ClaudeGuardIL v0.3.0

ClaudeGuardIL 0.3.0 — the compliance pillar, hygiene, and a benchmark we did not author

A security auditor for vibecoded apps. This release adds a whole second axis of risk, wires up four cheap high-signal checks, and — most importantly — starts measuring real-world detection against code the tool was never tuned on.

How to read the numbers. The regression gate (bench/run.mjs) holds 0 regressions across 19 pinned detections and 0 unexpected confirmed findings across 9 clean variants — genuine regression protection, but its recall is 100% by construction, so it is not a detection rate (retracted as ERR-006). The new wild benchmark is the honest measure: 11 real repos, blind-labelled — 10/16 detected on covered categories, 83% on the target profile, 0 candidate false positives.

A second pillar: compliance

Findings now carry pillar: 'security' | 'compliance', held rigorously apart — the security badge is computed over security findings only, and the benchmark's ratchets are scoped to security, so a compliance domain can never lower the security bar or redden the badge. There is deliberately no compliance P0; severity is legal-exposure-if-unfixed.

• Accessibility (ת"י 5568 / WCAG 2.0 AA) — shipped. CG-A11Y-001..007, with the mandatory accessibility statement handled as a declared row, never a cry-wolf P1 on a fresh scaffold.
• Privacy / data security — documented. A thin graded slice plus declared obligation rows tied to each תקנה.

Vibecoder hygiene, wired and capped

Four cheap greps — CG-HYG-001 placeholder credential in source, -002 base64-as-encryption, -003 auth token in web storage, -004 auth TODO. None can reach confirmed (a grep sees the sink, not whether it matters), so none reddens the badge alone. Measured at 0 findings on four clean reference repos and 0 on this repo's own source, with two false positives caught and fixed before shipping.

The wild benchmark

bench/wild.mjs — 11 real repos at pinned SHAs, labelled by a reviewer blind to the tool, in a neutral CWE vocabulary. First measured detection numbers, and it caught four real cry-wolf bugs on reference code (all fixed).

Also

• SARIF 2.1.0 output for GitHub Code Scanning.
• Roadmap honesty pass — the Snyk adapter and the business-logic intent loop were re-verified end to end and struck from the "not wired yet" list; they had been wired for some time.
• Tests 405 → 616, benchmark gate green throughout.

Full detail in ROADMAP.md and, for every claim retracted, ERRATA.md.

Community project — not an official Anthropic product. MIT licensed.

ClaudeGuardIL v0.1.0

First release. Contains claudeguard-skill.zip for uploading to claude.ai / Claude Desktop (Settings -> Capabilities -> Skills). For Claude Code, install via: /plugin marketplace add Freespirits/claudeguard-il then /plugin install claudeguard-il@claudeguard-il. Community project, not an official Anthropic product.