carabiner v0.1.11

pip install carabiner-sec

Consolidates v0.1.6–v0.1.11. This run was driven by scanning 60 public repositories (4.0 GB across Python, JS/TS, Go, Rust, Java, Kotlin, Ruby, PHP, C, C++, C#, Elixir, Swift and shell) and then re-checking every finding with an oracle written independently of the engines.

Precision

Critical findings across the corpus went from 31 to 2 — and both survivors are real: a committed -----BEGIN PRIVATE KEY----- in grafana, and an unguarded pull_request_target + PR-head checkout in rollup.

Five false-positive classes were found and fixed. Four were the same mistake wearing different clothes — judging a file by its name instead of reading it:

What	Evidence
.env flagged by filename	grafana commits 11 .env files holding mysql_version=8.0.32
.env.example treated as real	strapi ships JWT_SECRET=tobemodified — that is documentation
"AUTH" matched inside "AUTHOR"	LINEAR_CMS_STATUS_WAITING_ON_AUTHOR=<uuid> read as a credential
test-fixtures unmatched	vault's 14 test keys were critical because the directory name is hyphenated
.npmrc assumed to hold a token	every one in the corpus contained ignore-scripts=true

CI002 was separately wrong two times in three: pull_request.base.ref is the PR's target branch, and a GitHub username cannot carry a shell metacharacter. It now names the fields an outsider can actually put text into.

A guarded pull_request_target (discourse gates on the author's login, which is not spoofable) now reports high and says the guard exists, rather than crying open-door over a closed one.

Correctness

• Windows crash fixed — text I/O used the locale encoding, so one em dash in a workflow file killed the scan with UnicodeDecodeError. Windows is now in the test matrix.
• Dependencies in subprojects were silently skipped. backend/ and frontend/ lockfiles were invisible; the scan looked clean rather than unchecked.
• --offline is now real and enforced by a test that blocks socket creation.
• Packaging — the distribution is carabiner-sec; the command is still carabiner.

Performance

deps moved behind --all: its OSV lookups cost 0.7–9.3s while every other engine stayed under 1.7s. Worst fast path across the corpus went 10.2s → 2.4s, median 0.47s.

48 tests, 161 checks, on Linux and Windows across Python 3.10 and 3.13, plus a Docker build, a wheel install into a clean venv, and carabiner scanning itself — every commit.