🛡️ Security, Guard & SBOM

VelociForge ships with two layers of security built-in.

---

Layer 1 — vforge security (CVE & License Audit)

Scans all installed packages for known vulnerabilities and copyleft license risks:

vforge security

What it checks:

• ⚠️ Packages flagged with GPL / AGPL copyleft licenses (viral risk in commercial products).
• 🚨 Packages with suspicious postinstall shell scripts.
• 📋 Generates CycloneDX 1.4 and SPDX 2.3 SBOM manifests automatically.

---

Layer 2 — vforge guard (Zero-Trust Malicious Script Inspector)

Scans lifecycle scripts (preinstall, postinstall, install) of all installed packages for dangerous shell patterns:

vforge guard

Detected Patterns:

Pattern	Risk
curl -s | bash	Remote code execution
wget with pipe	Remote payload delivery
eval(Buffer.from(...))	Obfuscated code execution
base64 -d	Encoded payload decoding
.ssh/id_rsa access	SSH private key harvesting
process.env.AWS_ access	Cloud credential theft

---

📋 SBOM — Software Bill of Materials

Every vforge pack operation automatically generates a CycloneDX 1.4 SBOM inside .vforge.json:

vforge inspect   # View full SBOM in terminal

The SBOM records:

• All dependency names and versions.
• Package URLs (pkg:npm/package@version).
• Timestamp, generator tool, and lockfile fingerprint.