# Vulnerability Scanning {#vulnerability-scanning}


Automated security scanning for the Gauzy codebase.


## Dependency Scanning {#dependency-scanning}



### npm/Yarn Audit {#npmyarn-audit}


```bash
# Check for known vulnerabilities
yarn audit

# Fix automatically where possible
yarn audit fix
```


### Snyk {#snyk}


```bash
# Install Snyk
npm install -g snyk

# Test for vulnerabilities
snyk test

# Monitor project
snyk monitor
```


## Container Scanning {#container-scanning}



### Trivy {#trivy}


```bash
# Scan Docker image
trivy image ghcr.io/ever-co/gauzy-api:latest

# Scan filesystem
trivy fs .
```


### GitHub Security {#github-security}


Enable GitHub vulnerability alerts:

1. Repository **Settings** → **Code security and analysis**
2. Enable **Dependabot alerts**
3. Enable **Dependabot security updates**
4. Enable **Code scanning** with CodeQL


## CI/CD Integration {#cicd-integration}


```yaml
# In GitHub Actions
- name: Security Scan
  uses: snyk/actions/node@master
  with:
    args: --severity-threshold=high
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

- name: Container Scan
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ghcr.io/ever-co/gauzy-api:latest
    severity: CRITICAL,HIGH
```


## Scan Schedule {#scan-schedule}


| Type              | Frequency  | Tool       |
| ----------------- | ---------- | ---------- |
| Dependency audit  | Daily      | Dependabot |
| Container scan    | Per build  | Trivy      |
| SAST              | Per PR     | CodeQL     |
| Secrets detection | Per commit | GitLeaks   |


## Related Pages {#related-pages}


- [Security Overview](https://sourcey-gauzy.pages.dev/security/security-overview/index.md) — security guide
- [Security Headers](https://sourcey-gauzy.pages.dev/security/security-headers/index.md) — headers config