v0.1.0 — first public release

First public release of GitHub Security Researcher (GSR).

What it is: a local, policy-gated toolkit for security and bug research on public open source code. It scans only repositories you explicitly put in scope, stores findings in SQLite, gathers typed evidence, and lets a deterministic engine decide. LLM analysis alone cannot produce CONFIRMED.

Included

• Scope and policy gates (config/targets.yaml, config/policies.yaml); PR/issue/comment creation disabled by design
• Hardened cloning of in-scope public repositories
• Scanners: internal semgrep taint rules, gitleaks (values redacted), OSV dependency scan, Go dataflow
• Typed evidence + deterministic decision engine (R1–R5) with a separate confidence score
• Optional contextual LLM review through the local claude CLI, without tools
• Ordinary Go bug detectors (bugs.go/6) with lifecycle, reconciliation and PR gate
• Preliminary Solidity (contracts.solidity/2) and passive web (web.passive/2) engines
• Read-only discovery and ranking of organisations' public repositories

Install

python3 -m venv .venv && .venv/bin/pip install -e '.[dev,analysis]'
GSR_OFFLINE=1 .venv/bin/pytest -q

Verified from a clean environment: 500 passed, 8 skipped (tests needing optional tools), no network access.

Known limitations: no dynamic validation (target code is never executed, so code findings cannot reach CONFIRMED); Go analysis is syntactic; the contracts and web engines are measured on small corpora only. See README.md.

Licensed under Apache-2.0.