Skip to content

next-secure-check v0.5.0

Choose a tag to compare

View all tags
@SetraTheXX SetraTheXX released this 29 Aug 14:43
v0.5.0
051c3d8

Highlights

  • Shared AnalysisFacts and parse caching keep the default scan syntax-first and fast.
  • Bounded same-function source-to-sink analysis improves raw SQL and command-execution review signals without turning the product into a full taint engine.
  • XSS sanitizer/source refinement and auth/middleware intent signals improve finding context.
  • The CLI adds compact --summary output for readable terminal checks and demos.
  • Release-gate coverage validates fixtures, determinism, SARIF, privacy, performance, and package installation.

Compatibility

  • Existing rule IDs, CLI flags, terminal/JSON/Markdown/GitHub/SARIF formats, and deterministic SARIF fingerprints are preserved.
  • Scanned repository code is never executed.

Validation

  • 513 tests passed: 366 package tests and 147 web tests.
  • The v0.5 release gate passed, including fixture, summary, help, determinism, SARIF, privacy, performance, and pack checks.
  • Production dependency audit passed with no known high-severity vulnerabilities.
  • The GitHub Security Check workflow passed all steps in run 33261300291.
  • The four npm packages are published at 0.5.0 and next-secure-check latest is 0.5.0.

Scope and limitations

This release remains a deterministic deploy-time security sanity check, not a full SAST, pentest, or exploit verifier. Cross-file/cross-function taint tracking, full CFG/heap aliasing, dynamic resolution, and TypeChecker-based default analysis remain out of scope. Findings are review signals, not proof of exploitation.

Distribution

The v0.5.0 GitHub tag targets the validated release commit. The four npm packages are published at 0.5.0. The reusable GitHub Action v1.1.0 runs next-secure-check@0.5.0, and the floating v1 consumer tag points to the coordinated Action release commit.

Assets 2
Loading