tinkerise/socket.yml at main · farce1/tinkerise · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
version: 2

# Socket.dev security configuration for tinkerise
# https://docs.socket.dev/docs/socket-yml

projectType: library

issueRules:
  # Install scripts - we have none in any published package
  hasInstallScripts:
    action: error

  # Network access - only optional npm registry version check
  networkAccess:
    action: warn

  # Shell access - we use execa with argument arrays (safe)
  shellAccess:
    action: warn

  # No eval or dynamic code execution
  usesEval:
    action: error

  # No obfuscated code
  obfuscatedCode:
    action: error

  # No telemetry
  telemetry:
    action: error

  # No native code
  nativeCode:
    action: warn

  # License compliance - MIT, Apache-2.0, BSD, ISC only
  nonPermissiveLicense:
    action: error

  # No deprecated or unmaintained dependencies
  deprecated:
    action: warn

  unmaintained:
    action: warn

  # No known vulnerabilities
  knownMalware:
    action: error

  criticalCVE:
    action: error

  highCVE:
    action: error

  mediumCVE:
    action: warn

  # No trivial/empty packages
  emptyPackage:
    action: error

  # Filesystem and environment access awareness
  filesystemAccess:
    action: warn

  environmentVariableAccess:
    action: warn