MEDUSA v2026.5.2 — Security Hardening

Security Hardening Release

This release patches 16 security and bug findings identified through a multi-agent review (Sentinel, Skeptic, Architect, and Codex). All 289 tests pass. Tested on Linux, macOS, and Windows.

🔐 Security Fixes

Severity	Fix	File
HIGH	Auth tokens in `--git` URLs stripped from all console/log output before printing	`cli.py`
HIGH	Stored XSS — HTML report fields now escaped with `html.escape()`	`reporter.py`
HIGH	Symlinks skipped during scan — prevents path traversal via crafted repos	`parallel.py`
MEDIUM	Code snippets capped at 200 chars — secrets never written verbatim into JSON/SARIF/HTML reports	`parallel.py`
MEDIUM	Rule integrity `RuntimeError` no longer swallowed by bare `except Exception`	`rules/init.py`
MEDIUM	`fp_filter.get_stats()` no longer re-runs `filter_findings()` (double-filter bug)	`fp_filter.py`

🐛 Bug Fixes

• Cache hit returns empty — `FileMetadata.cached_issues` now correctly returns cached findings
• Dotfile scanning — `.cursorrules`, `.env`, `.mcp.json` etc now fully analyzed (were silently skipped)
• Shell injection hardening — `shell=True` replaced with `shlex.split()` in installer subprocess calls
• Severity enum mismatch — `_SEVERITY_MAP` now correctly uses `rule.severity.value` (string key)
• Phantom scanner — `CSharpScanner` in `LANGUAGE_TO_SCANNER` replaced with `CppScanner` (CSharpScanner doesn't exist)
• Temp dir cleanup — `atexit.register()` added for git clone temp dir on unexpected exit
• Token scrubbing — auth tokens stripped from git clone error messages
• Logging — invalid regex patterns in rule YAML use `logging.warning()` not `print()`
• FP reason — tools/scripts directories now correctly tagged `UTILITY_FILE` not `EXAMPLE_FILE`
• `dataclasses.field` import — missing import added to `parallel.py`

📦 Install / Upgrade

```bash
pip install --upgrade medusa-security
```

✅ Verified On

• Ubuntu 22.04 (kernel 6.17)
• macOS
• Windows 11