Which security rules siro can check for each package manager.
Generic files-field and portable publish-access checks also run on discovered
manifests with unknown PMs. Installation checks run only at
explicit installation roots;
discovering a package does not mean its installation settings were checked.
✅ = a check is implemented · — = no check is implemented.
An absent check says nothing about the manager's capabilities. See the
rule reference for primary inputs, severity overrides, and version notes.
| Rule | Severity | npm | pnpm | yarn | bun | deno | aube |
|---|---|---|---|---|---|---|---|
advisory-check |
warn | — | — | — | — | — | ✅ |
approved-git-repos |
warn | — | — | ✅ | — | — | — |
audit-suppression |
info | — | — | ✅ | — | — | — |
block-auto-install |
warn | — | — | — | ✅ | — | — |
block-exotic-subdeps |
warn | ✅ | ✅ | — | — | — | ✅ |
bun-security-scanner |
info | — | — | — | ✅ | — | — |
checksum-verification |
warn | — | — | ✅ | — | — | — |
commit-lockfile |
error | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
dependency-overrides |
info | — | ✅ | — | — | — | ✅ |
disable-lifecycle-scripts |
error | ✅ | ✅ | ✅ | ✅ | — | ✅ |
enforce-strict-ssl |
warn | ✅ | — | ✅ | — | — | — |
files-field |
info | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
frozen-lockfile |
warn | — | ✅ | ✅ | ✅ | ✅ | ✅ |
frozen-store |
info | — | ✅ | — | — | — | — |
hardened-mode |
warn | — | — | ✅ | — | — | — |
minimum-release-age |
warn | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
named-registries |
info | — | ✅ | — | — | — | — |
paranoid-mode |
info | — | — | — | — | — | ✅ |
patched-dependencies |
info | — | ✅ | — | — | — | — |
pin-exact-versions |
error | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
provenance |
warn | ✅ | ✅ | ✅ | ✅ | — | — |
publish-access |
info | ✅ | ✅ | ✅ | ✅ | — | ✅ |
store-server |
info | — | ✅ | — | — | — | — |
strict-allow-scripts |
warn | ✅ | — | — | — | — | — |
strict-release-age |
info | — | — | — | — | — | ✅ |
strict-store-integrity |
warn | — | — | — | — | — | ✅ |
trust-policy |
warn | — | ✅ | — | — | — | ✅ |
unsupported-settings |
error | ✅ | ✅ | ✅ | ✅ | ✅ | — |