CodeRiskTools Scanner v3.1.3

Hotfix release for automatic vulnerability database update.\n\n- Adds OSV all.zip full-dump ingestion for vuln-db update --full --profile core.\n- Enables OSV ZIP in generated vuln-db init-config by default.\n- Uses digest-only source record storage and bulk import settings for the full OSV dump.\n- Keeps extended provider feeds such as NVD/CVE-v5/distro archives disabled until dedicated pagination/adapters are production-ready.\n\nVerification before release:\n- GitHub Actions PASS for PR #203 on Python 3.10/3.11/3.12/3.13.\n- Local wheel install smoke: secret-scanner 3.1.3, init-config shows OSV enabled with osv-zip all.zip.\n\nTarget commit: c1698b2

CodeRiskTools Scanner 3.1.2

CodeRiskTools Scanner 3.1.2

Hotfix for the controlled vulnerability database updater default configuration.

Fixed

• secret-scanner vuln-db init-config no longer enables the retired OSV JSONL URL https://osv.dev/vulns/all.jsonl, which now returns HTTP 404 and caused vuln-db update --full --profile core to reject with source download failed.
• The generated config now records the current OSV full dump URL https://osv-vulnerabilities.storage.googleapis.com/all.zip as enabled: false / adapter_status: zip-adapter-required until ZIP full-dump ingestion and sufficient staging disk are explicitly supported.
• Working bounded sources remain enabled: CISA KEV, EPSS, and GitHub Advisories.

Boundary

This release prevents the default full-update config from failing on a retired OSV endpoint. It does not claim full OSV/CVE mirror support.

Verification

• Targeted update/config tests passed.
• GitHub Actions CI passed on Python 3.10, 3.11, 3.12, and 3.13 for PR #202.
• Built wheel/sdist from merged main, installed the wheel in a clean venv, and verified secret-scanner 3.1.2 plus corrected vuln-db init-config output.

CodeRiskTools Scanner 3.1.1

CodeRiskTools Scanner 3.1.1 is a hotfix release for local vulnerability scanning against the signed starter database.\n\nHighlights:\n- adds secret-scanner vuln scan --sbom FILE for local CycloneDX, SPDX and Syft JSON SBOM scans against an active SQLite vulnerability database;\n- preserves the signed starter database workflow from v3.1.0: 243,381 real CVE/OSV records, explicitly partial, SHA-256/Ed25519 verified;\n- verified positive local SBOM smoke against the active osv-partial-2026-07-23 database: pkg:bitnami/abantecart@1.3.1 produced 3 vulnerability findings;\n- documents the full OSV source ceiling currently at 813,101 records after future updates.\n\nThe v3.1.1 scanner reuses the pinned signed OSV database release asset from v3.1.0; this release updates the Python package and README/CLI behavior, not the database snapshot.\n\nVerification run:\n- focused SBOM/vuln/bootstrap suite: 17 tests OK;\n- full unittest suite: 1019 tests OK, 1 skipped;\n- compileall and diff check: PASS;\n- baseline self-scan: 0 findings, 0 stale baseline;\n- installed wheel smoke: secret-scanner 3.1.1, vuln scan --sbom returned 3 findings against the 243,381-record active DB.

CodeRiskTools Scanner 3.1.0 — partial OSV database

CodeRiskTools Scanner 3.1.0 — release notes

CodeRiskTools Scanner 3.1.0 adds a controlled, local-first vulnerability database workflow, a small verified partial seed, and a pinned, signed partial OSV prefix SQLite ZIP for first-use installation. The release database is not Full/Core/Complete; its manifest exposes included and available source counts.

What is included

• opt-in local dependency inventory and vulnerability matching;
• user-triggered staging, verification, reconciliation, rollback and retention commands;
• bounded source adapters and explicit provenance/quality evidence;
• a 5.9 MB SQLite seed with 187 advisories and 378 affected-package rows;
• represented OSV ecosystems: PyPI, npm, Go, crates.io, Maven, NuGet and Packagist;
• signed pinned bootstrap that installs seed as staged only;
• explicit vuln-db activate --profile seed --apply activation;
• real lodash 4.17.15 end-to-end matching evidence with stable fingerprints.
• streamed first-use partial OSV database bootstrap with ZIP/database SHA-256, Ed25519, SQLite integrity, foreign-key and compact-manifest verification;
• automatic installation to ~/.local/share/coderisktools/vuln-db/osv-partial.sqlite when the default database is missing;
• vuln-db bootstrap-global for an explicit installation and vuln scan --no-bootstrap to disable automatic network bootstrap.

Release assets

• Python wheel and source distribution;
• coderisktools-vulndb-seed-2026-07-23.sqlite;
• detached seed manifest;
• SHA-256 sidecar;
• Ed25519 signed manifest envelope (.sig JSON);
• public release keyring.
• partial OSV prefix single-SQLite ZIP, detached manifest and Ed25519 signed manifest envelope.

Verified seed facts

• profile=seed;
• completeness=partial;
• production_full_database=false;
• SQLite PRAGMA integrity_check=ok;
• SQLite PRAGMA foreign_key_check=0;
• database SHA-256 2bf63ca969a56a12551c491a956746d504409f13ea1c006abcf19e52ff0e6b04;
• CISA KEV: 1,653 processed, 2 exact enrichments, 1,651 unresolved retained;
• EPSS: 54 processed, 17 exact enrichments, 37 unresolved retained;
• GHSA: bounded 100 imported;
• OSV: 87 imported.

Important limitations

The seed is not Core, Full, Production or Complete. The global snapshot is labeled full-osv-source, not complete Core coverage or proof that an unmatched component is safe. It retains exact-alias conflicts rather than heuristically merging advisories. A zero-finding scan is not proof that a project has no vulnerabilities. Secret/config scans remain offline; the first default vulnerability scan downloads only the pinned signed release asset, and subsequent matching is local.

A clean scanner result is not proof that code is secure. This release is not a security audit, certification, compliance guarantee or legal opinion.

CodeRiskTools Secret Scanner Engine 3.0.1

Changelog

All notable changes to coderisktools-scanner are documented here.

[3.0.1] — 2026-07-20

Changed

• refreshed the public package release metadata for the current Scanner flagship;
• updated the documented registry inventory to 299 native, 267 line and 32 contextual detectors;
• updated CI/CD coverage documentation to 73 policy detectors;
• synchronized install examples for pre-commit and GitHub Actions with v3.0.1.

Security posture

• local-first and offline by default;
• no runtime telemetry;
• no runtime dependencies;
• bounded input handling;
• redacted output by default;
• no execution of target-project code;
• synthetic fixtures only in the public repository.

Limitations

A clean result is not proof that code is secure. Findings can include false positives and false negatives. This release is not a security audit, certification, compliance guarantee or legal opinion.

[3.0.0] — 2026-07-16

First public GitHub release of the MIT-licensed CodeRiskTools Secret Scanner Engine.

See the GitHub release notes and attached provenance files for the original 3.0.0 artifact record.

CodeRiskTools Secret Scanner Engine 3.0.0

CodeRiskTools Secret Scanner Engine 3.0.0

First public release of the MIT-licensed Scanner flagship.

Included

• local-first secret-like value scanning across bounded file and diff inputs;
• strict bounded unified-diff parsing;
• staged-change and bounded Git-history scanning;
• pre-commit hook and composite GitHub Action;
• JSON, Markdown, HTML, SARIF and GitHub output;
• redacted findings, reviewed fingerprint baselines and allowlists;
• Python 3.10–3.13 CI coverage.

Security and provenance

• GitHub Push Protection passed without bypasses;
• Private Vulnerability Reporting enabled;
• 332 tests ran: 331 passed, 1 skipped;
• self-scan: 0 new / 58 matched / 0 stale;
• independent audit: PASS B0/H0/M0/L0;
• attached wheel is reproducible and covered by SHA256SUMS.txt and BUILD_PROVENANCE.txt.

Product boundary

This repository and release contain only Secret Scanner Engine source. MCPwatch Scanner is a paid proprietary add-on. AI Change Firewall is a separate paid proprietary product. Neither proprietary codebase is included.

Important limitation

A clean scan is not proof that code is secure. Findings can include false positives and false negatives. This release is not a security audit, certification, compliance guarantee or legal opinion.