Build your own security checks into your repo

Add automated security checks to this repo, using GitHub Actions and free tools only. Show me each file before you commit it.
1. Secrets: add .github/workflows/gitleaks.yml that runs gitleaks/gitleaks-action@v3 on pull requests and pushes to main, with actions/checkout@v7 and fetch-depth: 0. Add a .pre-commit-config.yaml with the gitleaks hook.
2. Dependencies: add .github/dependabot.yml for npm and github-actions. Add a workflow that runs npm audit --audit-level=high (or pnpm audit --audit-level high if this repo uses pnpm).
3. Browser bundle: add scripts/check-client-secrets.mjs that fails when the value of any server only environment variable, or a known secret key format, appears in the built browser files. Run it right after the build in package.json.
4. Live site: add scripts/check-live-headers.mjs and a daily scheduled workflow that fetches my production URL and fails if Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options or frame protection is missing, or a cookie lacks Secure, SameSite or (for login cookies) HttpOnly.
5. If this app uses Supabase: add tests/rls.test.mjs that uses only the public anon or publishable key and asserts every table that should be private returns no rows. List the tables you treated as private and ask me to confirm.
Never put a secret key in any of these files. Use GitHub Actions secrets or variables for anything the workflows need.

name: gitleaks

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Only needed for repos owned by an organization, not a personal account.
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1
    hooks:
      - id: gitleaks

gitleaks git -v --redact

version: 2
updates:
  - package-ecosystem: npm # also covers pnpm and Yarn lockfiles
    directory: /
    schedule:
      interval: weekly
    groups:
      minor-and-patch:
        update-types: [minor, patch]
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly

name: dependency audit

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
      # Fails on high or critical advisories. Reads package-lock.json, no install needed.
      - run: npm audit --audit-level=high

// Fails the build when a server secret shows up in files sent to browsers.
// Usage: node scripts/check-client-secrets.mjs [folder ...]
import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
import { join } from "node:path";

// Folders your framework writes browser code to. Pass your own if they differ.
const dirs = process.argv.slice(2);
if (dirs.length === 0) dirs.push(".next/static", "dist");

// Frameworks put variables with these prefixes into browser code on purpose.
const PUBLIC = /^(NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|PUBLIC_|NUXT_PUBLIC_)/;
const SECRET_NAME = /KEY|SECRET|TOKEN|PASSWORD|PRIVATE|SERVICE_ROLE|DATABASE_URL/;
const SHAPES = [
  ["Stripe secret key", /\b[rs]k_live_[A-Za-z0-9]{20,}/],
  ["Supabase secret key", /\bsb_secret_[A-Za-z0-9_-]{20,}/],
  ["Anthropic API key", /\bsk-ant-[A-Za-z0-9_-]{20,}/],
  ["OpenAI API key", /\bsk-proj-[A-Za-z0-9_-]{20,}/],
  ["AWS access key", /\bAKIA[0-9A-Z]{16}\b/],
  ["GitHub token", /\bgh[pousr]_[A-Za-z0-9]{36,}/],
];

// Server only values from the environment and local .env files.
const env = { ...process.env };
for (const file of [".env", ".env.local", ".env.production"]) {
  if (!existsSync(file)) continue;
  for (const line of readFileSync(file, "utf8").split(/\r?\n/)) {
    const m = line.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
    if (m) env[m[1]] ??= m[2].trim().replace(/^["']|["']$/g, "");
  }
}
const secrets = Object.entries(env).filter(
  ([name, value]) => SECRET_NAME.test(name) && !PUBLIC.test(name) && value?.length >= 12,
);

function* walk(dir) {
  for (const name of readdirSync(dir)) {
    const path = join(dir, name);
    if (statSync(path).isDirectory()) yield* walk(path);
    else if (/\.(js|mjs|cjs|html|json|map|txt)$/.test(name)) yield path;
  }
}

const found = dirs.filter((d) => existsSync(d));
if (found.length === 0) {
  console.error(`None of ${dirs.join(", ")} exist. Build first, or pass your output folder.`);
  process.exit(2);
}

const problems = [];
for (const dir of found) {
  for (const file of walk(dir)) {
    const text = readFileSync(file, "utf8");
    for (const [label, re] of SHAPES) if (re.test(text)) problems.push(`${label} in ${file}`);
    for (const [name, value] of secrets) {
      if (text.includes(value)) problems.push(`value of ${name} in ${file}`);
    }
  }
}

if (problems.length > 0) {
  console.error(`Server secrets in browser files:\n  ${problems.join("\n  ")}`);
  console.error("Rotate each key that shipped, then move the code that uses it to the server.");
  process.exit(1);
}
console.log(`No server secrets in ${found.join(", ")}. Values checked: ${secrets.length}.`);

{
  "scripts": {
    "build": "next build && node scripts/check-client-secrets.mjs"
  }
}

// Checks the security headers and cookie flags your live site sends.
// Usage: node scripts/check-live-headers.mjs https://your-app.com
const url = process.argv[2];
if (!url) {
  console.error("Usage: node scripts/check-live-headers.mjs https://your-app.com");
  process.exit(2);
}

const res = await fetch(url, { redirect: "follow" });
const h = res.headers;
const problems = [];

const hsts = h.get("strict-transport-security") ?? "";
const maxAge = Number(hsts.match(/max-age="?(\d+)/i)?.[1] ?? 0);
if (maxAge < 15552000) problems.push("Strict-Transport-Security missing or under 6 months");

const csp = h.get("content-security-policy") ?? "";
if (!csp) problems.push("Content-Security-Policy missing");

if (!/nosniff/i.test(h.get("x-content-type-options") ?? "")) {
  problems.push("X-Content-Type-Options: nosniff missing");
}
if (!h.get("x-frame-options") && !/frame-ancestors/i.test(csp)) {
  problems.push("No X-Frame-Options and no frame-ancestors in the CSP");
}

for (const cookie of h.getSetCookie()) {
  const name = cookie.split("=")[0].trim();
  const attrs = cookie.split(";").slice(1).map((a) => a.trim().toLowerCase());
  const has = (flag) => attrs.some((a) => a === flag || a.startsWith(`${flag}=`));
  if (!has("secure")) problems.push(`Cookie ${name} has no Secure flag`);
  if (!has("samesite")) problems.push(`Cookie ${name} has no SameSite attribute`);
  // Login cookies should be out of reach of page scripts. Supabase's own
  // sb-...-auth-token cookies and CSRF cookies are script readable by design.
  const login = /sess|auth|token|jwt/i.test(name) && !/^sb-|csrf|xsrf/i.test(name);
  if (login && !has("httponly")) problems.push(`Cookie ${name} has no HttpOnly flag`);
}

if (problems.length > 0) {
  console.error(`${res.url}\n  ${problems.join("\n  ")}`);
  process.exit(1);
}
console.log(`${res.url}: headers and cookies pass`);

name: live headers

on:
  schedule:
    - cron: "17 6 * * *" # every day at 06:17 UTC
  workflow_dispatch:

permissions:
  contents: read

jobs:
  headers:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
      - run: node scripts/check-live-headers.mjs https://your-app.com

// Checks that tables meant to be private return nothing to the public key.
// Run with: node --test tests/rls.test.mjs
import assert from "node:assert/strict";
import { test } from "node:test";

const url = process.env.SUPABASE_URL; // https://YOUR_PROJECT_REF.supabase.co
const key = process.env.SUPABASE_ANON_KEY; // the anon or sb_publishable_ key
// Every table a signed out visitor should not be able to read.
const PRIVATE_TABLES = ["profiles", "orders", "messages"];

for (const table of PRIVATE_TABLES) {
  test(`${table} returns no rows to the public key`, async () => {
    const res = await fetch(`${url}/rest/v1/${table}?select=*&limit=1`, {
      headers: { apikey: key },
    });
    // 401 or 403 means permission denied, which is also closed.
    if (res.status === 401 || res.status === 403) return;
    assert.equal(res.status, 200, `${table}: unexpected status ${res.status}`);
    assert.deepEqual(await res.json(), [], `${table} is readable with the public key`);
  });
}

name: supabase rls

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "43 6 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  rls:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
      - run: node --test tests/rls.test.mjs
        env:
          SUPABASE_URL: ${{ vars.SUPABASE_URL }}
          SUPABASE_ANON_KEY: ${{ vars.SUPABASE_ANON_KEY }}

name: semgrep

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    # Skip Dependabot's pull requests, as Semgrep's own sample does.
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v7
      - run: semgrep scan --config auto --error