Kasandro security checks: what runs on every change, and what it found

Every change to Kasandro's code goes through automated security checks, and new findings stop the build: a dependency vulnerability, a leaked secret, a risky code pattern, an alert on the built site. This post lists them and gives the results of their first runs on 13 October 2026. Kasandro's bank connection is not open yet; these checks cover the code and the public site that exist today.

The checks on every change

"Stops the build" means the check turns red and the pull request fails. The ZAP baseline never attacks: it browses the site and reads the responses (what that means is in our ZAP explainer).

Every week Dependabot opens grouped pull requests with the dependency updates it found (dependabot.yml); a weekly routine consolidates all open ones into a single pull request and works on it until every blocking check passes; a human merges it.

First runs, 13 October 2026

• Semgrep: 0 findings.
• OWASP ZAP baseline: 63 checks passed, 0 failed.
• TruffleHog: the whole git history, 0 secrets.
• Dependency scan (OSV-Scanner): it flagged known vulnerabilities, and we upgraded the packages that had a fix (the Anthropic SDK and Prisma's tooling dependencies).
• gitleaks and npm audit at the critical level: passed.

FAQ

Do these checks mean Kasandro is secure?

They are an automatic floor: they catch known classes of mistakes on every change and complement review by people.

Which checks stop the build?

New findings in npm audit (critical), gitleaks, Semgrep (ERROR), TruffleHog (verified secrets), the ZAP baseline and OSV-Scanner stop the build. Dependabot proposes updates.

Where can I report a vulnerability?

Write to support@kasandro.com, our only address, and see the security page and security.txt.