A pre-commit security gate that automatically blocks vulnerable code before every git commit. Covers SAST · SCA · Misconfigurations · SQL Injection · Hardcoded Secrets and more.

  git commit  →  sec-gate scans  →  vulnerability?  →  BLOCKED ✗
                                 →  clean?          →  committed ✓

⚡ Quick Start

# Step 1 — Install globally (once per machine)
npm install -g sec-gate

# Step 2 — Hook into your repo (once per clone)
cd your-project
sec-gate install

# Step 3 — Commit as normal — scans run automatically
git commit -m "your changes"

That's it. No config needed. No extra tools to install. Everything is bundled.

🛡️ What gets scanned

| Layer | Tool | What it catches | |:---:|:---:|:---| | | Semgrep + AST rules | SQL injection, XSS, command injection, hardcoded secrets | | | OSV-Scanner | Known CVEs in npm/pnpm/yarn dependencies | | | govulncheck | Known CVEs in Go modules | | | acorn AST walker | Prototype pollution, insecure random, eval injection |

🔴 What blocked output looks like

sec-gate: scan started (staged files)
sec-gate: excluding 3 high-noise rule(s)
sec-gate: scanning src/services/payment.js (js) with owasp-top10 rules...

sec-gate: SECURITY FINDINGS (commit blocked):

- src/services/payment.js:40 [CRITICAL] [sql-injection-template-literal] (A03:2021 Injection)
  SQL query built with template literal interpolation.
  Use parameterized queries: sequelize.query(sql, { replacements: [...] })

- src/services/payment.js:82 [LOW] [insecure-object-assign] (A01:2021)
  Object.assign with potentially user-controlled data.

- package-lock.json [OSV:GHSA-r5fr-rjxr-66jc]
  lodash: vulnerable to Code Injection via _.template

🟢 What a clean commit looks like

sec-gate: scan started (staged files)
sec-gate: excluding 3 high-noise rule(s)
sec-gate: all checks passed — no vulnerabilities found by sec-gate
sec-gate: checks ran: SAST (3 files), SCA-node (package-lock.json)

🗂️ OWASP Top 10 (2021) Coverage

| # | Category | Status | |:---:|:---|:---:| | A01 | Broken Access Control | | | A02 | Cryptographic Failures | | | A03 | Injection (SQL · XSS · CMD) | | | A04 | Insecure Design | | | A05 | Security Misconfiguration | | | A06 | Vulnerable Components | | | A07 | Authentication Failures | | | A08 | Software Integrity Failures | | | A09 | Security Logging Failures | | | A10 | Server-Side Request Forgery | |

🔧 All Commands

sec-gate install        # Install/inject pre-commit hook (auto-detects husky, lefthook etc.)
sec-gate scan           # Scan all tracked files
sec-gate scan --staged  # Scan only staged files
sec-gate doctor         # Diagnose installation issues
sec-gate --version      # Print installed version
sec-gate --help         # Show help

🔕 Suppressing False Positives

Two formats supported — use whichever you prefer:

Short format (quick)

// sec-gate-disable: sql-injection-template-literal
const rawQuery = `SELECT * FROM payments WHERE status = '${status}'`;

Long format (recommended for PRs — shows reason)

// security-scan: disable rule-id: sql-injection-template-literal reason: status validated against enum
const rawQuery = `SELECT * FROM payments WHERE status = '${status}'`;

Suppress all rules on a line

// sec-gate-disable: *
dangerousLegacyFunction();

⚙️ Configuration (.sec-gate.yml)

Create this file in your project root to tune the scanner:

# .sec-gate.yml

# Block only on high/critical findings
severity_threshold: high

# Exclude specific rules globally
exclude_rules:
  - path-join-resolve-traversal
  - detect-non-literal-regexp

# Skip test and mock files
exclude_paths:
  - "**/__tests__/**"
  - "**/*.test.js"
  - "**/mocks/**"

# Toggle scanners
sca: true
custom_rules: true

| Value | Blocks on | |---|---| | all (default) | Every finding | | high | High + Critical only | | critical | Critical only | | medium | Medium + High + Critical | | low | Everything (same as all) |

🪝 Hook Manager Support

sec-gate install automatically detects your hook manager — no manual config needed:

| Tool | Detection | Auto-injected | |:---:|:---:|:---:| | | .husky/ directory | ✅ .husky/pre-commit | | | package.json hooks | ✅ prepended to command | | | lefthook.yml | ✅ priority 1 command | | | package.json | ✅ prepended to command | | | .pre-commit-config.yaml | ✅ local hook entry | | | no manager | ✅ .git/hooks/pre-commit |

🔒 Supported Package Managers

🚨 Emergency Bypass

# Skip the scan for this commit only (emergency use only)
SEC_GATE_SKIP=1 git commit -m "emergency fix"

⚠️ This only skips the local pre-commit hook. CI will still catch it.

👥 Team Auto-Setup

Add to your project's package.json so every developer gets the hook automatically on npm install:

{
  "scripts": {
    "prepare": "sec-gate install"
  }
}

Then new developer onboarding is just:

npm install -g sec-gate   # once per machine
npm install               # installs hook automatically via prepare script

🏗️ How it works internally

git commit
    │
    ▼
pre-commit hook
    │
    ├── Load .sec-gate.yml config
    │
    ├── SAST ──► Semgrep (owasp-top10)
    │        ──► AST walker (acorn) — SQL injection, secrets, prototype pollution
    │
    ├── SCA  ──► osv-scanner (npm/pnpm/yarn lockfile)
    │        ──► govulncheck (go.mod)
    │
    ├── Apply inline suppressions (sec-gate-disable / security-scan: disable)
    │
    ├── Apply config filters (exclude_rules, exclude_paths, severity_threshold)
    │
    ├── Findings? → exit 1 → commit BLOCKED ✗
    └── Clean?   → exit 0 → commit proceeds ✓

Built with ❤️ to make security automatic, not optional.