies. Runs automatically on every production build.

Native Rust — Zero Dependencies

Why built-in security?

Most security tools require separate CI steps, manual configuration, and heavy npm dependencies. Lunx integrates security directly into the build pipeline — every lunx build runs a complete security audit before emitting a single byte to disk. If anything fails, the build aborts immediately.

Pipeline stages

1. Secret scanning

Parses all source files, .env files, and configs using entropy analysis and pattern matching to detect hardcoded secrets before they enter your git history or bundle. Detects: AWS keys (AKIA*), GitHub PATs (ghp_*), Stripe keys (sk_live_*), private RSA keys, JWTs, and 200+ additional patterns.

bash

lunx security scan

🔍 Scanning 84 files for secrets...
  ✓ No secrets detected
  Scanned: .env, .env.local, src/**/*.ts, config/**/*

2. CVE checking

Queries the OSV (Open Source Vulnerability) database using exact installed package versions from your lockfile. Results in under 300ms — no external CLI required.

bash

lunx security cve

🔍 Checking 312 packages against OSV database...
  ✓ 0 critical, 0 high, 1 moderate
  ⚠ lodash@4.17.20 — CVE-2021-23337 (moderate)
  → Run "lunx security fix" to upgrade automatically

3. SBOM generation

Generates a CycloneDX 1.5 Software Bill of Materials listing every dependency with its version, license, and source URL. Satisfies SOC 2, NIST, and US federal SBOM mandates.

typescriptlunx.config.ts

security: {
  generateSBOM: {
    format:          'json',      // 'json' | 'xml'
    outputFile:      'dist/bom.json',
    includeLicenses: true,        // SPDX license identifiers
    includeHashes:   true,        // SHA-256 of each package tarball
  }
}

4. SRI hash injection

Computes SHA-384 Subresource Integrity hashes for all output JS/CSS assets and injects them into index.html. Browsers reject assets that don't match, protecting users from CDN manipulation and man-in-the-middle attacks.

html

<!-- Output index.html — SRI injected automatically by Lunx -->
<link rel="stylesheet"
  href="/assets/style-8d3f20.css"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/..."
  crossorigin="anonymous" />

<script type="module"
  src="/assets/main-4f2c1a.js"
  integrity="sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcg..."
  crossorigin="anonymous">
</script>

Commands 5–8 at a glance

Command	Purpose
lunx security fix	Interactively upgrade vulnerable packages. Shows diffs and requires confirmation before modifying package.json.
lunx security plugins	Audit sandbox permissions of all installed plugins. Blocks unauthorized disk writes or network calls.
lunx security report	Compile all results into a scored HTML/JSON report (0–100 security score). Ready for compliance review.
lunx security audit	Run all 8 checks in sequence. Returns exit code 1 on any violation. Designed for CI/CD gates.

Full security config

typescriptlunx.config.ts

export default defineConfig({
  security: {
    scanSecrets:    true,
    excludePaths:   ['./test/fixtures/**', './mock-data/**'],

    checkCVEs:      true,
    failOnSeverity: 'high',    // 'low' | 'moderate' | 'high' | 'critical'

    generateSBOM: {
      format:          'json',
      outputFile:      'dist/bom.json',
      includeLicenses: true,
    },

    sri:           true,
    failOnSecrets: true,
    warnOnly:      false,      // set true only for local dev
  }
})

CI/CD integration

yaml.github/workflows/deploy.yml

name: Build & Deploy

on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npm ci
      # Standalone security gate — fails CI on any critical/high finding
      - run: npx lunx security audit
      # Production build (also runs security pipeline internally)
      - run: npm run build
      - uses: actions/upload-artifact@v4
        with: { name: dist, path: dist/ }

Never set warnOnly: true in production

Setting warnOnly: true bypasses build failures on security violations. Only use it during local development. Always enforce strict mode in CI/CD pipelines.

PreviousPlugins Guide NextSecret Scanning