Deep Security Audit

While the core ship runner is optimized for sub-second pre-commit checks, ship security performs a comprehensive, multi-layered inspection across extended credentials, git-tracked secrets, dependency vulnerabilities, and framework authorization antipatterns.

01. Security Telemetry Simulator

Simulate Deep Scanning Outcomes

SCANNER READY

MISSION CONTROL // DEEP SECURITY AUDIT v0.3.7 PID: 8840

$ ship security

ship security

Checks

✓ secrets none found (extended pattern set)

✓ env-files no committed .env files detected

✓ deps Cargo.lock verified (0 advisories)

✓ auth no JWT/auth smells detected

✓ Security scan passed

02. Inspection Domains

Deep Scan Module Breakdown

Check	Target Scope	Heuristics & Flagged Conditions
secrets	EXTENDED	Expanded pattern library beyond the fast scan. Detects JWT tokens & signing secrets, private keys (RSA/EC/OpenSSH/DSA/PGP), GCP service account keys, cloud provider tokens (AWS, Azure, DigitalOcean, Docker Hub, npm, PyPI), and vendor API keys (GitHub, OpenAI, Anthropic, Stripe, Slack, Twilio, SendGrid, Mailgun). Also scans infrastructure and CI files that the fast check skips: Terraform (`.tf`, `.tfvars`), Dockerfiles, `docker-compose.yml`, and Jenkinsfiles.
env-files	CRITICAL	Scans git index for any committed `.env` or `.env.*` files. Automatically distinguishes harmless template files such as `.env.example`, `.env.sample`, and `.env.template` to avoid false positives.
deps	ADVISORY	Parses `Cargo.lock`, `package-lock.json`, `poetry.lock`, `go.sum`, and `requirements.txt`. Flags: Resolved versions matching curated high-severity security advisories (e.g. log4j, minimist, lodash prototype pollution). Missing lockfiles in production application targets (context-aware: skipped for Rust library crates where unpinned `Cargo.lock` is standard). Wildcard `*` or unbounded ranges (`>=x` without upper ceiling) on security-critical dependencies (auth, cryptography, web frameworks). Unpinned floating dependencies in `requirements.txt`.
auth	CODE HEURISTIC	Framework-aware authorization and JWT vulnerability smell detection for JavaScript/TypeScript and Python: Usage of insecure JWT `"none"` algorithm. Hardcoded signing secrets passed as literal strings directly to `jwt.sign`, `verify`, or `encode`. `jwt.verify` or `decode` calls without an explicit `algorithms` allowlist (mitigates algorithm confusion CVEs). Express.js routes on sensitive paths (`/admin`, `/account`, `/payment`, etc.) lacking intervening authorization middleware. Flask routes on sensitive paths missing `@login_required` or `@jwt_required` decorators.

03. CLI Usage & Dedicated Reports

Audit Execution Flags

Run Commands

ship security supports the same composable flags as the primary runner, including non-zero dry runs, check filtering, and dedicated security audit exports:

ship security                          # execute full deep scan
ship security -p /path/to/project      # run on external project directory
ship security -v                       # verbose mode: print line numbers & snippets
ship security -n                       # dry-run mode: report only without failing process
ship security --skip env-files,deps    # skip specific security modules
ship security --only secrets           # isolate a specific check
ship security --json                   # writes ship-security-report.json
ship security --md                     # writes ship-security-report.md

Security Export Sample

{
  "project": {
    "kind": "Node",
    "root": "/workspace/payment-service"
  },
  "results": [
    { "name": "secrets", "status": "pass", "critical": true, "detail": "none found (extended patterns)" },
    { "name": "env-files", "status": "pass", "critical": true, "detail": "no committed .env files" },
    { "name": "deps", "status": "warn", "critical": false, "detail": "1 unbounded dependency range found in package.json (jsonwebtoken: >=8.0.0)" },
    { "name": "auth", "status": "pass", "critical": false, "detail": "no auth smells detected" }
  ]
}