VULNERABILITY-SCANNING.md

Dependency Vulnerability Scanning

This document describes how AetherMint scans for dependency vulnerabilities, where to find results, and how to respond to findings.

Overview

Three complementary tools cover the full dependency surface:

Tool	Scope	Purpose
npm audit	JS/TS (root, backend, frontend)	Detect known vulnerabilities
cargo audit	Rust contracts	Match against RustSec advisory database
Trivy (filesystem)	All languages + containers	Comprehensive vulnerability scanning

---

Where to Find Results

GitHub Security Tab

Trivy results can be viewed in your local scan output.

Local Scanning

Run scans locally to check for vulnerabilities:

---

Severity Thresholds

npm audit

Run npm audit to check for known vulnerabilities. Critical vulnerabilities should be addressed promptly. Lower-severity findings can be reviewed and prioritized.

To review findings locally:

# Full report (all severities)
npm audit --workspaces

# Specific workspace
npm audit -w backend
npm audit -w frontend

cargo audit

Any matched advisory in the RustSec Advisory Database should be reviewed and addressed. To check locally:

cd contracts
cargo audit

---

Responding to Vulnerabilities

Critical npm vulnerability

1. Check the advisory details to identify the affected package.
2. Update the package manually:

   npm audit fix -w backend    # auto-fix where possible
   npm audit fix -w frontend

3. For vulnerabilities with no upstream fix yet, add an npm audit override in the relevant package.json:

   "overrides": {
     "affected-package": ">=safe-version"
   }

   Document the override with a comment and a link to the advisory.

cargo audit advisory

1. Check cargo audit output for the RUSTSEC advisory ID and affected crate.
2. Update the crate version in contracts/Cargo.toml if a patched version is available.
3. If no fix is available, add an ignore entry to contracts/.cargo/audit.toml:

   [advisories]
   ignore = ["RUSTSEC-YYYY-NNNN"]  # Link: https://rustsec.org/advisories/RUSTSEC-YYYY-NNNN

   Tracked in: open a GitHub Issue with the security label.

Trivy findings

Trivy results identify vulnerabilities in your codebase. Review and address findings promptly.

---

Dependency Updates

Dependencies should be reviewed and updated regularly. Check for vulnerabilities using the local scanning commands above.

---

Running Scans Locally

# npm – all workspaces
npm audit --workspaces --include-workspace-root

# npm – specific workspace
npm audit -w backend
npm audit -w frontend

# Rust
cd contracts && cargo audit

# Trivy (requires trivy CLI)
trivy fs .

---

Scan Schedule

Run vulnerability scans locally on a regular basis to stay on top of dependency issues.

---

Contacts

Security issues: security@aetheredu.xyz (see SECURITY.md)