CI Security Gates

CVE Lite Classroom · Learn security by doing.

Classroom repository · CVE Lite CLI repository · CVE Lite website

Prerequisites: Exercise 01 or equivalent dependency-remediation knowledge, basic JavaScript, a terminal and one supported package manager. You should already be able to read a finding, justify a version change and verify a repair. Read the dependency primer first if needed (included as DEPENDENCY-BASICS.md in exported kits).

Allow about 30 minutes as a follow-on to Exercise 01, or 45–60 minutes for students with equivalent knowledge who are new to this activity. Setup, first-time tool familiarization and optional extensions need extra time. The supplied application is self-contained: no previous checkout is needed, but the knowledge prerequisites still apply.

Select npm, pnpm, Yarn Classic, Yarn Berry or Bun.

Read the worksheet, complete the submission, and follow the selected manager's setup. Instructor materials: walkthrough and rubric. Each manager includes a separate solution and historical before/after reports.

Example solution

Open the solution directory for the corrected apps across all five package-manager tracks, worked explanations, and instructor references.

Do not deploy this intentionally vulnerable app. The full safety and setup guides are at the repository root under docs; exported kits include them locally.

What the exercise looks like

Starting point

Local gate rejects the supplied high-severity scenario with exit code 1.

Expected result

Local gate accepts the supplied complete clean scenario with exit code 0.

See screenshot sources and context. Use your own run as submission evidence.