Skip to content

next-secure-check v0.3.0

Choose a tag to compare

View all tags
@SetraTheXX SetraTheXX released this 04 Jun 17:42
· 52 commits to main since this release
v0.3.0
402feb8

next-secure-check v0.3.0

v0.3.0 focuses on better signal quality, lower noise, and improved CLI/GitHub Code Scanning UX.

This release keeps the project positioned as a deterministic, rule-based security sanity check tool for Next.js projects. It is still a review signal tool, not a replacement for a full security audit.

Added

  • v0.3 regression fixture suite for safer future changes
  • Middleware auth/rate-limit signal support
  • CLI rules command
  • CLI explain <rule-id> command
  • CLI init command for generating a config file and GitHub Actions workflow
  • SARIF helpUri, CWE/security tags, and additional fingerprints

Improved

  • Unknown context classification for registry, demo, playground, story, fixture, and package UI paths
  • XSS sanitizer/source signal handling
  • Login/register rate-limit detection signals
  • GitHub Code Scanning SARIF metadata
  • CLI onboarding for new users

Validation

  • 429 package tests
  • 143 web tests
  • Self scan: 100/100, excellent, 0 findings
  • Vulnerable fixture: 26 findings, critical
  • Secure fixture: 99/100, excellent, 1 LOW

Install / Usage

npx --yes next-secure-check@latest scan . --preset app
npx --yes next-secure-check@latest rules
npx --yes next-secure-check@latest explain xss/dangerously-set-inner-html
npx --yes next-secure-check@latest init

Full Changelog: v0.2.1...v0.3.0

Assets 2
Loading