IronWarden v1.1.0 — Sovereign Security Audit Hardening

IronWarden v1.1.0 — Sovereign Security Audit Hardening

This release delivers a comprehensive security and reliability hardening based on a full-scope code quality audit conducted in September 2026. All findings across network security, async concurrency, data integrity, and performance have been remediated.

---

🔴 Security Fixes

Finding 1 — SSRF via X-IronWarden-Target-URL (Critical)

• Added validate_upstream_url() with strict scheme enforcement (HTTP/HTTPS only)
• Unconditionally blocks all cloud metadata endpoints: 169.254.0.0/16 (AWS IMDS), fe80::/10, instance-data, metadata.google.internal
• In production: blocks all RFC 1918 private ranges with opt-in escape valves via IRONWARDEN_ALLOWED_TARGET_HOSTS and ALLOW_PRIVATE_TARGET_URL=true

Finding 6 — Environment Check Standardization

• WARDEN_ENV, IRONWARDEN_ENV, and RUST_ENV all recognized for production mode detection

---

⚡ Async Concurrency

Finding 3 — Nested block_on eliminated

• warden/src/engine.rs: replaced nested block_on/block_in_place with native pool.get().await
• #[derive(Clone)] added to OffsetMap and NormalizationResult

Finding 4.3 — Dead code removed

• Unused global_name_re: Regex field removed from ShadowNer

---

🗄️ Data Integrity

• BEGIN IMMEDIATE TRANSACTION results now checked and propagated in audit.rs
• Atomic anchor writes via <path>.tmp.<pid> + fs::rename
• LocalSessionManager now evicts idle sessions after 1h TTL (SESSION_IDLE_TIMEOUT)
• Only dirty/active sessions flushed; batch write errors propagated via ?

---

🚀 Performance

• Stop words moved to static STOP_WORDS: LazyLock<HashSet> — eliminates ~50 heap allocations per search row

---

🧹 Hygiene

• Removed duplicate "mcp_ocr_ingest" from valid_methods
• Removed || true suppressor from ci_local.sh app test step
• Python conftest.py cleanup now defaults to True

---

Verification

• Code Red invariants V-12, V-14, V-15, V-19 verified intact
• Full workspace test suite: 0 failures on tag commit b533ce1
• CI both jobs green: Format & Clippy + Test Suite (Unit & Integration)

---

Docker image: ghcr.io/somnerd/ironwarden:v1.1.0

IronWarden v1.0.1 — Enterprise Privacy Governance & Sidecar Firewall

🛡️ IronWarden v1.0.1 Official Public Release

We are proud to announce the official v1.0.1 public release of IronWarden, an enterprise-grade AI privacy firewall, contextual PII tokenization proxy, and multi-model audit engine.

---

🌟 Release Highlights & Core Capabilities

• PII & Sensitive Data Redaction / Tokenization Engine:
  • Dual deterministic tokenization with Format-Preserving Encryption (FPE) and AES-256-GCM.
  • Real-time regex pattern detectors, legal privilege discovery, financial identifier tokenization (SSN, credit cards, IBAN, SWIFT), and medical records masking (HIPAA compliance).
• High-Throughput Rust Reverse Proxy Sidecar:
  • Sub-millisecond latency Axum 0.7 gateway with Tower Governor rate limiting, Failsafe circuit breakers, and MCP JSON-RPC routing.
• Vector Knowledge Retrieval & Ingestion:
  • Hybrid LanceDB + Tantivy semantic & full-text indexing engine with Lance format v4.
• Multi-Format Document Parsing:
  • Native in-memory streaming extraction of PDF, DOCX, CSV, JSON, and raw text without external dependencies.
• Immutable Dual-Write Audit Logging:
  • Cryptographically hashed SQLite audit trails with HMAC verification and tamper-evident chaining.
• Complete Verification Suite:
  • 137 passing tests across 6 workspace crates.

v1.0.0-beta.2

What's Changed

• fix(docker): resolve docker-compose compilation and runtime startup failure by @Somnerd in #182
• feat(engine): contextual typed PII placeholder tokens ([EMAIL_1], [NAME_1], [PHONE_1], [AFM_1]) by @Somnerd in #184
• refactor(workspace): unify workspace dependencies and stabilize integration tests by @Somnerd in #186
• feat(oss): quickstart zero-config mode, client examples, GHCR workflow, and test stabilization by @Somnerd in #197
• feat(observability): prometheus metrics endpoint, enhanced health check, compliance presets, and release workflow by @Somnerd in #198
• chore(oss): community standards, issue forms, release documentation, and demo script by @Somnerd in #199
• docs(benchmarks): publish reproducible performance benchmark suite, proxy benches, and code coverage CI workflow by @Somnerd in #202
• Release v1.0.0-beta.1: IronWarden Sovereign AI Gateway by @Somnerd in #203
• feat(oss): adopt MIT license, revamp README, align compliance presets, and add streaming fuzz and preset e2e tests by @Somnerd in #204

Full Changelog: v1.0.0...v1.0.0-beta.2