search

jonschlinkert / kind-of

Get the native JavaScript type of a value, fast. Used by superstruct, micromatch and many others!
https://github.com/jonschlnkert
MIT License
347 stars 38 forks source link

Add CodeQL analysis tool #43

Open gabibguti opened 1 year ago

gabibguti commented 1 year ago

Proposal

Hello, I'm working on behalf of Google and the Open Source Security Foundation (OpenSSF) to help open-source projects improve their supply-chain security. Given kind-of project importance to the JavaScript community, the OpenSSF has identified it as one of the 100 most critical open source projects.

Would you consider adopting an analysis tool called CodeQL? CodeQL scans your code for potential vulnerabilities and reports the results as code scanning alerts. It is developed by GitHub and can help improve the project's security posture.

Would you be interested in a PR adding this tool?

Additional Context

To simplify maintainers' lives, CodeQL can be configured with CodeQL GitHub Action. It runs on every change or pull request to the repository's main branch. This Action is recommended by GitHub and Scorecards.

Let me know if you have any questions!

gabibguti commented 10 months ago

Hi! Frindly ping here, if you'd like I believe a SAST, such as CodeQL, would still be a good addition, but it requires some maintainance. So, let me know if you're interested, otherwise we can close as not planned for now :)