Next Secure Check GitHub Action v1.1.0

What's changed

• The reusable composite Action now invokes the published next-secure-check@0.5.0 CLI.
• Existing inputs, outputs, summary behavior, SARIF handling, and the @v1 consumer reference remain compatible.
• The release follows the v0.5.0 npm publication and the successful security-check workflow.

Validation

• GitHub Security Check run 33261300291 passed build, typecheck, lint, tests, release gate, security check, and reusable Action smoke.
• The four npm packages report version 0.5.0, with next-secure-check latest at 0.5.0.

next-secure-check v0.5.0

Highlights

• Shared AnalysisFacts and parse caching keep the default scan syntax-first and fast.
• Bounded same-function source-to-sink analysis improves raw SQL and command-execution review signals without turning the product into a full taint engine.
• XSS sanitizer/source refinement and auth/middleware intent signals improve finding context.
• The CLI adds compact --summary output for readable terminal checks and demos.
• Release-gate coverage validates fixtures, determinism, SARIF, privacy, performance, and package installation.

Compatibility

• Existing rule IDs, CLI flags, terminal/JSON/Markdown/GitHub/SARIF formats, and deterministic SARIF fingerprints are preserved.
• Scanned repository code is never executed.

Validation

• 513 tests passed: 366 package tests and 147 web tests.
• The v0.5 release gate passed, including fixture, summary, help, determinism, SARIF, privacy, performance, and pack checks.
• Production dependency audit passed with no known high-severity vulnerabilities.
• The GitHub Security Check workflow passed all steps in run 33261300291.
• The four npm packages are published at 0.5.0 and next-secure-check latest is 0.5.0.

Scope and limitations

This release remains a deterministic deploy-time security sanity check, not a full SAST, pentest, or exploit verifier. Cross-file/cross-function taint tracking, full CFG/heap aliasing, dynamic resolution, and TypeChecker-based default analysis remain out of scope. Findings are review signals, not proof of exploitation.

Distribution

The v0.5.0 GitHub tag targets the validated release commit. The four npm packages are published at 0.5.0. The reusable GitHub Action v1.1.0 runs next-secure-check@0.5.0, and the floating v1 consumer tag points to the coordinated Action release commit.

Next Secure Check GitHub Action v1.0.0

Reusable composite GitHub Action for next-secure-check@0.4.1.

Usage:

• uses: SetraTheXX/next-secure-check@v1
  with:
  preset: app
  fail-on: high
  format: github

Supported inputs: path, preset, fail-on, format, exclude, and output. The Action writes GitHub output to the Step Summary by default and can produce SARIF for a separate upload step.

next-secure-check v0.4.1

Release notes

v0.4.1 is a documentation-only CLI patch following the v0.4.0 bounded-analysis feature release.

Included

• Updated the npm-facing CLI README with published v0.4 usage and reproducible commands.
• Clarified GitHub Actions, SARIF, and preset usage.
• Updated security support and contribution guidance for the published v0.4 line.
• No scanner, rule, reporter, or web runtime behavior changed.

Validation

• 320 package tests
• 146 web tests
• Self-scan: 100/100, excellent, 0 findings
• Vulnerable fixture: 26 findings, critical
• Secure fixture: 99/100, excellent, 1 LOW

Findings remain review signals, not proof of exploitation.

next-secure-check v0.3.0

next-secure-check v0.3.0

v0.3.0 focuses on better signal quality, lower noise, and improved CLI/GitHub Code Scanning UX.

This release keeps the project positioned as a deterministic, rule-based security sanity check tool for Next.js projects. It is still a review signal tool, not a replacement for a full security audit.

Added

• v0.3 regression fixture suite for safer future changes
• Middleware auth/rate-limit signal support
• CLI rules command
• CLI explain <rule-id> command
• CLI init command for generating a config file and GitHub Actions workflow
• SARIF helpUri, CWE/security tags, and additional fingerprints

Improved

• Unknown context classification for registry, demo, playground, story, fixture, and package UI paths
• XSS sanitizer/source signal handling
• Login/register rate-limit detection signals
• GitHub Code Scanning SARIF metadata
• CLI onboarding for new users

Validation

• 429 package tests
• 143 web tests
• Self scan: 100/100, excellent, 0 findings
• Vulnerable fixture: 26 findings, critical
• Secure fixture: 99/100, excellent, 1 LOW

Install / Usage

npx --yes next-secure-check@latest scan . --preset app

npx --yes next-secure-check@latest rules
npx --yes next-secure-check@latest explain xss/dangerously-set-inner-html
npx --yes next-secure-check@latest init

Full Changelog: v0.2.1...v0.3.0

next-secure-check v0.2.1

next-secure-check v0.2.1

Docs-only patch release.

Changed

• Clarified recommended npx --yes next-secure-check@latest usage
• Documented old global install conflict with next-secure-check@0.1.0
• Added GitHub Actions Step Summary workflow example
• Added SARIF / GitHub Code Scanning workflow example
• Updated CLI package version output to 0.2.1

No scanner/rule behavior changed.

Full Changelog: v0.2.0...v0.2.1

next-secure-check v0.2.0

next-secure-check v0.2.0

v0.2.0 focuses on reducing false positives and making the scanner more useful on real-world Next.js projects.

Highlights

• Added context-aware scanning metadata
• Added --preset support:
  • default
  • app
  • strict
  • ci
  • audit
  • library
  • monorepo
• Added context-aware severity/confidence tuning
• Added AST-assisted checks for:
  • command execution
  • raw SQL interpolation
  • dangerous HTML rendering
  • password handling without hashing
• Improved admin route detection with route-aware checks
• Improved upload validation checks with endpoint-aware detection
• Improved next-powered-by-header detection for monorepos, templates, and fixtures
• Preserved terminal, JSON, Markdown, GitHub Actions, and SARIF output support

Validation

• pnpm build passed
• pnpm typecheck passed
• pnpm test passed
• 374 total tests passing
• npx next-secure-check@latest --version returns 0.2.0
• Self-scan with --preset app: 100/100, excellent, 0 findings
• Vulnerable fixture: 26 findings, critical
• Secure fixture: 99/100, excellent

Notes

Findings are review signals, not proof of exploitation or a full security audit. False positives and false negatives are still possible, especially in large monorepos, generators, templates, and tooling-heavy repositories.

npm: https://www.npmjs.com/package/next-secure-check

next-secure-check v0.1.0

next-secure-check v0.1.0

First public release of next-secure-check.

next-secure-check is a deterministic, rule-based static security scanner for Next.js projects. It helps catch common security mistakes before production, including leaked secrets, unsafe API routes, missing rate limits, weak configuration, XSS patterns, raw SQL usage, unsafe upload endpoints, and missing security headers.

This is a student-built learning project developed with an AI-assisted workflow, but the scanner itself does not use AI at runtime. All checks are deterministic and rule-based.

Highlights

• CLI scanner published on npm
• 20 built-in deterministic security rules
• Terminal, JSON, Markdown, GitHub, and SARIF output
• .next-secure-check.json config support
• GitHub Actions friendly output
• SARIF metadata, security severity, partial fingerprints, and concise messages
• Safe public GitHub repository scan pipeline in the web demo
• Server-side secret evidence redaction
• Safe archive extraction with path traversal, symlink, hardlink, duplicate path, size, and cleanup protections
• Optional GITHUB_TOKEN support
• Optional Upstash Redis distributed scan guard
• Timeout handling and safe logging
• Committed .env.* variant coverage
• Partial security header detection
• 261 passing tests

Install

npm install -g next-secure-check
next-secure-check scan .

Or run without global install:

npx next-secure-check scan .

Example

npx next-secure-check scan . --format sarif --output report.sarif
npx next-secure-check scan . --fail-on high
npx next-secure-check scan . --exclude "**/*.test.ts,examples/**"

Published packages

• next-secure-check
• @next-secure-check/core
• @next-secure-check/rules
• @next-secure-check/reporter

Notes

Findings are review signals, not proof of exploitation. False positives and false negatives are possible, especially because v0.1 uses deterministic regex/lightweight-context rules rather than a full AST-based analysis engine.

Feedback, issues, and critical review are welcome.