How do you find security vulnerabilities?

Layer several checks, because each one catches a different class of problem.

Your dependencies

This is where most real vulnerabilities live — you did not write the code, but you ship it.

npm audit                # known CVEs in the tree
npm audit fix            # patch what can be patched safely
npx depcheck             # packages you no longer use

Automate it: Dependabot or Renovate open pull requests as advisories appear, and Snyk or Socket add supply-chain signals such as a package suddenly changing maintainer. Treat npm audit output with judgment though — a high-severity finding in a build-only dependency is not the same risk as one in your runtime.

Static analysis of your own code

eslint-plugin-security and eslint-plugin-no-unsanitized flag patterns such as innerHTML with a variable, eval, and dynamic require. Enable TypeScript's strict mode too — a large share of injection bugs start as an unchecked any crossing a boundary.

Add secret scanning (gitleaks, or GitHub's built-in) so a committed key is caught before merge rather than after.

Running the application

Dynamic tools probe the live app: OWASP ZAP for automated scanning, Burp Suite for manual testing. They find what static analysis cannot — authorisation flaws, session handling, misconfigured CORS.

Check your response headers with an external scanner; a missing CSP or HSTS shows up immediately.

The part tools cannot do

Automated scanners are very good at known patterns and useless at logic flaws — an endpoint that checks authentication but forgets to check whose record is being edited looks perfectly fine to every tool. That needs a human reading the code with an attacker's questions in mind: what happens if I change this id, omit this field, send this twice?

Put the cheap checks in CI so they run on every commit, and reserve review time for the authorisation and business-logic paths where the expensive bugs actually are.