Choose the correct scope
Source mode helps an agent understand a project without following large dependency and cache trees. It lists excluded directories such as node_modules and build caches. Release mode applies no such source-directory exclusions because accidentally shipping a dependency or cache directory is relevant to the delivered artifact.
Run a release audit on the exact output customers will receive. Scanning the repository and assuming its result covers a separately assembled installer can miss copied resources, generated maps or packaging-time configuration. Record both paths when source planning and release screening are part of the same review.
Treat limits as part of the result
The default scanner has deliberate file, aggregate-byte, filesystem-entry and archive-expansion limits. Current documented defaults include 16 MiB per file and 256 MiB aggregate bytes. These boundaries keep local screening bounded; reaching one means some requested content was not fully assessed.
The audit command accepts deliberate larger file and aggregate limits, but increasing them is not a substitute for understanding the specimen. An unexpectedly large nested archive may signal a packaging error. Opaque formats such as ASAR or DMG need the appropriate native workflow, even when the outer file can be hashed.
Gate on status as well as findings
The CLI distinguishes a completed scan below threshold, findings at or above the selected threshold, and an error or incomplete scan. Preserve the exit status in CI. The --fail-on none option does not turn incomplete screening into success, which helps avoid a quiet coverage downgrade.
Review the report’s skipped surfaces and completeness fields alongside severity counts. A credential pattern scanner can report zero matches while missing a secret format it does not recognize. A completed scan means the configured path and byte screening finished, not that API authorization, signing or clone resistance was validated.
Close each gap with an owned next step
For a known large release, choose reviewed byte budgets and rerun. For an unsupported container, identify a native inspection tool and preserve the original artifact while examining an authorized copy. For dynamic security properties, add runtime tests rather than repeatedly scanning the same bytes.
Keep the remaining unknowns in the release record with an owner and disposition. A release may have a consciously accepted limitation, but the report should not hide it. This creates a reliable distinction between a passing scanner invocation and a broader release approval decision made by the team.
Practical checklist
- Use release scope for shipped artifacts.
- Check exit status and completeness.
- Review every skipped or opaque surface.
- Assign native or runtime checks to unresolved questions.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.