Reference

Security

EGC maintains a layered security posture: static analysis, supply chain protection, continuous fuzzing, and community-driven scoring.

Security posture

🔍

CodeQL

Static analysis on every PR and weekly scheduled scans. Covers JavaScript and TypeScript, Python, and the GitHub Actions workflows. Advanced query suite enabled.

☁️

SonarCloud

Continuous code quality and security analysis. Tracks reliability, maintainability, and security hotspots on every push.

🤖

Dependabot

Automated dependency update PRs. Grouped by ecosystem (npm). Security alerts and auto-dismissal of dev-only patches enabled.

🔗

Dependency Review

Every PR is scanned for newly introduced vulnerable or license-incompatible dependencies before merge.

💥

ClusterFuzzLite

Continuous fuzzing through ClusterFuzzLite on pull requests and on a weekly batch. The JavaScript harnesses have been active since the upstream blocker tracked in #910 was resolved in July 2026.

🏆

OpenSSF Scorecard

Weekly automated scoring across 20+ security checks: branch protection, signed releases, CI, token permissions, and more.

✅

OpenSSF Best Practices

Best Practices badge passing, plus Baseline Levels 1, 2 and 3. Validates documentation, test coverage, vulnerability reporting process, and project hygiene.

🔗

Socket.dev

Supply chain protection on every PR touching package.json. Catches malicious packages, typosquatting, and obfuscated code before they reach the codebase.

✍️