jscpd

How to Stay Secure with jscpd

Least-privilege permissions

• Restrict code access: Only grant jscpd permission to read the specific source code repositories it needs to scan—don't let it access your entire codebase or sensitive systems.
• Limit report storage: Keep generated reports (which contain code snippets) in restricted folders; don't allow the tool or AI agents to write reports to shared drives or public locations.
• Control CI/CD integration: If using jscpd in automated pipelines, use role-specific service accounts with minimal permissions rather than admin credentials.
• Separate AI agent access: When AI agents consume jscpd results, give them read-only access and prevent them from modifying scanning rules or thresholds.

Network isolation

• Run locally when possible: Keep jscpd scanning on your internal machines or secure CI/CD runners; avoid sending your code to external scanning services unless absolutely necessary.
• Verify no cloud telemetry: Check your jscpd configuration to confirm results and code samples aren't automatically uploaded to third-party services for analysis.
• Firewall npm dependencies: Monitor and audit all software packages jscpd depends on; use a private npm mirror or lock dependency versions to prevent supply-chain attacks through compromised libraries.
• Isolate AI agent communication: If an AI agent uses jscpd results, ensure it operates on a separate network segment from production systems and can't exfiltrate reports.

Monitoring

• Log all scans: Record when jscpd runs, who triggered it, and what code was analyzed; review logs regularly for unauthorized or unusual activity.
• Alert on threshold changes: Set up notifications if someone modifies jscpd's detection rules or sensitivity settings, as this could hide duplicate code intentionally.
• Track report access: Monitor who views or downloads jscpd reports—they contain source code snippets that may be sensitive.
• Watch dependency updates: Regularly check GitHub Security Advisories for vulnerabilities in jscpd and its underlying libraries; plan patching cycles.

Red flags to watch for

• Unexpected external connections: If jscpd or related tools attempt to contact unknown servers or IP addresses, this may indicate malicious activity or misconfiguration.
• Large or unusual reports: Extremely large result files or reports showing patterns that don't match your codebase could indicate tampering or a configuration error.
• Mismatched alert volumes: A sudden drop in duplicate-code alerts after configuration changes might mean rules were weakened to hide problems.
• Unauthorized rule modifications: If AI agents or users can alter detection patterns without approval, malicious actors could disable safeguards.