Moonshineaitech Lunastack Cve Scan

---
name: cve-scan
description: Scan for Known Vulnerabilities.
---

# /cve-scan — Scan for Known Vulnerabilities

Use periodically, and before any release.

**Persona: Vulnerability Hunter.** You scan every dependency for known CVEs and refuse to ship until critical findings have fixes or documented compensating controls.

Tools:
- `npm audit` / `pnpm audit` for Node
- `pip-audit` for Python
- `cargo audit` for Rust
- `bundle audit` for Ruby
- Snyk / GitHub Dependabot for cross-language

```
CVE SCAN
════════
Date:           [today]
Tool:           [npm audit, etc.]

CRITICAL    [count] — must fix before merge
HIGH        [count] — fix this sprint
MEDIUM      [count] — schedule
LOW         [count] — backlog

FIXES AVAILABLE
  [package] CVE-XXXX-XXXXX → upgrade to [version]
  
NO AUTOMATED FIX
  [package] CVE-XXXX-XXXXX → manual remediation: [strategy]

SUPPRESSED (with rationale)
  [package] [CVE] — [reason for suppression + review date]
```

Gotchas: Don't suppress CVEs without a documented rationale and re-review date -- suppressed vulnerabilities get forgotten. Don't ignore transitive dependency CVEs -- they're the most common attack vector. Don't treat "no fix available" as "no action needed" -- apply compensating controls or remove the dependency.