Repository quality rating

[luisfer]

Implement key security hardening, noise reduction, and credibility improvements.

This PR addresses the top recommendations from a recent repo evaluation, focusing on safer command execution, reducing false positives by excluding test files, and enforcing code quality through linting in CI to improve overall reliability and trustworthiness.

---

 

---

Note

Medium Risk
Touches core scanning, fix application, and git/CI execution paths; while changes are mostly additive and covered by new tests, regressions could affect scan results or CI gating behavior.

Overview
Hardens and expands the CLI scan pipeline by adding --scorecard JSON output (including per-scanner runtime/stats), introducing policy presets via --policy, and tightening fix application controls with --fix-level gating for auto-fixes.

Reduces scan noise and improves accuracy by default-ignoring tests/coverage/tmp artifacts across scanners (unless --detailed), refactoring SecurityScanner checks into dedicated executors, skipping link checks in --skip-build, and improving secret detection/redaction (including avoiding false positives on regex literals).

Improves supply-chain/CI credibility by adding a CLI-docs drift check (docs:cli-sync), running npm audit and eslint in CI/release workflows, adding conditional Jest coverage thresholds in CI, and updating git operations to use spawnSync with safe ref/branch validation to mitigate command-injection risks.

^{Written by Cursor Bugbot for commit 4adfdbe. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on March 9

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Policy presets never enable fast mode as intended

Medium Severity

The startup and ai-prototype policy presets check typeof scanOptions.fast === 'undefined' before setting fast = true, but buildScanOptions always produces a boolean for fast via options.fast ?? defaults.fast ?? false. Since fast is never undefined after buildScanOptions, these policies silently fail to enable fast mode. The strict-prod and regulated policies work correctly because they unconditionally assign fast = false.

Additional Locations (2)

• src/cli/shared.ts#L203-L204
• src/cli/shared.ts#L140-L141