Skip to content

v3.3.0 — privacy-safe corpus persistence

Latest
Latest

Choose a tag to compare

View all tags
@AliceLJY AliceLJY released this 16 Jul 21:18
· 6 commits to main since this release
v3.3.0
445ba00

Highlights

  • applies best-effort secret and PII redaction in memory before the first raw corpus write, including metadata fields
  • adds --no-raw / no_raw modes for scans that should create no raw corpus artifact
  • expands coverage for private keys, JWTs, AWS, Google, GitHub, Slack, provider, bearer, bot, URL, email, phone, and assignment-shaped sensitive values
  • replaces 100-character prefix deduplication with full normalized-content SHA-256, preserving entries with shared openings and distinct tails
  • renames the heuristic report to corpus readiness; old quality CLI, MCP, and API names remain compatibility shims
  • sanitizes RecallNest stdout before persistence and avoids echoing failed export content
  • upgrades the MCP SDK and patched transitive dependencies to a zero-vulnerability npm audit
  • adds deterministic regression tests and CI for both CLI and MCP builds

Security boundary

Redaction is best-effort, not a complete secret scanner. Raw and refined corpus still contain private conversation text and must be inspected before sharing or uploading.

Verification

  • 5 Bun tests, 41 assertions
  • CLI and MCP production builds
  • npm audit: 0 vulnerabilities
  • GitHub Actions CI on main
Assets 2
Loading