v1.0.0

Added

• A static native detector-pack registry now owns 49 first-party rule IDs across eight packs and
  29 independently failing analyzers. Existing AI/framework packs retain their scanner behavior.
• A fail-closed Opengrep reconciliation layer promotes the parity-proven JavaScript/TypeScript
  weak-hash and weak-cipher rules into a native SAST pack before routing and deduplication. Exact
  matches surface native-only provenance; Opengrep remains physically active and wins on reference-
  only or metadata-mismatch cases, while native-only candidates are suppressed. If Opengrep cannot
  run, the native implementation is the explicit fallback. Shadow parity remains a release gate.
• An additive Flutter/Dart pack contributes ci-flutter-tls-verification-disabled,
  ci-flutter-sensitive-shared-preferences, ci-flutter-webview-untrusted-content,
  ci-flutter-sensitive-log, ci-flutter-supabase-privileged-key-client, and
  ci-flutter-cleartext-network. These first-party structural checks run only when Flutter is
  detected and do not replace runtime mobile testing, the separate native platform configuration
  packs, or Pub vulnerability/SBOM analysis.
• Android and iOS configuration packs add eight first-party rules for explicit production
  debuggability, cleartext/user-CA policy, exported AndroidX FileProvider, ATS exceptions/TLS policy,
  and disabled iOS data protection. They use bounded structured repository parsing, never execute
  Gradle, Xcode, or target content, and report unsupported/dynamic inputs as coverage limitations.
• Separate React Native and Expo packs add six first-party structural rules for sensitive
  AsyncStorage writes, unsafe WebView content/origin settings, public Expo configuration secrets,
  and unsigned cleartext updates. They require explicit framework evidence, never execute target
  modules/configuration, and keep bare React Native coverage distinct from Expo coverage.
• A Python AI/API pack adds six high-confidence first-party rules for hardcoded framework signing secrets,
  credentialed all-origin CORS, request-controlled file responses, redirects, and template source,
  plus unsanitized OpenAI/Anthropic output returned as HTML. Bounded Lezer-gated, source-ordered
  intrafile analysis never imports or executes target code; unsupported syntax and project bounds
  fail closed with explicit pack-coverage notes.
• A separate first-party codeinspectus-pub engine now analyzes bounded pubspec.lock files under
  the vuln scanner class, independently of Trivy. It matches only exact affected versions from a
  bundled, provenance-recorded OSV Pub snapshot (11 active reviewed advisories across 10 packages
  at this release), rejects ambiguous lockfiles, excludes custom registries/Git/path/SDK packages,
  and reports explicit dependency coverage instead of treating skipped input as clean.
• Native Pub SBOM support generates CycloneDX 1.6 or SPDX 2.3 inventories, merges official Pub
  components additively into Trivy output, and falls back to a Pub-only document when Trivy is
  unavailable. It preserves lockfile hashes/directness/origin without inventing licenses,
  suppliers, or a dependency graph that pubspec.lock does not contain.
• Scan and rescan output now includes deterministic repository technology detection and explicit
  per-pack analyzer/rule execution coverage, including not_applicable for an installed pack that
  does not match detected technology. Stored scans from older versions remain loadable.
• codeinspectus_list_rules now exposes native-pack inventory and exact manifest-to-pack ownership,
  including user-visible scope limitations that prevent a ran state being read as full language
  coverage.
• Detection database 1.0.0 contains 70 curated detections: 49 first-party native rules,
  18 Opengrep-owned SAST rules, and 3 custom Gitleaks rules. The two promoted native rules retain
  active Opengrep YAML fallbacks, so 20 YAML rules still execute. The aggregate native engine
  signature is 5.0.0; the separate Pub engine is 1.0.0, and the built MCP stdio eval suite
  contains 36 cases. Opengrep, Gitleaks, and Trivy remain installed.

Fixed

• Authored Opengrep confidence metadata now takes precedence over the producer's generic SARIF
  precision, preventing medium-confidence rules from being silently upgraded to high. The weak-
  cipher wording now covers deprecated password-based createCipher as well as DES/3DES/RC4.
• Supabase Edge Function authentication analysis now runs for projects that commit Edge Function
  source without also committing Supabase SQL migrations. The SQL project gate remains scoped to
  RLS analysis, and dedicated true-positive/false-positive fixtures lock the behavior.
• Replaced a pathological API-boundary string-masking regular expression with a bounded linear
  scanner. On the pinned Mattermost Mobile checkout, the complete native scan fell from about 69
  seconds to 7-8 seconds without changing finding identities or native-pack coverage.

Changed

• The supported runtime floor is Node.js 22, with Node 24 LTS as the primary CI/runtime target.
  Node 22 and 24 are tested separately; the production bundle now targets Node 22 instead of the
  end-of-life Node 18 line.

v0.4.1

Added

• Offline engine_setup health in scan and list-rules output, with stable ready,
  repair_required, db_refresh_recommended, and unsupported_platform states.
• Incremental repair-engines command. It downloads only unhealthy engine artifacts, verifies
  them against immutable shipped pins, installs binaries atomically, refreshes stale/missing
  Trivy DB state, and serializes concurrent repairs with a per-machine lock.

Changed

• End-user setup no longer rewrites the npm package's engines.lock.json; lockfile mutation is
  restricted to the maintainer-only pin-engines command. install-engines remains as a
  backward-compatible alias.
• MCP instructions require agents to explain partial coverage and obtain approval before launching
  a networked engine repair. No npm postinstall or scan-time download was added.
• CI now exercises offline health reporting, incremental repair, a real Trivy DB refresh, and
  immutable-lockfile enforcement. The manual maintainer workflow uses pin-engines explicitly.

Fixed

• Long-running MCP processes invalidate cached engine verification when a repaired binary's file
  identity changes, so a successful repair is recognized without restarting the client.
• Binary and Trivy DB updates are staged and replaced atomically; interrupted repairs leave the
  last verified installation usable and clean stale repair locks safely.

v0.4.0

Added

• Project CI Enhancement 1: four conservative JavaScript/TypeScript API-boundary
  detections for client-visible internal error details, explicit sensitive API-response
  fields, whole unvalidated request objects passed to Prisma/Supabase/Mongoose writes, and
  sensitive request data passed to logs. Each ships with dedicated component provenance,
  CWE plus OWASP Web/API mappings, remediation, redacted snippets, rescan continuity, and
  dual-direction precision fixtures.
• Credentialed arbitrary-origin CORS detection for cors middleware approval/reflection
  and direct allow-origin header reflection, with safe allowlist/pinned-origin fixtures.
• Project CI Enhancement 2: four evidence-gated configuration detections for security
  response headers explicitly disabled/neutralized, production CSP with bare wildcard or
  'unsafe-eval' script sources, auth/session cookies with explicitly insecure attributes,
  and Supabase CAPTCHA-enabled auth calls that omit captchaToken.
• Three-state runtime-control evidence on scan results:
  verified_in_repository, insecure_configuration_found, or
  not_verifiable_from_repository. Only explicit insecure repository configuration enters
  findings; missing/hosted/ambiguous controls remain metadata with no posture penalty.
• Literal configuration fixtures for Next.js last-match header ordering, Vercel, Helmet,
  nginx, Cloudflare Pages _headers, cross-layer conflicts,
  development/report-only CSP, cookie near misses, and Supabase hosted/disabled CAPTCHA.

Changed

• Corrected the existing wildcard-plus-credentials CORS explanation: browsers reject
  credentialed response sharing for that invalid combination; it does not itself expose an
  authenticated response. Its severity is now medium, below the high-severity arbitrary-origin
  credential exposure rule.
• Extended credentialed-CORS precision to separately declared cors options while keeping
  realistic indexOf/allow-list callbacks silent.
• Hardened API-boundary source analysis against commented examples and minified vendor code;
  added Fastify response/request-log forms, Prisma transaction clients, and lowercase Mongoose
  *Model variables while keeping boolean-only sensitive-data presence logging silent.
• Corrected ci-baseline-insecure-cookie wording to its actual narrow behavior (explicit
  httpOnly: false); the new AI cookie rule covers secure: false and
  SameSite=None without Secure.
• Detection database 0.4.0 now contains 44 curated detections: 21 AI analyzers,
  20 Opengrep SAST rules, and 3 custom Gitleaks rules. The CodeInspectus AI engine signature
  is 1.2.0, and the eval suite now contains 21 cases.
• Refreshed permitted transitive patch versions for fast-uri and Hono before publication,
  clearing all high/critical advisories from the production dependency tree.

Known limitations

• New API-boundary analysis is JavaScript/TypeScript source-only and intrafile; build output and
  minified vendor files are excluded. It intentionally prefers silence for ambiguous validation,
  business authorization, runtime middleware, and cross-file dataflow.
• Missing security headers, hosted CAPTCHA state, gateway rate limits, runtime overrides,
  and behavioral auth remain unverified. CodeInspectus reports these as
  not_verifiable_from_repository, never as vulnerabilities or proof of protection.

v0.3.2

Correctness release for effective Supabase RLS state, secret-scan coverage honesty,
and cross-version rescan proof.

Fixed

• Superseded RLS policies are no longer reported as active. Ordered migration
  sequences now reduce CREATE, ALTER, DROP, enable, and disable operations to final
  effective state. Earlier releases could report a policy that a later migration had
  dropped or safely replaced, and could miss some later final-state changes.
• Rescan no longer treats detector changes as user fixes. Every finding now records
  its producing detector components. A vanished finding is resolved only when those
  components are present with identical signatures; otherwise it is not_rechecked.
  The first rescan of a pre-0.3.2 scan is therefore conservative: present findings stay
  remaining, while vanished findings report that CodeInspectus cannot tell whether the
  user fixed them because the checks changed.
• Target Gitleaks config can no longer silently replace bundled checks. CodeInspectus
  always uses its bundled config and ignores target .gitleaks.toml files and inline
  gitleaks:allow comments, disclosing both behaviors in scan output.
• Machines whose Trivy DB predates 0.3.2 report vanished CVEs as not_rechecked until
  install-engines is run once to record DB provenance; scan output now surfaces this
  expected state and the next install-engines run self-heals it.

Added

• Component-scoped provenance. Signatures cover the shared RLS reducer, independent
  AI analyzers, normalization pipeline, engine binaries, invocation flags, the Opengrep
  ruleset, bundled Gitleaks config, Trivy checks, and the Trivy vulnerability DB. Trivy
  DB content is hashed once at install time, never during an offline scan.
• Secret-coverage status. A target .gitleaksignore remains effective in Gitleaks
  8.30.1 and cannot be neutralized. CodeInspectus continues the useful portion of the
  secret scan but marks secret_coverage: "unverified" and warns that coverage is partial.

Known limitations

• Both paths where final RLS state is off report high; sensitivity tiering is pending
  independent validation (CG-83).
• RLS reduction does not compose separate migration directories or standalone SQL
  snapshots, and does not model SQL larger than 2 MiB, dynamic SQL, or dashboard-only
  database changes.
• .gitleaksignore can still suppress individual Gitleaks findings. CodeInspectus detects
  and discloses the file but does not claim an unremovable secret-detection floor.

v0.3.1

Codex integration and cross-platform release hardening. No detection-rule
changes; the 35-rule detection set is unchanged.

Added

• MCP-level agent workflow instructions. Clients now receive the recommended
  scan → explain → consent → fix → rescan workflow during initialization, including
  granular fix consent, git-safety guidance, secret-rotation reminders, and the rule
  that a finding is never called fixed until a rescan confirms it.
• Native portability CI. Windows x64, macOS Intel, and Linux ARM64 now build,
  run unit tests and the MCP transport smoke, install and verify the pinned engines,
  require all 17 evals to execute, run the redaction e2e, and scan the fixture app.

Fixed

• Windows SARIF paths. Absolute paths emitted by Opengrep are now normalized
  against Windows backslash targets, so findings retain repository-relative file
  locations across every supported runtime.
• Accurate Codex setup documentation. Codex now uses its CLI command, settings
  UI, or config.toml instead of the Claude JSON example. The documented
  tool_timeout_sec = 600 prevents Codex's 60-second default from ending legitimate
  large-repository scans early. Existing Claude setup remains unchanged.
• GitHub Actions Node.js deprecation warnings. Checkout, Node setup, and artifact
  actions now use immutable Node 24-based release SHAs. The retired macos-13
  Intel runner label is replaced with macos-15-intel.

Internal

• The MCP stdio smoke now requires non-empty server instructions and checks that the
  critical consent/rescan guidance is present in the initialization handshake.

v0.3.0

Rescan now reports "resolved" only when it can prove it, plus honesty fixes to install docs and stored-scan handling.

Changed

• Rescan no longer over-claims "resolved." A prior finding is reported resolved only when CodeInspectus can prove it was re-checked and is gone — the producing engine actually ran, results weren't truncated, and the original scan's scope was reproduced. When it can't confirm (an engine didn't run, results hit a limit, or the prior scan predates captured scope), the finding is reported as not_rechecked — an honest "couldn't confirm," never a false all-clear. A genuine fix still shows as resolved.
• Severity threshold on rescan is now display-only. It affects what's shown, not what's compared — so filtering to "medium and up" can no longer make a still-present lower-severity finding look resolved.

Fixed

• Rescans could report a still-present finding as "resolved" when the re-scan used a narrower filter, an engine quietly didn't run, or a co-located secret's identity shifted between runs. All three paths are closed; rescan now matches findings on stable identity, not just a run-specific fingerprint.

Docs

• Install prerequisites now stated up front: Node.js 18+ and cosign on your PATH (cosign verifies the Opengrep and Trivy downloads; the install fails closed without it — Gitleaks needs none).
• Refined the write-scope wording from 0.2.0: CodeInspectus never edits or deletes your source code or repository; scan history and engines live under ~/.codeinspectus, and an SBOM is written to a managed directory by default, or a path you choose.

Internal

• Hardened stored-scan handling against path traversal and added validation of loaded scan files. Added continuous integration (build, tests, engine-verified evals) with dependency-pinned workflows. No change to what gets detected — the 35-rule detection set is unchanged.

Known limitations (stated plainly)

• A rescan run with a smaller max_findings than the original may report some findings as not_rechecked rather than resolved — by design, so a truncated re-scan never produces a false all-clear.

v0.2.1

Fixed

• Release provenance: 0.2.1 is published from the public repository, so the npm package's gitHead and the v0.2.1 git tag both resolve to a public commit. (0.1.0 and 0.2.0 were published from a private build repo; their gitHead values point at commits not reachable from this repository and cannot be retroactively corrected.)

Added

• MCP Registry metadata: mcpName in package.json and a root server.json, making CodeInspectus installable/listable via the official Model Context Protocol registry.

No detection or scanner behavior changes in this release.

v0.2.0

CodeInspectus v0.2.0 focuses on making the project easier to evaluate, list, and contribute to.

Highlights:

• Added a public demo GIF to the README.
• Added example demo reports for Next.js + Supabase, AI chatbot/RAG, and Node/React apps.
• Added listing copy for MCP registries and awesome-lists.
• Added clearer README positioning for local-first MCP security scanning of AI-generated apps.
• Added good-first contribution ideas for rules, fixtures, and mapping verification.

Validation:

• npm run build: PASS
• npm test: PASS, 115 tests passed

CodeInspectus remains local-first, MIT licensed, MCP-ready, and designed to help developers and coding agents catch common AI-app security mistakes before shipping.