Verum v0.1.4

Deterministic, whole-program code analyzer. cargo install verum, cargo binstall verum, docker run ghcr.io/ibmark/verum, or grab a binary below.

0.1.4 - false-positive hardening

Validated by running the analyzer across ~90 real-world repositories and fixing every false positive it surfaced:

• Taint: parameterized ORM/driver methods no longer count as SQL sinks; interprocedural flows skip ambiguously-named callees (a sort()/count() name-collision was reporting phantom SQLi/path-traversal); Express res.send/res.write removed from XSS sinks.
• Length-prefix: recognizes validation helpers/macros (ensure_size!, validate_*, ...) as bound checks and treats u16-and-narrower counts as bounded. (IronRDP: 20 findings -> 2; the genuine unbounded-allocation bugs still flag.)
• Hardcoded secrets: web-asset dirs (public/, static/, assets/, plugins/) and vendored code are auxiliary; templated/interpolated values are skipped.
• BlockingInAsync no longer flags tokio's async .lock().await.
• The fixtures carve-out is scoped to Verum's own suite, so a real project's test corpus is auxiliary again.

Added

• VERUM_PROFILE prints per-pass timing to stderr.

Prebuilt binaries: Linux (gnu/musl), macOS (x86_64/arm64), and Windows.