We are building free open source tools to secure the Node.js & JavaScript ecosystem. Our biggest area of expertise is in package and code analysis.

We are mainly developers who like to build tools that bring you value for free ❤️. Our tools often provide a range of benefits and information such as:

• Non opinionated metrics (On quality and maintainability).
• Very useful information about the projects you use:
  • OpenSSF Scorecard.
  • SPDX license conformance.
  • Vulnerabilities (with support of multiple strategies: NPM, Sonatype, Snyk).
• The different security threats within your codes (detected using our open source SAST JS-X-Ray).

Our tools have proven to be of great use to rigorous developers and package maintainers. But there is still a long way to go to make our tools more accessible to beginners 💪.

We welcome new contributors. Please feel free to join us on Discord and help on the different projects.

It doesn't necessarily matter if you are a beginner in security or not. Many projects require skills that are not directly related to security. So don't feel illegitimate to come and contribute and learn.

Learn how you can contribute by reading our guide:

• For french contributor
• For english contributor