Dependency Security Policy

BEPpoker uses npm packages for the React/Vite frontend and Cargo crates for the Tauri/Rust backend. Dependency checks are local commands that can run before a private build or release build.

Required Commands

• npm run security:npm checks npm advisories at moderate severity and higher.
• npm run security:licenses checks npm and Cargo license expressions from local dependency metadata.
• npm run security:cargo-audit checks RustSec advisories when cargo-audit is installed.
• npm run security:cargo-deny checks Cargo advisories, bans, licenses, and sources when cargo-deny is installed.
• npm run security runs the combined security gate.
• npm run notices regenerates THIRD_PARTY_NOTICES.md.
• npm run sbom writes a CycloneDX JSON SBOM to artifacts/sbom/.

Required Tool Installation

The npm audit command is built into npm. The Rust advisory and policy commands require these Cargo tools:

cargo install cargo-audit
cargo install cargo-deny

The project-owned SBOM script does not require cargo-cyclonedx. If a separate Cargo-generated SBOM is needed for a distributor, install it with:

cargo install cargo-cyclonedx

Policy

• Commit lockfiles with release changes.
• Run npm run security before building a release artifact.
• Run npm run notices and npm run sbom before collecting release artifacts.
• Treat npm audit moderate-or-higher findings as release blockers until reviewed.
• Treat RustSec advisories as release blockers until reviewed.
• Treat unreviewed third-party path dependencies as release blockers.
• Allow permissive and notice-based dependency licenses currently represented in deny.toml and scripts/check-license-policy.mjs.
• Review any new copyleft, network-service, proprietary, or missing license expression before accepting the dependency.
• Keep first-party crates and reviewed third-party forks under src-tauri/crates/ so the build is self-contained.
• Track unresolved dependency release decisions in docs/security-review-notes.md.