How I score the health of a Node.js API in one command

Description and use

A single command scores Node.js API security, detecting missing auth guards and tracking data flow to critical sinks with an explainable score.

Problem

Code review catches logic bugs, but nobody reads every controller to check for a missing auth guard. Nobody traces every req.body to see whether it reaches a SQL string either.

Outcome

The tool provides a single-command health score, identifies missing auth guards, tracks taint flow to critical sinks, and offers an explainable score breakdown, improving security review efficiency.

Workflow

• Run npx @sabahattink/codediag scan . to index files once, respecting .gitignore and skipping large/minified files.
• Parse files with ts-morph to build an AST shared by all analyzers.
• Track taint from request data through up to three assignments into shell, SQL, and eval sinks.
• Generate an explainable score where each lost point maps to a rule ID.
• Integrate into CI using the GitHub Action sabahattink/codediag@v0 with threshold and baseline settings.

Evidence

Code review catches logic bugs, but nobody reads every controller to check for a missing auth guard. Nobody traces every req.body to see whether it reaches a SQL string either.

Source

npx @sabahattink/codediag scan .

Source

Discovery once. Files are indexed a single time, .gitignore-aware, with minified and oversized files skipped.

Source

AST, not regex. ts-morph parses each file once, and all analyzers share the result.

Source

Taint tracking. Request data is followed through up to three assignments into shell, SQL, and eval sinks.

Source

Explainable score. Every lost point maps to a rule ID in the score breakdown.

Source

• uses: sabahattink/codediag@v0

with:
threshold: 80
baseline: .codediag-baseline.json

Source

Path traversal, SSRF, and XSS rules are on the roadmap. Feedback on false positives is the most valuable contribution right now.

Source