@infandev/node-security-init

One command. Security-ready Node repo.

Scaffold a config-only baseline into any existing or new project — local secret scanning, CI SAST, CI secrets, and dependency audit. After scaffolding, complete GitHub setup (org repos need a GITLEAKS_LICENSE secret).

npx @infandev/node-security-init
# yarn: yarn dlx @infandev/node-security-init

After install, husky’s prepare enables the pre-commit hook. Commit your application code next.

What you get

| Layer | What runs | |-------|-----------| | Pre-commit | gitleaks protect --staged via husky (scripts/gitleaks.mjs) | | CI — sast | Semgrep CE (Node/TS rulesets, --error, job summary) | | CI — secrets-scan | gitleaks-action (same version pin as local) | | CI — dependency-scan | npm audit --audit-level=high or yarn audit --level high |

• Gitleaks binary downloads once into .cache/gitleaks/<version>/ (default 8.30.1)
• Optional full-tree scan: npm run hooks:run / yarn hooks:run
• Workflow triggers: all pull requests + workflow_dispatch
• Actions pinned by commit SHA; Dependabot PRs are skipped

GitHub setup

Personal repositories

No extra config. Push the scaffolded workflow, then open a PR or run Actions → Security Scan.

Organization repositories (required)

gitleaks-action needs a free license on org-owned repos. Without it, secrets-scan fails.

1. Get a free license key: gitleaks.io
2. In the GitHub repo: Settings → Secrets and variables → Actions
3. Create a repository secret:
   • Name: GITLEAKS_LICENSE
   • Value: your license key
4. Re-run the workflow (or open a new PR)

Also confirm Actions are enabled for the repo (org policy / Settings → Actions).

GITHUB_TOKEN is provided automatically — do not add it as a custom secret.

GitHub Desktop / GUI git (node: command not found)

GUI apps often omit Node from PATH. This package’s .husky/pre-commit adds common Homebrew / nvm / fnm / Volta paths. If it still fails, create ~/.config/husky/init.sh:

export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
# if you use nvm:
# export NVM_DIR="$HOME/.nvm"
# [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"

Then restart the GUI app. Or commit from a terminal where node works.

To refresh an older hook after upgrading this package:

npx @infandev/node-security-init --force

CLI options

| Flag | Meaning | |------|---------| | --force | Overwrite existing scaffold files (.gitignore is always merge-only — never replaced) | | --dry-run | Print planned writes; write nothing; skip install | | --no-install | Scaffold only; skip npm i / yarn | | --upgrade | Refresh script, husky hook, and CI workflow (keeps .gitleaks.toml unless --force) | | --cwd <path> | Target directory (default: current) |

npx @infandev/node-security-init --dry-run
npx @infandev/node-security-init --upgrade

Allowlist false positives

Edit .gitleaks.toml. Do not leave an empty paths = [] — gitleaks rejects that.

[extend]
useDefault = true

[allowlist]
description = "Known false positives"
paths = [
  '''(?i)(^|/)\.env\.example$''',
]

Bump gitleaks version

Keep these in sync, or let the package do it:

1. Default in scripts/gitleaks.mjs
2. GITLEAKS_VERSION in .github/workflows/security-scan.yml

npx @infandev/node-security-init --upgrade

Links

• npm: npmjs.com/package/@infandev/node-security-init
• Source: infantex-team/node-security-template
• License: MIT