JavaScript/TypeScript

This article shows you how to analyze your applications written in JavaScript or TypeScript (including those that use the Angular, React.js, and Vue.js frameworks) using Qwiet AI by Harness. It assumes that you have already set up and authenticated with Qwiet.

note

Qwiet offers sample applications that you can use to run and test Qwiet AI by Harness. They also include functioning configuration files to demonstrate how you can leverage GitHub Actions to automate code analysis whenever you open a new Pull Request (PR).

• Angular
• JavaScript
• React
• Vue.js
• TypeScript

Requirements

See Prerequisites for more information.

Analyzing your JavaScript application

JavaScript (Source) - Preferred

To analyze your JavaScript application without the need to build it, run:

sl analyze --app <name> --jssrc [<path>]

Parameter	Description
--app <name>	The name of the application to be analyzed (maximum length: 100 characters)
--jssrc	The flag identifying the application's language
<path>	The path to the application directory

See the CLI reference for additional sl analyze options.

Additional parameters

The analysis accepts additional parameters after a double hyphen --.

For example, the following excludes any folder with tests in its path:

sl analyze --jssrc /path/to/my/javascript-project -- --exclude-regex 'tests'

Such parameters, if valid, are passed directly to the JavaScript plugin.

Parameter	Description
--exclude <path>	Exclude the specified file/directory during code analysis; can be relative to the project directory or absolute; can be specified multiple times
--exclude-regex <value>	A regex specifying files to exclude (matched against paths relative to the input directory)
--output <value>	The CPG output file name (defaults to cpg.bin.zip)

SCA

To identify open-source vulnerabilities, Qwiet AI by Harness automatically searches for build manifests in the project path you provided when running sl analyze. However, depending on how your project repo is structured, you may need to provide --oss-project-dir <project-path> so that Qwiet AI by Harness can identify where your dependencies are located.

SCA requires a lock file (package-lock.json, yarn.lock, pnpm-lock.yaml, or Rush.js). If your repository does not include one, generate it before running sl analyze — for example:

npm install --package-lock-only

This creates a package-lock.json without installing packages into node_modules. For other package managers, consult their documentation for the equivalent command.

Tagging results with your branch name

To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:

sl analyze --tag branch=$(git symbolic-ref --short HEAD)

If you're working in a GitHub environment (e.g., GitHub Actions), you can also use --tag branch=${{ github.head_ref }} to populate your branch name.

If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.

Troubleshooting

If you have any issues scanning your project, please see our general troubleshooting page, as well as the JavaScript-specific suggestions below.

Excluding files / directories

The analysis automatically excludes several directories by default, including node_modules, dist, build, test, tests, vendor, and others. Use --exclude (for specific paths) or --exclude-regex (for a regex pattern) to exclude additional files or directories.

No findings found

If a scan returns no findings, re-run with verbose logging enabled to see which files were included in the analysis. The output will show which files were skipped due to default exclusion rules or user-provided exclusion flags.

Zero files parsed

If no source files are parsed at all, your project's source files may all fall under a default-excluded directory (e.g., the entire project is inside a dist/ or build/ folder). Check the verbose logs to confirm. Restructure your project so that source files are not under a default-excluded path, or use --exclude-regex with a pattern that does not match your source files.

JavaScript

caution

--js is deprecated. Use --jssrc instead — it requires no build step and is the preferred way to analyze JavaScript and TypeScript applications.

To analyze your JavaScript application, run:

# Ensure node_modules does not exist
sl analyze --app <name> --js [<path>]

Parameter	Description
--app <name>	The name of the application to be analyzed (maximum length: 100 characters)
--js	The flag identifying the application's language
<path>	The path to the application directory

See the CLI reference for additional sl analyze options.

SCA

To identify open-source vulnerabilities, Qwiet AI by Harness automatically searches for build manifests in the project path you provided when running sl analyze. However, depending on how your project repo is structured, you may need to provide --oss-project-dir <project-path> so that Qwiet AI by Harness can identify where your dependencies are located.

Tagging results with your branch name

To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:

sl analyze --tag branch=`git symbolic-ref --short HEAD`

If you're working in a GitHub environment (e.g., GitHub Actions), you can also use --tag branch=${{ github.head_ref }} to populate your branch name.

If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.

Additional parameters

The analysis accepts additional parameters after a double hyphen --.

For example, the following ignores minified JavaScript sources in the analysis and uses a custom package.json in the config sub-directory:

sl analyze --app Xyz --js /path/to/my/typescript-project -- --ignore-minified --package-json /path/to/my/typescript-project/config/package.json

Such parameters, if valid, are passed directly to the JavaScript plugin.

Parameter	Description
--package-json <path>	The custom path to package.json (by default, Qwiet AI by Harness looks for the file in the JavaScript project directory)
--output <value>	The CPG output file name (defaults to cpg.bin.zip if none provided)
--no-ts	Exclude TypeScript sources from the analysis (by default, Qwiet AI by Harness includes Typescript sources)
--no-babel	Exclude Babel sources in the analysis (by default, Qwiet AI by Harness includes Babel sources)
--no-vue-js	Exclude Vue.js sources in the analysis (by default, Qwiet AI by Harness includes Vue.js sources)
--no-nuxt-js	Exclude Nuxt.js sources in the analysis (by default, Qwiet AI by Harness includes Nuxt.js sources)
--no-templates	Exclude EJS and Pug template sources in the analysis (by default, Qwiet AI by Harness includes EJS and Pug template sources)
--include-minified	Include minified Javascript sources (e.g., filenames ending with -min.js or .min.js) in the analysis (by default, Qwiet AI by Harness excludes all such sources)
--include-tests	Include test files (typically required for sample vulnerable apps, such as OWASP Juice Shop)
--exclude <path>	Exclude the specified file/directory during code analysis; the path provided must either be an absolute path or a relative path to the project directory; can be specified multiple times
--exclude-html	Exclude HTML files from the analysis
--exclude-regex <value>	A regex specifying the files to exclude during the analysis (the match is to the absolute file path), e.g., --exclude-regex ".*([-.])min\\.js" or `--exclude-regex ".*.(spec
--exclude-private-deps	Exclude private modules/dependencies in node_modules (defaults to false)
--all-dependencies	Install all project dependencies during transpilation. May result in slow execution times depending on your project setup and network speed. Defaults to false. If this option is not used, only a minimal set of dependencies relevant for transpilation is installed (and may result in faster execution times).
--private-deps-ns <dep1>,<dep2>,...	Additional private dependencies you would like to be analyzed from node_modules