Análisis de seguridad de TestGenAI con ESLint Security y GitHub Actions

TestGenAI is a software quality and testing project that allows users to organize requirements, generate specifications and test cases, review results, and maintain traceability. This review incorporated ESLint Security to analyze TypeScript code using a distinct tool from Sonar, Semgrep, and Snyk. The goal was to obtain reproducible results, review what the alerts meant, and verify that corrections preserved system behavior.

The application uses HTML, CSS, and modular JavaScript for the frontend, while the backend exposes an Express and TypeScript API, storing information in PostgreSQL via Prisma. It includes a deterministic specification and test design engine, as well as optional adapters for Gemini and OpenAI. Test generation does not replace human review, and data such as requirements, cases, revisions, sessions, and executions are stored using twelve Prisma models. The dashboard calculates requirement coverage and state distribution from project data.

ESLint Security, a different tool for static analysis, incorporates rules to flag patterns that may require review, such as dynamic object accesses, potentially problematic regular expressions, usage of eval, and other sensitive Node.js operations. The plugin documentation warns that many results are false positives and require human classification.

After installing ESLint Security as a development dependency and using a separate configuration with the TypeScript parser and recommended rules, 50 security alerts were found. These included 39 dynamic object accesses, 10 potentially insecure regular expressions, and a non-literal RegExp constructor. These results do not equate to 50 confirmed vulnerabilities, as they are not confirmed exploitable routes.

The initial execution also revealed three configuration errors due to TypeScript rule comments, which were corrected by loading the corresponding plugin; these errors are not included in the security alert count.

One alert corresponded to a pattern used to mask card numbers before sending text to an AI provider. The pattern employed a nested block of four-digit repetitions. The transformation was rewritten by enumerating the four groups and their optional separators, preserving the alternative for fifteen-digit numbers, which eliminates the static alert for this pattern while maintaining formats already accepted by the application.

This does not prove that the original expression was exploitable. Additional testing was added for numbers with spaces, dashes, and fifteen digits, as well as a test to verify that the inverse function restores the original data after masking.

Subsequent analysis reported 49 alerts: 39 dynamic object accesses, 9 regular expressions, and a non-literal RegExp. The remaining required review. These findings do not represent a vulnerability-free application. Dependency auditing as a complementary control responds to different questions than code analysis. npm audit initially identified 12 known vulnerabilities in the installed tree: 3 moderate, 5 high, and 4 critical.

After upgrading Vitest and coverage tool to 4.1.11, lint-staged to 17.6.0, and ensuring dependency compatibility, a subsequent npm audit reported zero known vulnerabilities. This result is limited to the tree and audit information at the time of execution, and the CI configuration and Docker now use Node.js 24, compatible with the updated tools.

GitHub Actions automation executes a reproducible installation, ESLint Security analysis, and dependency auditing. The workflow retains the JSON analysis as an artifact and adds a summary with the number of files and alerts. Execution errors cause failure, while recommended rule alerts are retained for review without automatically blocking deployment.

Errors preventing the previous pipeline, such as SQLite connection when PostgreSQL is required by the backend, the mock provider that no longer accepts the configuration, and the reference to an inexistent Docker Compose file, were also corrected. The subsequent local suite passed 59 tests, and the coverage report, with 52 tests, measured 16.43% of lines.

Coverage remains limited, and it is insufficient to rely solely on passed tests to verify the entire backend. Semgrep also found an AES-GCM configuration without an explicit tag length in CryptoVault. Tag length was specified as 16 bytes for both encryption and decryption, and two tests verify the restoration of text and rejection of altered tags or incomplete payloads.

Semgrep's subsequent execution with zero findings in selected JavaScript and TypeScript rules does not resolve the 49 independent ESLint Security alerts. SonarQube Community was also executed in a temporary runner service. The first analysis showed 49 alerts, primarily related to ESLint Security findings, while SonarQube reported no known vulnerabilities in the current state of the project.