zick

Developer-first supply-chain security CLI.

zick currently provides local developer checks for:

• dependency publish-age checks for npm-compatible projects
• secret scanning through betterleaks or gitleaks
• vulnerability scanning through osv-scanner or trivy
• SBOM generation through syft

Why zick

Modern supply chain attacks exploit the gap between when a package is published and when the community notices something is wrong. zick fresh helps make that gap visible by flagging packages that are newer than your configured age gate.

zick secrets gives the same project-level entry point for local secret scanners, using an installed tool when available and Docker as a fallback.

Commands

zick fresh      Check dependencies for supply chain risk (freshness age gate)
zick secrets    Scan for leaked secrets (betterleaks / gitleaks)
zick scan       Run vulnerability scan (osv-scanner / trivy)
zick sbom       Generate SBOM (syft)
zick audit      Run fresh, secrets, and scan checks
zick hook       Install or remove Git hooks

Supply Chain Freshness

zick fresh queries npm registry metadata for publish timestamps and flags dependencies published within a configurable age window. The default age gate is 7 days.

Supported inputs:

• bun.lock
• pnpm-lock.yaml
• yarn.lock
• package-lock.json
• package.json

With a lockfile, zick checks exact resolved versions. With only package.json, zick checks the current registry latest version for each dependency.

zick fresh .
zick fresh --age-gate 14 --fail-on warn --include-dev .
zick fresh --format json .

RISK   PACKAGE      VERSION   PUBLISHED    AGE
HIGH   some-util    2.1.0     2026-05-25   2 days ago
WARN   another-pkg  1.0.0     2026-05-21   6 days ago
OK     lodash       4.17.21   2021-02-20   5 years ago

2 package(s) below the 7-day age gate.

Flags:

--age-gate int     Flag packages published within this many days (default 7)
--fail-on string   Exit 1 when this risk level is found: high | warn (default "high")
--format string    Output format: table | json (default "table")
--include-dev      Include devDependencies for package.json/package-lock.json

Secret Scanning

zick secrets runs a secret scanner against the target path.

zick secrets .
zick secrets --tool gitleaks .

Supported tools:

• betterleaks
• gitleaks
• auto (currently resolves to betterleaks)

For external tools, zick resolves execution in order:

1. Local binary in $PATH
2. Docker fallback using the tool's container image

Vulnerability Scanning

zick scan runs vulnerability scanners against the target path.

zick scan .
zick scan --tools osv-scanner .
zick scan --tools osv-scanner,trivy .
zick scan --sarif-output zick.sarif .

Supported scanners:

• osv-scanner
• trivy

Like secret scanning, zick uses a local binary first and falls back to Docker.

SBOM Generation

zick sbom generates a software bill of materials with syft.

zick sbom .
zick sbom --format spdx-json --output sbom.json .

Supported formats:

• cyclonedx-json
• spdx-json
• syft-json

Audit

zick audit runs fresh, secrets, and scan in one command.

zick audit .
zick audit --skip-secrets --scan-tools osv-scanner .
zick audit --json-output zick-report.json --html-output zick-report.html .

Audit reports are useful as CI artifacts and local review files. The HTML report is self-contained and can be opened directly in a browser.

Git hooks

zick hook install installs a managed pre-commit hook in the target Git repository. By default the hook runs zick fresh .; add --secrets to also run secret scanning before commits.

zick hook install .
zick hook install --secrets --secrets-tool gitleaks .
zick hook uninstall .

Existing unmanaged hooks are preserved unless --force is passed.

Configuration

Place .zick.yaml at the project root. All fields are optional.

fresh:
  age_gate_days: 7
  include_dev: false
  fail_on: high
  format: table

secrets:
  tool: auto

scan:
  tools: [osv-scanner, trivy]
  sarif_output: ""

sbom:
  format: cyclonedx-json
  output: ""

hook:
  include_secrets: false
  secrets_tool: auto

report:
  json_output: ""
  html_output: ""

Config discovery walks upward from the target path until it finds .zick.yaml. Command-line flags override config values.

GitHub Actions

- uses: m11s-io/zick-action@v1
  with:
    commands: audit
    age_gate_days: 7
    fail_on: high
    secrets_tool: auto
    scan_tools: osv-scanner,trivy
    sarif_output: zick.sarif
    json_output: zick-report.json
    html_output: zick-report.html

Installation

# macOS / Linux (Homebrew)
brew install m11s-io/tap/zick

# Script
curl -sSL https://raw.githubusercontent.com/m11s-io/zick/main/install.sh | sh

# Go install
go install github.com/m11s-io/zick/cmd/zick@latest

Docker:

docker run --rm -v "$(pwd):/src" ghcr.io/m11s-io/zick fresh /src

Roadmap

Stage 1 - CLI foundation and freshness:

• Project scaffold (Go + Cobra)
• zick fresh npm registry freshness check
• bun.lock, package-lock.json, and package.json parsing
• .zick.yaml for fresh and secrets
• zick secrets with betterleaks and gitleaks
• zick scan with osv-scanner and trivy
• zick sbom with syft
• zick audit combining fresh, secrets, and scan
• JSON and self-contained HTML audit reports
• SARIF output wiring for scan
• yarn.lock / pnpm-lock.yaml freshness parsing
• GitHub Actions workflow (zick-action)
• GitHub Action local smoke workflow
• Single binary release configuration via GoReleaser
• Docker image release configuration for ghcr.io/m11s-io/zick

Stage 2 - Ecosystem expansion:

• Multi-ecosystem freshness: PyPI, crates.io, RubyGems, Go

Stage 3 - SBOM and audit:

• Pre-commit hook installer (zick hook)
• Renovate config audit helper

Stage 4 - Platform:

• zick serve REST API
• Helm chart for Kubernetes deployment
• Result persistence and history
• Web dashboard
• Slack / webhook notifications

Contributing

zick is built on Go + Cobra.

cmd/
  zick/
    main.go         root command + execute
    audit.go        zick audit command
    fresh.go        zick fresh command
    scan.go         zick scan command
    sbom.go         zick sbom command
    secrets.go      zick secrets command
    hook.go         zick hook command
internal/
  config/
    config.go       .zick.yaml loader
  fresh/
    npm.go          npm registry client + lockfile parsing
    resolver.go     age gate classification
  hook/
    hook.go         Git pre-commit hook installer
  report/
    report.go       JSON and self-contained HTML audit reports
  tools/
    executor.go     local -> Docker fallback resolution
    betterleaks.go  betterleaks integration
    gitleaks.go     gitleaks integration
    osvscanner.go   osv-scanner integration
    syft.go         syft integration
    trivy.go        trivy integration

License

Apache 2.0