ai-security-scanner 0.3.1

ai-security-scanner 0.3.1

Source: 6b61e9ef72f90174ef7310f80e766aba61c9428d

One scan, clearer findings, and practical next steps. / 一次掃描，清楚結果與下一步。

ai-security-scanner 0.3.1 is the stable-channel desktop release for Linux, macOS, and Windows.
Choose approved project folders, websites, and internal systems, then read one report organized by asset.

• Prowler headlines now describe the condition that actually failed. Related AWS findings share an action card while their original identifiers, evidence, severity, and remediation stay available.
• An expired read-only connection leads directly to reconnecting and scanning again. Blocked continuation actions and Markdown presentation are corrected.
• Semgrep uses a pinned pack of 1,493 legacy upstream rules plus four product rules. Published source, notices, image digests, and build/update notes are retained.
• kube-bench manual checks and KICS scan failures now appear as incomplete coverage, while completed sibling findings remain in the report.
• Microsoft 365 setup includes the four approved PIM read permissions and pinned ScubaGear/Maester images. A fresh owner-signed-in live rerun is still pending; this release does not claim that rerun passed.

繁體中文

0.3.1 為 Linux、macOS 與 Windows 的正式發布版本。選擇已授權的專案資料夾、網站與內部系統，即可閱讀依資產整理的同一份報告。

• Prowler 標題改為實際失敗的原因；需要相同修正的 AWS 發現合併呈現，原始識別碼、證據、嚴重度與修正建議完整保留。
• 唯讀連線過期後，可直接重新連接再掃描；受阻的繼續操作與 Markdown 顯示也已修正。
• Semgrep 固定使用 1,493 條舊版上游規則加上四條產品規則，並提供來源、授權聲明、映像檔摘要與更新筆記。
• kube-bench 的人工檢查與 KICS 的掃描失敗會標示檢查範圍未完成，已完成的其他發現仍保留。
• Microsoft 365 已更新四項核准的 PIM 讀取權限及 ScubaGear／Maester 映像檔；仍待擁有者登入後重新實測，本版不宣稱該次複驗已通過。

Windows installers are unsigned. macOS is not notarized. The artifact-specific qualification record below states what was observed and what remains unobserved.
Windows 安裝檔未簽章，macOS 尚未公證；下方依安裝檔列出實際驗證與尚未觀察的項目。

On macOS, drag the app to Applications, then remove quarantine from this app if macOS blocks it:
macOS 請先將程式拖入 Applications；若系統阻擋開啟，再針對此程式移除隔離標記：

xattr -dr com.apple.quarantine /Applications/ai-security-scanner.app

Artifacts offered by this finalized set:

• linux-x86_64 / deb: ai-security-scanner_0.3.1_amd64.deb; technical qualification passed; beginner human path not-observed.
• macos-universal / dmg: ai-security-scanner_0.3.1_universal.dmg; technical qualification installer-passed-runtime-not-observed; beginner human path not-observed.
• windows-x86_64 / msi: ai-security-scanner_0.3.1_x64_en-US.msi; technical qualification passed; beginner human path not-observed.
• windows-x86_64 / nsis: ai-security-scanner_0.3.1_x64-setup.exe; technical qualification passed; beginner human path not-observed.

Not offered in this finalized set:

• linux-x86_64 / appimage: not offered (technical-qualification-not-observed).
• linux-x86_64 / rpm: not offered (technical-qualification-not-observed).

Verify the selected file against SHA256SUMS.txt and its artifact-specific public provenance before installing.
Qualification, human-path observation, OS signing, notarization, updater availability,
provenance requirements, and known limitations are recorded independently for every offered artifact
in release-metadata.json. An absent platform never implies that it passed.

Windows package record

The Windows installers in this stable release are not code-signed. Windows may show an Unknown publisher warning, and Microsoft Defender SmartScreen may warn on first run.

• MSI: Authenticode not verified; exact-candidate beginner path not observed; installed-app lifecycle not observed; data-preservation path not observed.
• NSIS: Authenticode not verified; exact-candidate beginner path not observed; installed-app lifecycle not observed; data-preservation path not observed.