owlwarden

Node and agent config security

Security checks for Node apps and coding-agent config

15 checks cover Node application code and 10 cover coding-agent config. Each finding includes the line, confidence, and a fix. owlwarden turn reports only what this turn introduced.

Install Read 25 rules How turn works
HIGH likely Stack trace leaked in error response A05:2021 app/api/users/route.ts:20:16 18 │ } catch (err) { 19 │ return NextResponse.json( 20 │ { error: err.stack }, │ ~~~~~~~~~ leaks internal stack trace to the client 21 │ { status: 500 } 22 │ )
HIGH likely active Repository config executes a command when the workspace is opened ASI05 .claude/settings.json:27:24 25 │ { 26 │ "type": "command", 27 │ "command": "node .claude/setup.mjs" │ ~~~~~~~~~~~~~~~~~~~~~~~~ runs when the workspace opens (SessionStart) 28 │ } 29 │ ]
Application source and agent workspace in one local scan
npx owlwarden turn          # what did this turn just introduce?
npx owlwarden scan          # your app, whole
npx owlwarden vet .         # your agent's config

Which of these did I just do?

Twenty-five rules on a six-month-old repository produce a backlog. The thing that actually happened is narrower: an agent changed seven files in the last thirty seconds. Of the findings now standing on them, some were there before the turn started and some were not, and only the second kind has an author who is still at the keyboard. 

◉ᴥ◉ turn / 7 files / since HEAD a1b2c3d / 0.31s
✔ clean - nothing introduced
  2 fixed / 5 carried (already at a1b2c3d, not this turn's)

Carried findings never fail a turn, at any threshold. There is no flag that changes it. A control that blocks on debt the turn did not create is a control somebody disables on the second day, and everything it would have caught goes with it. How the verdict works.

Known limits

Read these before treating a clean result as a clean repository.

LimitWhy
9 of 10 OWASP categoriesA04 (Insecure Design) needs design context. See the full mapping.
Origin tracking is one hopNot a full taint engine. Injection-shaped rules cap their confidence instead of guessing.
Agent rules cap at likelyconfirmed means corroborated against a running target, and a config file has none.
25 rules, not thousandsNode web applications and agent configuration. Run Semgrep too.

What gets scanned

15 rules read application code. 10 read agent config. Agent rules cover files loaded from the working tree, including .claude/settings.json, .vscode/tasks.json, .cursor/hooks.json, and CLAUDE.md. These files are not recorded in the lockfile.

Each finding includes a fix for the detected framework or agent host. The rule catalogue shows the tested examples.

Run it from agent hooks

owlwarden init wires gate after edits and before shell commands, and turn at Stop. The agent does not need to remember to call it. Carried findings never fail the turn: an agent handed a repository's inherited debt starts fixing files nobody asked it to touch. 

owlwarden init --claude-code   # Stop hook is turn --hook, not gate
owlwarden init --cursor
owlwarden init --generic       # any host that can run a process

turn / Claude Code / Cursor / MCP / CI / vet / seal / exposure / runtimes / benchmark / Changelog

Common questions

Does owlwarden send my code anywhere?

No. There is no telemetry and no opt-in switch, because there is nothing to switch on. The threat model is on its own page.

Is it free?

MIT OR Apache-2.0, at your option. No account, no seat count, no hosted tier.

Does it replace my existing scanner?

No. Compare its scope with Semgrep, Snyk, model-based review, and eslint-plugin-security.

What changed in the last release?

1.3 added owlwarden turn: only the findings this turn introduced. Carried findings never fail. The changelog has the rest, and an Atom feed.