Stingward v0.1.7

Added

• Terms of service, privacy policy and refund policy for the paid report, in English (/terms/, /privacy/, /refund/) and Portuguese (/pt/terms/, /pt/privacy/, /pt/refund/). They are built from site/legal.json, linked from the footer of every page, and load the site's stylesheet and no script; a link in them can only go to another of the three pages or to an https:// address.
• AI review in the review file: "review_kind": "ai" (the default is "person"). The HTML, text and Markdown reports then say AI review instead of human review, and the scope section says what was checked, in which files and on what date. An AI review refuses accepted_risk, because only the client can accept a risk, and accepts fixed only for a finding that is gone from a scan that could see it: not hidden by .stingwardignore, a stingward:ignore comment or the size and file limits. The HTML report also says that the code excerpt of each finding, with secrets masked, went to the AI model. The JSON review block gains kind and masked, which is true when something in a comment, the notes or a name looked like a secret and was masked, in any of the formats.
• --no-ignore, to audit someone else's project: its .stingwardignore and stingward:ignore comments hide nothing, so whoever wrote the code does not choose what the audit shows. When the project asked to hide findings, the HTML report says those requests were not applied. Since nothing is hidden, an AI review can mark fixed a finding that is gone even where an ignore line or comment would have covered it.

Changed

• The website moved to https://stingward.com/. The old GitHub Pages address sends visitors there.
• The website offers the Stingward report in place of the human-reviewed audit: US$ 29 ($29 in English), paid once. You send a zip or one GitHub repository, Stingward checks it, an automatic review goes over every finding, and the PDF report arrives in minutes, with one free new check of the fixed version within 30 days and a full automatic refund if it is not ready in 24 hours. The FAQ and the note on the sample report say the same. The buy button still reads "Coming soon" while links.audit_checkout is empty.
• The language switch shows each language beside its flag (Brazil for Portuguese, the United States for English) and lists Portuguese first, since the site opens in English. The flags are two small SVG files published with the site.

Fixed

• SEC001 no longer reports a password in a database URL with several hosts, such as postgresql://h1:5432,user:password@h2/db from pydantic's MultiHostUrl: the start used to be read as the user h1 with the password 5432,user:password. The credential after the last comma is checked as any other, and a user with no password is not reported. foo, bar, baz, qux and foobar count as sample passwords.
• Language words beside a sensitive name, such as credentials: true in a CORS or fetch setting or password = None, are no longer masked as secrets in code excerpts and reports.
• With an AI review, the text, Markdown and HTML reports say "fixed since the previous report" instead of "fixed during the audit", since nobody followed the fix: it is what a new scan no longer finds.

What's Changed

• Add AI review to the review file and reports by @IsaqueMoutta in #9
• Add --no-ignore to audit someone else's project by @IsaqueMoutta in #10
• Site: US$ 29 report, legal pages, flags in the language switch by @IsaqueMoutta in #11
• Release 0.1.7: multi-host URLs, language literals, AI review wording by @IsaqueMoutta in #12

Full Changelog: v0.1.6...v0.1.7