Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Audit dependencies for known vulnerabilities as a CI gate
Run a dependency vulnerability audit in CI that fails on high/critical advisories; if you silence audit at install time, ensure a real audit runs elsewhere.
Bad example
| 1 | # .npmrc silences install-time audit for cleaner logs... |
| 2 | audit=false |
| 3 |
|
| 4 | # ...and there is NO audit step anywhere in CI. |
| 5 | # Result: a transitive dep with a published critical CVE |
| 6 | # (e.g. a prototype-pollution or RCE advisory) ships to prod |
| 7 | # and nobody is alerted until it is exploited. |
Explanation (EN)
Disabling install-time audit without an equivalent enforced check removes the intended gate.
Objašnjenje (HR)
Isključivanje audita pri instalaciji bez odgovarajuće obavezne provjere uklanja namjeravanu zaštitu.
Good example
| 1 | pnpm audit --audit-level=high |
Explanation (EN)
A required CI job can run this command and fail on the configured severity; alerts alone do not enforce branch protection.
Objašnjenje (HR)
Obavezni CI job može pokrenuti ovu naredbu i pasti na dogovorenoj ozbiljnosti; same obavijesti ne provode branch protection.
Notes (EN)
When the repository requires a vulnerability gate, verify that the chosen command/check actually runs and blocks the protected branch at the configured severity.
Exceptions / Tradeoffs (EN)
Audits produce false positives and unfixable transitive advisories; triage with an allowlist of reviewed advisory IDs (with expiry) rather than disabling the gate entirely. Pin the audit level (high/critical) to avoid alert fatigue from low-severity noise. Advisory notifications alone are not a CI gate. Do not add personal CI configuration to a company repository without authorization; follow its security ownership and exception process.
Iznimke / Tradeoffi (HR)
Audit može prijaviti neprimjenjive ili trenutačno nepopravljive tranzitivne probleme. Koristi pregledan popis iznimaka s rokom valjanosti i dogovoreni prag ozbiljnosti. Same obavijesti nisu CI provjera koja zaustavlja promjenu. U company repozitorij ne dodaj osobnu CI konfiguraciju bez ovlasti; slijedi postojeći postupak vlasništva i iznimaka.