v0.5.1 — Security hardening from an independent audit

v0.5.1 — Security hardening from an independent audit

0.5.1 is a security + correctness patch. Two independent reviewers — one auditing functional correctness, one red-teaming — reviewed the codebase cold. Six genuine issues were fixed, each pinned by a regression test.

Upgrade from 0.4.1 / 0.5.0 is recommended — the most serious finding, a read-any-file exfiltration channel, is present in those versions.

Fixes

• Exfiltration via $(...) substitution (critical). The read-only command-substitution allowlist included file-content readers (cat/head/tail/wc), so scoring rm -rf $(cat ~/.aws/credentials) executed cat during analysis and surfaced the file's contents. Removed every content-reader; all path arguments are now bounded to the working tree; control characters blocked. The allowlist expands target lists — it never discloses bytes.
• Wrapper / assignment scorer-evasion. A leading VAR=value or exec-wrapper (env, timeout, nohup, nice, xargs, …) hid the real verb, downgrading even rm -rf / to low. The parser now peels these prefixes; the fix is shared with the resolver and the speculation gate.
• SQL probe DoS. The sqlite scoped-DELETE probe ran an attacker-controlled WHERE with no query interrupt — a recursive CTE hung analysis for minutes. Added a real opcode + wall-clock budget (set_progress_handler); pathological clauses abort in milliseconds.
• 2>&1 misparse. File-descriptor duplication was read as a truncating redirect, mis-flagging benign make 2>&1 / pytest 2>&1 as destructive. Now recognized as a stream wiring, not a file write.
• git checkout <path> false negative. Path-discarding checkouts without an explicit -- (git checkout ./src, git checkout HEAD app.py) weren't detected. Now flagged; branch/tag switches still aren't.
• find probe root. find / … -delete triggered a whole-disk walk during analysis; the probe root is now bounded to the working tree.
• Defense-in-depth. Destructive interpreter one-liners floor high (advise, not silent); config-reference matching is whole-word; command substitution blocks control characters.

Notes

• 40+ regression tests pin every finding. 451 tests total, calibration corpus 58/58 exact, and SABER is unchanged — 0.58% false-positive rate, 82.4% data-destruction recall — so this hardened at zero calibration cost.
• The audit also cleared the snapshot path-traversal defense and found no ReDoS, so it wasn't a scare sweep.
• Honest boundary: a static scorer is always evadable by sufficient obfuscation (a chr()-built one-liner dodges the token heuristics). That is the ceiling the opt-in speculative-execution path exists to raise — not a bug left unfixed.

Apache-2.0. Install: uvx blast-scope@0.5.1.