Skip to content

MEDUSA v2026.7.0

Latest
Latest

Choose a tag to compare

View all tags
@rosschurchill rosschurchill released this 24 Jun 07:52
v2026.7.0
5f217ed
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Claude Code supply-chain detection, broader language coverage, and rule-level observability.

Highlights

  • 🛡️ Claude Code compromise detection — medusa scan --git structurally vets .claude/ for poisoned hooks (curl|bash, base64→exec, credential exfil, reverse shells), over-broad permissions (Bash(*), bypassPermissions), wildcard-tool subagents, and dropper skills — before you clone.
  • 🎯 Always-on AI attack-signature scanner — catches jailbreak / prompt-injection payloads in data (.jsonl/.csv) and prose regardless of LLM-context confidence; invisible-unicode / bidi (Trojan Source, CVE-2021-42574) recovery.
  • 🦀 Native Rust security ruleset (22 rules) + .rs discovery fix — TLS-off, command injection, untrusted deserialization, raw SQL, unsafe memory, weak crypto, SSRF. Out-of-box, no toolchain.
  • 🐘 Native PHP security ruleset (16 rules) + .php discovery fix — SQLi, command/eval, LFI/RFI, path traversal, unserialize() object injection, unrestricted upload, reflected XSS, SSRF, weak crypto.
  • 🔬 Rule diagnostics (--trace-rules) — per-rule trace + timing + hang-survivable heartbeat; found & fixed a real catastrophic-backtracking ReDoS; ReDoS/nested-set lint (CR-050).
  • ⚡ Context-aware screening mode, large-file byte-cap sampling, placeholder-secret FP fix, scan-engine perf.

Verification

  • Full gate: pytest tests/ 560 passed; cross-platform CI green (Ubuntu/Windows/macOS × Py 3.10–3.12).
  • Self-scan adds 0 new findings; solana-pay 0→24 real Rust findings; clean code stays silent.

🤖 Generated with Claude Code

Assets 2
Loading