
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
docguard-cli
Advanced tools
The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.
The enforcement layer for Spec-Driven Development. Validate. Score. Enforce. Ship documentation that AI agents can actually use.
โจ See what DocGuard catches in 30 seconds โ no install, no setup:
npx docguard-cli demoRuns against a baked-in sample project with intentional drift and shows you the findings + a clear path to fixing them.

DocGuard enforces Canonical-Driven Development (CDD) โ a methodology where documentation is the source of truth, not an afterthought. AI writes the docs, DocGuard validates them.
| Traditional Development | Canonical-Driven Development |
|---|---|
| Code first, docs maybe | Docs first, code conforms |
| Docs rot silently | Drift is tracked and enforced |
| Docs are optional | Docs are required and validated |
| One AI agent, one context | Any agent, shared context via canonical docs |
DocGuard is an official GitHub Spec Kit community extension. It validates the artifacts that Spec Kit creates, ensuring your specs stay high-quality throughout the development lifecycle.
๐ Philosophy ยท ๐ CDD Standard ยท โ๏ธ Comparisons ยท ๐บ๏ธ Roadmap
graph TD
CLI["CLI Entry<br/>docguard.mjs"] --> Commands["Commands (17)"]
Commands --> guard["guard"]
Commands --> generate["generate"]
Commands --> score["score"]
Commands --> diagnose["diagnose"]
Commands --> setup["setup wizard"]
Commands --> other["diff ยท init ยท fix ยท trace ยท impact ยท sync<br/>explain ยท memory ยท upgrade ยท agents ยท hooks ยท badge ยท ci ยท watch"]
guard --> Validators["Validators (24)"]
generate --> Scanners["Scanners (4)<br/>routes ยท schemas ยท doc-tools ยท speckit"]
score --> Scoring["Weighted Scoring<br/>8 categories"]
diagnose --> Validators
diagnose --> AIPrompts["AI-Ready<br/>Fix Prompts"]
Validators --> Output["Output"]
Scanners --> Output
Scoring --> Output
Output --> Terminal["Terminal"]
Output --> JSON["JSON"]
Output --> Badge["Badge"]
style CLI fill:#2d5016,color:#fff
style Validators fill:#1a3a5c,color:#fff
style Scanners fill:#1a3a5c,color:#fff
style Output fill:#5c3a1a,color:#fff
Distribution: Node.js core (npm) ยท Python wrapper (PyPI) ยท GitHub Action (
action.yml) ยท Spec Kit Extension (ZIP)
Recent highlights across the v0.16 โ v0.19 line:
docguard explain <validator> โ docguard explain freshness prints purpose, rules, common
failures, and fix recipes for any of the 24 validators. No need to dig into source.docguard memory --diff โ surface what changed in your canonical docs between two refs
(HEAD~10..HEAD by default). Great for code review and changelog drafting.docguard score --diff โ see exactly which validators moved the score up or down between
two commits. Pinpoints regressions without re-running the full suite by hand.docguard upgrade --apply --pr โ when the config schema bumps, DocGuard migrates
.docguard.json for you and (optionally) opens a PR with the change.docguard trace and the guard-time Traceability validator
understand Python, Rust, Go, Java, Ruby, and PHP layouts in addition to JS/TS, via a shared pattern
set (cli/shared-trace-patterns.mjs) so the two never drift apart.freshness to high for production repos,
demote doc-quality to low for prototypes. Configurable per-project..docguard.json โ IDE autocomplete, in-line docs, and validation via
$schema. Shipped in the package at schemas/docguard-config.schema.json.docguardVersion + --pin) โ pin the CLI version your project supports so
CI fails loudly if someone bumps DocGuard without re-running the suite.--quiet, --format json, --write, and --changed-only
automatically suppress the banner so JSON output stays parse-clean.See CHANGELOG.md for the full history.
Package naming: this repo is
raccioly/docguard; the published package isdocguard-clion both npm and PyPI; the installed command isdocguard. Same project โ the-clisuffix is just the registry name. The package runs no install scripts, sonpm i -g docguard-cli --ignore-scriptsis equivalent.
# No install needed โ run directly
npx docguard-cli diagnose
# Or install globally
npm i -g docguard-cli
docguard diagnose
pip install docguard-cli
docguard diagnose
Note: The Python package is a thin wrapper that delegates to
npx. Node.js 18+ is required on the system.
# 1. Initialize docs for your project
npx docguard-cli init
# 2. Or reverse-engineer docs from existing code
npx docguard-cli generate
# 3. AI diagnoses issues and generates fix prompts
npx docguard-cli diagnose
# 4. Validate โ use as CI gate
npx docguard-cli guard
# 5. Check maturity score
npx docguard-cli score
diagnose โ AI reads prompts โ AI fixes docs โ guard verifies
โ โ
โโโโโโโโโโโโโโโโโโ issues found? โโโโโโโโโโโโโโโโโโโโโโโโ
diagnose is the primary command. It runs all validators, maps every failure to an AI-actionable fix prompt, and outputs a remediation plan. Your AI agent runs it, fixes the docs, and runs guard to verify.
DocGuard splits drift into two kinds and is explicit about which is which:
| Kind | Example | How it's fixed |
|---|---|---|
| Mechanical (deterministic) | An endpoint documented in API-REFERENCE.md that the OpenAPI spec confirms is gone | docguard fix --write deletes the row + detail block itself โ no AI |
| Agent (needs judgment) | Rewriting an X-Ray prose section as CloudWatch; writing a new endpoint's request/response | Routed to an AI agent via diagnose / fix --doc prompts |
docguard fix --write only touches docs marked <!-- docguard:generated true --> (override with --force), is idempotent, and prints exactly what changed. It never rewrites prose โ that stays with the agent.
guard โโโถ fix --write (mechanical, auto) โโโถ guard โโโถ diagnose (agent prompts for the rest)
docguard hooks --type pre-commit --auto-fix installs a hook that applies mechanical fixes, re-stages the docs, then runs guard; anything left is surfaced as agent prompts.docguard diagnose --auto scaffolds missing docs and applies mechanical fixes, then emits prompts for the content rewrites that remain.guard/diagnose --format json include a mechanicalFixes array and tag each issue mechanical vs agent, so an agent can apply or delegate precisely.DocGuard is a community extension for GitHub's Spec Kit framework. While Spec Kit focuses on creating specifications (via AI slash commands like /speckit.specify and /speckit.plan), DocGuard focuses on validating their quality.
โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโ
โ Spec Kit โ โ DocGuard โ
โ โ โ โ
โ /speckit.specifyโ โโโโโโโ โ docguard guard โ
โ Creates specs โ โ Validates specs โ
โ (AI-driven) โ โ (automated) โ
โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโ
| Phase | Tool | What happens |
|---|---|---|
| 1. Initialize | specify init | Creates .specify/ directory and templates |
| 2. Write specs | /speckit.specify | AI creates spec.md with FR-IDs, user stories |
| 3. Validate | docguard guard | Checks spec quality (mandatory sections, FR/SC IDs) |
| 4. Plan | /speckit.plan | AI creates plan.md with technical context |
| 5. Validate | docguard guard | Checks plan quality (sections, structure) |
| 6. Tasks | /speckit.tasks | AI creates tasks.md with phased breakdown |
| 7. Validate | docguard guard | Checks task quality (phases, T-IDs) |
| 8. Implement | /speckit.implement | AI writes code |
| 9. Enforce | docguard guard | Final quality gate โ CI/CD |
.specify/memory/constitution.md or project rootspecify extension add docguard
This installs DocGuard's slash commands (/docguard.init, /docguard.guard, /docguard.review, /docguard.fix, /docguard.update) into your AI agent's command palette.
DocGuard ships 17 commands (the "Daily 5" + 12 situational tools, including the zero-install demo). Six additional one-shot scaffolders are accessed via docguard init --with <name>. Eight v0.19 commands continue to work as deprecation aliases through v0.20.x โ see MIGRATION-v0.20.md.
The Daily 5 โ what you'll reach for 95% of the time:
| Command | What It Does |
|---|---|
init | Bootstrap a project (--wizard for interactive ยท --with <name> for scaffolders) |
guard | Validate against canonical docs โ 24 validators |
diff | Show gaps between docs and code (--since <ref> for impact mode) |
sync | Refresh code-truth doc sections โ keeps memory always up to date |
score | CDD maturity score (0-100; --diff for delta between refs) |
Tools (situational, but day-to-day useful):
| Command | Purpose |
|---|---|
demo | Zero-install showcase โ runs guard against a baked-in drifting fixture (npx docguard-cli demo) |
diagnose | AI orchestrator โ guard โ emit fix prompts in one command |
fix | Generate AI fix instructions for specific docs (--doc <name> --format prompt) |
fix --write | Apply deterministic fixes (no AI โ version bumps, counts, anchors, sections) |
fix --history | Audit log of every mechanical fix applied (from .docguard/fixed.json) |
generate | Reverse-engineer docs from existing codebase (--plan for AI scan) |
agent | One-shot agent task graph โ ordered, pre-filled code-truth, per-task verify (--format json) |
explain <warning|CODE> | Paste any warning โ or a finding code like SEC001 โ to get the validator's docstring, fix path, and how to suppress |
verify --semantic | Extract documented numbers/limits/enums (retention days, rate limits, GSI/role counts, status enums) as a task list for an agent to check against code โ the semantic-drift class regex/AST can't see |
feedback | Report likely false positives back to DocGuard โ local-first record + a 1-click prefilled, redacted GitHub issue (zero typing) |
memory | Per-domain accuracy headline (endpoints / entities / env / tech) |
memory --diff | Drill into which specific claims don't match code |
score --diff | Drill into which checks pulled each category down |
trace / trace --reverse <file> | Requirements traceability โ forward AND reverse |
upgrade [--apply] [--pr] | Check + migrate .docguard.json schema; --pr opens a PR |
watch | Live mode: re-run guard on file changes |
init --with <name> scaffolders โ picked at init time:
| Scaffolder | What It Generates |
|---|---|
agents | AGENTS.md, CLAUDE.md, .cursor/rules/, .github/copilot-instructions.md |
hooks | Git pre-commit / pre-push hooks |
ci | GitHub Actions / pipeline YAML |
badge | Shields.io score badges for README |
llms | llms.txt (AI-friendly summary) |
publish | External doc-site config (Mintlify) โ experimental |
Run them solo (docguard init --with hooks) or stacked (docguard init --with agents,hooks,badge,ci).
Deprecation aliases โ setup ยท agents ยท hooks ยท ci ยท badge ยท llms ยท publish ยท impact keep working in v0.20.x with a yellow stderr warning. audit โ guard is permanent (no warning). See MIGRATION-v0.20.md.
| Flag | Description | Commands |
|---|---|---|
--dir <path> | Project directory (default: .) | All |
--verbose | Show detailed output | All |
--quiet / -q | Suppress banner โ for hooks, CI loops, scripts | All |
--format json | Machine-readable output (clean JSON, no ANSI bleed) | guard, score, diff, trace, diagnose, memory, impact, explain |
--force | Overwrite existing files (creates .bak backups) | generate, agents, init |
--force-redo | Bypass ping-pong suppression in .docguard/fixed.json | fix --write |
--profile <name> | Starter / standard / enterprise | init |
--no-spec-kit | Skip auto-init of .specify/ / .agent/ scaffolding | init |
--changed-only [--since <ref>] | Pre-commit lite mode (5 fast validators on changed files only) | guard |
--timings | Per-validator wall-time profile (slowest first) | guard |
--show-failing | Show warnings/errors even when status is PASS | guard |
--pin | Record running CLI version into .docguard.json (reproducibility) | guard |
--diff | Per-category drill-down | score, memory |
--check-only | Exit 1 if behind (for CI) | upgrade |
--apply | Actually run the migration | upgrade |
--pr | Open a PR with the migration | upgrade |
--reverse <file> | Reverse traceability (code โ docs) | trace |
--history | Show fix audit log | fix |
$ npx docguard-cli generate
๐ฎ DocGuard Generate โ my-project
Scanning codebase to generate canonical documentation...
Detected Stack:
language: TypeScript ^5.0
framework: Next.js ^14.0
database: PostgreSQL
orm: Drizzle 0.33
testing: Vitest
hosting: AWS Amplify
โ
ARCHITECTURE.md (4 components, 6 tech)
โ
DATA-MODEL.md (12 entities detected)
โ
ENVIRONMENT.md (18 env vars detected)
โ
TEST-SPEC.md (45 tests, 8/10 services mapped)
โ
SECURITY.md (auth: NextAuth.js)
โ
REQUIREMENTS.md (spec-kit aligned)
โ
AGENTS.md
โ
CHANGELOG.md
โ
DRIFT-LOG.md
Generated: 9 Skipped: 0
DocGuard runs 24 automated validators on every guard check. Every one is language-aware as of v0.16 โ patterns for Python (test_*.py), Rust (tests/*.rs), Go (*_test.go), Java (*Test.java), Ruby (*_spec.rb), PHP, and JS/TS all match.
| # | Validator | What It Checks | Default |
|---|---|---|---|
| 1 | Structure | Required CDD files exist | โ On |
| 2 | Doc Sections | Canonical docs have required sections (or N/A markers) | โ On |
| 3 | Docs-Sync | Routes/services referenced in docs + OpenAPI cross-check | โ On |
| 4 | Drift-Comments | // DRIFT: comments logged in DRIFT-LOG.md (skips test files by default) | โ On |
| 5 | Changelog | CHANGELOG.md has [Unreleased] section | โ On |
| 6 | Test-Spec | Tests exist per TEST-SPEC.md rules | โ On |
| 7 | Environment | Env vars documented, .env.example exists | โ On |
| 8 | Security | No hardcoded secrets in source code | โ On |
| 9 | Architecture | Imports follow layer boundaries (honors config.ignore) | โ On |
| 10 | Freshness | Docs not stale relative to code changes (rename-aware via git log --follow) | โ On |
| 11 | Traceability | Requirement IDs (FR, SC, NFR, US, AC, T) trace to tests | โ On |
| 12 | Docs-Diff | Code artifacts match documented entities | โ On |
| 13 | API-Surface | API-REFERENCE.md endpoints match real routes (OpenAPI cross-check) | โ On |
| 14 | Metadata-Sync | Version refs consistent across docs | โ On |
| 15 | Docs-Coverage | Code features referenced in documentation | โ On |
| 16 | Doc-Quality | Writing quality (readability, passive voice, atomicity, IEEE 830) | โ On |
| 17 | TODO-Tracking | Untracked TODOs/FIXMEs and skipped tests (skips test files by default) | โ On |
| 18 | Schema-Sync | Database models documented in DATA-MODEL.md | โ On |
| 19 | Spec-Kit | Spec quality validation (FR-IDs, mandatory sections, phased tasks) | โ On |
| 20 | Cross-Reference | Internal markdown links + anchors resolve (with "did you mean?" hints) | โ On |
| 21 | Generated-Staleness | source=code sections match scanner output; status: draft doc age | โ On |
| 22 | Canonical-Sync | DocGuard's own README count claims match code-truth (DocGuard repo only โ N/A elsewhere) | โ On |
| 23 | Metrics-Consistency | Hardcoded numbers match actual counts | โ On |
| 24 | Surface-Sync | Item-level enumerable drift โ names in doc tables/lists (commands, validators, etc.) match code-truth (opt-in via surfaceSync.surfaces; N/A unless configured) | โ On |
Per-validator controls (in .docguard.json):
{
"validators": {
"test-spec": false, // disable (kebab-case OR camelCase both accepted)
"freshness": true
},
"severity": {
"todoTracking": "high", // warnings fail CI
"freshness": "low" // warnings ignored for exit code
}
}
DocGuard ships 18 professional templates with metadata, badges, and revision history:
| Template | Type | Purpose |
|---|---|---|
| ARCHITECTURE.md | Canonical | System design, components, layer boundaries |
| DATA-MODEL.md | Canonical | Schemas, entities, relationships |
| SECURITY.md | Canonical | Auth, permissions, secrets management |
| TEST-SPEC.md | Canonical | Test strategy, coverage requirements |
| ENVIRONMENT.md | Canonical | Environment variables, deployment config |
| REQUIREMENTS.md | Canonical | Spec-kit aligned FR/SC IDs, user stories |
| DEPLOYMENT.md | Canonical | Infrastructure, CI/CD, DNS |
| ADR.md | Canonical | Architecture Decision Records |
| ROADMAP.md | Canonical | Project phases, feature tracking |
| KNOWN-GOTCHAS.md | Implementation | Symptom โ gotcha โ fix entries |
| TROUBLESHOOTING.md | Implementation | Error diagnosis guides |
| RUNBOOKS.md | Implementation | Operational procedures |
| VENDOR-BUGS.md | Implementation | Third-party issue tracker |
| CURRENT-STATE.md | Implementation | Deployment status, tech debt |
| AGENTS.md | Agent | AI agent behavior rules |
| CHANGELOG.md | Tracking | Change log |
| DRIFT-LOG.md | Tracking | Deviation tracking |
| llms.txt | Generated | AI-friendly project summary (llmstxt.org) |
DocGuard works with every major AI coding agent. All canonical docs are plain markdown โ no vendor lock-in.
| Agent | Compatibility | Auto-Generate Config |
|---|---|---|
| Google Antigravity | โ | docguard agents --agent antigravity |
| Claude Code | โ | docguard agents --agent claude |
| GitHub Copilot | โ | docguard agents --agent copilot |
| Cursor | โ | docguard agents --agent cursor |
| Windsurf | โ | docguard agents --agent windsurf |
| Cline | โ | docguard agents --agent cline |
| Google Gemini CLI | โ | docguard agents --agent gemini |
| Kiro (AWS) | โ | โ |
DocGuard provides AI agent slash commands for integrated workflows. Installed automatically via docguard init or specify extension add docguard:
| Command | What It Does |
|---|---|
/docguard.init | Initialize Canonical-Driven Development in a new or existing project |
/docguard.guard | Run quality validation โ check all 24 validators |
/docguard.review | Analyze doc quality and suggest improvements |
/docguard.fix | Generate targeted fix prompts for specific issues |
/docguard.update | Update canonical docs after code changes โ detect drift and sync documentation |
These commands are installed into your AI agent's command directory:
.github/commands/ โ GitHub Copilot
.cursor/rules/ โ Cursor
.gemini/commands/ โ Google Gemini
.claude/commands/ โ Claude Code
.agents/workflows/ โ Antigravity
Beyond slash commands, DocGuard provides 4 enterprise-grade AI skills โ deep behavior protocols that tell AI agents not just what to run, but how to think, validate, and iterate. Skills are modeled after Spec Kit's skill architecture.
| Skill | Lines | What It Does |
|---|---|---|
docguard-guard | 155 | 6-step quality gate with severity triage (CRITICALโLOW), structured reporting, remediation |
docguard-fix | 195 | 7-step research workflow with per-document codebase research and 3-iteration validation loops |
docguard-review | 170 | Read-only semantic cross-document analysis with 6 analysis passes and quality scoring |
docguard-score | 165 | CDD maturity assessment with ROI-based improvement roadmap and grade progression |
DocGuard integrates into the spec-kit workflow as an automated quality gate:
| Hook | When | Behavior |
|---|---|---|
after_implement | After /speckit.implement | Mandatory โ always runs DocGuard guard |
before_tasks | Before /speckit.tasks | Optional โ reviews doc consistency |
after_tasks | After /speckit.tasks | Optional โ shows CDD maturity score |
For advanced users and CI/CD pipelines, DocGuard includes bash scripts with --json output:
| Script | Purpose |
|---|---|
docguard-check-docs.sh | Discover project docs, return JSON inventory with metadata |
docguard-suggest-fix.sh | Run guard, parse results, output prioritized fixes |
docguard-init-doc.sh | Initialize canonical doc with metadata header |
Three real-world projects to see DocGuard in action:
| Example | Scenario | What You'll See |
|---|---|---|
| 01-express-api | Node.js API with zero docs | Cold-start: generate โ instant coverage |
| 02-python-flask | Python app with drifted docs | Drift detection: catch when docs lie |
| 03-spec-kit-project | Full CDD + Spec Kit | Gold standard: what maturity looks like |
See examples/README.md for step-by-step instructions.
npm test # 33 tests across 18 describe blocks
Covers all 15 CLI commands, project type detection, compliance profiles, JSON output format, and help completeness.
| Node.js | OS | Status |
|---|---|---|
| 18 | ubuntu-latest | โ |
| 20 | ubuntu-latest | โ |
| 22 | ubuntu-latest | โ |
DocGuard runs its own guard, score, diff, diagnose, and badge commands against itself in CI โ ensuring the tool passes its own checks.
Full recipes: see
docs-canonical/CI-RECIPES.mdfor guard, auto-fix (commits mechanical fixes back to PRs), nightly sync, score-on-PR, and pre-commit configs.
name: DocGuard Guard
on: [pull_request, push]
jobs:
docguard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: raccioly/docguard@v0.12.0
with:
command: guard
name: DocGuard Auto-Fix
on: { pull_request: { types: [opened, synchronize, reopened] } }
permissions: { contents: write, pull-requests: write }
jobs:
autofix:
runs-on: ubuntu-latest
if: github.event.pull_request.head.repo.full_name == github.repository
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
token: ${{ secrets.GITHUB_TOKEN }}
fetch-depth: 0
- uses: raccioly/docguard@v0.12.0
with: { command: fix, auto-commit: 'true', comment-on-pr: 'true' }
npx docguard-cli hooks --type pre-commit
Two ready-to-use templates ship with the Spec Kit extension and as standalone files:
extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml โ mandatory CI gateextensions/spec-kit-docguard/templates/github-workflows/docguard-autofix.yml โ PR auto-fixyour-project/
โโโ .specify/ # Spec Kit (if using specify init)
โ โโโ specs/
โ โ โโโ 001-feature/
โ โ โโโ spec.md # Requirements (FR-IDs, user stories)
โ โ โโโ plan.md # Implementation plan
โ โ โโโ tasks.md # Task breakdown
โ โโโ memory/
โ โ โโโ constitution.md # Project principles
โ โโโ templates/
โ
โโโ docs-canonical/ # CDD canonical docs (the "blueprint")
โ โโโ ARCHITECTURE.md # System design, components
โ โโโ DATA-MODEL.md # Database schemas
โ โโโ SECURITY.md # Auth, permissions, secrets
โ โโโ TEST-SPEC.md # Required tests, coverage
โ โโโ ENVIRONMENT.md # Environment variables
โ โโโ REQUIREMENTS.md # Spec-kit aligned FR/SC IDs
โ
โโโ docs-implementation/ # Current state (optional)
โ โโโ KNOWN-GOTCHAS.md
โ โโโ TROUBLESHOOTING.md
โ โโโ RUNBOOKS.md
โ โโโ CURRENT-STATE.md
โ
โโโ AGENTS.md # AI agent behavior rules
โโโ CHANGELOG.md # Change tracking
โโโ DRIFT-LOG.md # Documented deviations
โโโ llms.txt # AI-friendly summary
โโโ .docguard.json # DocGuard configuration
Create .docguard.json in your project root (auto-generated by docguard init):
{
"projectName": "my-project",
"version": "0.4",
"profile": "standard",
"projectType": "webapp",
"validators": {
"structure": true,
"docsSync": true,
"drift": true,
"changelog": true,
"testSpec": true,
"security": true,
"environment": true,
"docQuality": true,
"specKit": true
}
}
See Configuration Guide for all options.
DocGuard's quality evaluation and documentation generation patterns are informed by peer-reviewed research from the University of Arizona and the Joint Interoperability Test Command (JITC), U.S. Department of Defense:
Lead researcher: Martin Manuel Lopez ยท ORCID 0009-0002-7652-2385
See CONTRIBUTING.md for full citations.
MIT โ Free to use, modify, and distribute.
Made with โค๏ธ by Ricardo Accioly
FAQs
The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.
The npm package docguard-cli receives a total of 314 weekly downloads. As such, docguard-cli popularity was classified as not popular.
We found that docguard-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.