Command line — Safe to Send

Run from GitHub

npx github:hassanalshama/safe-to-send proposal.pptx

After the package is published to npm, the shorter command is:

npx safe-to-send proposal.pptx

Global installation from the repository:

npm install --global github:hassanalshama/safe-to-send
safe-to-send proposal.pptx

Directories and standard input

# Scan supported files in one directory
safe-to-send ./release/

# Include nested directories
safe-to-send --recursive ./release/

# Read bytes from stdin
cat final.pdf | safe-to-send --stdin-name final.pdf -

Output formats

safe-to-send --format json final.pdf > report.json
safe-to-send --format markdown final.pptx > report.md
safe-to-send --format html final.pptx --output report.html
safe-to-send --format sarif ./release --recursive > results.sarif

Supported formats are text, JSON, Markdown, standalone HTML, and SARIF 2.1.0. Reports include the SHA-256 fingerprint of every scanned file.

Exit behavior

Code	Meaning
0	Scan completed and no finding met the configured threshold.
1	Argument, input, or scanner execution error.
2	A finding met `--fail-on`.
3	Coverage was incomplete and no finding met the threshold.

# Default: fail on high findings
safe-to-send final.pptx

# Fail on medium or high findings
safe-to-send --fail-on medium final.pptx

# Produce a report without a finding-based failure
safe-to-send --fail-on never --format json final.pptx

GitHub Actions example

name: document-safety
on:
  pull_request:
    paths:
      - "deliverables/**"

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm install --global github:hassanalshama/safe-to-send
      - run: safe-to-send --recursive --fail-on high deliverables/
      - if: always()
        run: safe-to-send --recursive --fail-on never --format sarif deliverables/ > safe-to-send.sarif

For sensitive deliverables, consider whether uploading a SARIF artifact to a hosted system is appropriate. The scanner itself is local, but whatever you do with its report remains your responsibility.

Library API

import { readFile } from 'node:fs/promises';
import { scan, renderMarkdown } from 'safe-to-send';

const bytes = await readFile('proposal.pptx');
const report = await scan(bytes, { name: 'proposal.pptx' });
console.log(renderMarkdown(report));