# ------------------------------------------------
# CITATION.cff file created with {cffr} R package
# See also: https://docs.ropensci.org/cffr/
# ------------------------------------------------
 
cff-version: 1.2.0
message: 'To cite package "pkgaudit" in publications use:'
type: software
license: Apache-2.0
title: 'pkgaudit: Static Analysis Security Testing (SAST) for R Packages'
version: 0.4.0
identifiers:
- type: doi
  value: 10.32614/CRAN.package.pkgaudit
abstract: A static analysis tool that flags security-relevant files and code in R
  source packages for human review without executing anything it scans. Models package
  lifecycle execution semantics -- it reports not just what a package does, but when
  it runs, so code that executes on install or load is distinguishable from code that
  runs only when called. Reads every surface a package can execute, including 'configure'
  scripts, help-file macros, and vignettes, and states what it could not read, so
  a clean result can be checked rather than trusted. Detection rules are data, shipped
  in a versioned and hash-verified 'SQLite' database.
authors:
- family-names: Smith
  given-names: Tyler
  email: tylerjssmith@gmail.com
  orcid: https://orcid.org/0000-0003-4692-2206
preferred-citation:
  type: manual
  title: 'pkgaudit: Static Analysis Security Testing (SAST) for R Packages'
  authors:
  - family-names: Smith
    given-names: Tyler
    orcid: https://orcid.org/0000-0003-4692-2206
    email: tylerjssmith@gmail.com
  notes: R package version 0.4.0
  year: '2026'
  url: https://github.com/tylerjssmith/pkgaudit
repository: https://ropensci-staging.r-universe.dev
repository-code: https://github.com/tylerjssmith/pkgaudit
commit: 4279f8f5d42300ba9cc860db490392af2ca64b2f
url: https://tylerjssmith.github.io/pkgaudit/
date-released: '2026-09-17'
contact:
- family-names: Smith
  given-names: Tyler
  email: tylerjssmith@gmail.com
  orcid: https://orcid.org/0000-0003-4692-2206