v0.1.0

injection-scanner release

Raw, target-triple-named binaries cross-compiled from a single Linux
host via cargo zigbuild. Download the binary for your platform,
chmod +x, run.

Every binary carries a signed SLSA build-provenance attestation:

gh attestation verify injection-scanner-x86_64-unknown-linux-musl \
  --repo UnityInFlow/injection-scanner

The crate and binary are both named injection-scanner.

Platform	Asset (raw binary)
Linux x86_64 (musl)	injection-scanner-x86_64-unknown-linux-musl
Linux aarch64 (musl)	injection-scanner-aarch64-unknown-linux-musl
Linux x86_64 (gnu)	injection-scanner-x86_64-unknown-linux-gnu
Linux aarch64 (gnu)	injection-scanner-aarch64-unknown-linux-gnu
macOS x86_64	injection-scanner-x86_64-apple-darwin (if present)
macOS aarch64	injection-scanner-aarch64-apple-darwin (if present)

The musl binaries are statically linked (run-anywhere, no libc-
version drift) and are the assets the spec-ci-plugin GitHub Action
downloads and executes at CI runtime.

macOS binaries are cross-compiled via cargo-zigbuild. If the
apple-darwin SDK/sysroot build is unavailable, macOS is
document-and-deferred to v2 (A4 fallback) and the assets above will
be absent — the Linux set still ships.

Checksums

See SHA256SUMS.txt for verification.

What's Changed

• fix: actually deny unwrap_used in src/ — the other half of #19 by @hermanngeorge15 in #62
• fix: make #[serde(default)] on suppressed mean something by @hermanngeorge15 in #63
• docs: three SHA pins claimed versions they were not by @hermanngeorge15 in #64
• feat: markdown context awareness — documentation is not an attack (#20) by @hermanngeorge15 in #65
• feat: replace the hand-rolled walker with the ignore crate (#22) by @hermanngeorge15 in #69
• test: a false-positive corpus, because negative tests were not enough (QUAL-03) by @hermanngeorge15 in #71
• feat: scan what agents actually ingest, and stop calling prose an attack (#23) by @hermanngeorge15 in #72
• feat: a newline is no longer a bypass (#24) by @hermanngeorge15 in #73
• feat: obfuscation is no longer a bypass (#26) by @hermanngeorge15 in #74
• feat: rebalance severity across the full range (#21) by @hermanngeorge15 in #75
• feat: --fail-on, --quiet, exit code 2, rules and explain (#25) by @hermanngeorge15 in #76
• feat: install-hook — the v0.0.1 promise, three milestones late (#8) by @hermanngeorge15 in #77
• chore: preserve the injection lab that drove #65 and #23 by @hermanngeorge15 in #78
• feat: fill reserved pattern ID gaps (PI008–PI049) from #27 by @VedantMadane in #66
• feat: --baseline for incremental adoption, and install-hook --baseline (#25, CLI-08) by @hermanngeorge15 in #79
• feat: SARIF 2.1.0 output and GitHub code-scanning upload (#5, CLI-04) by @hermanngeorge15 in #82
• docs: SECURITY.md, CODEOWNERS, issue forms, CHANGELOG and a real release checklist by @hermanngeorge15 in #83
• feat: generated pattern catalogue with verified examples, and the gates to keep it current by @hermanngeorge15 in #84
• test: coverage gate, benchmark run, and the per-pattern test policy as a ratchet by @hermanngeorge15 in #90
• test: measure recall against a real attack corpus, and publish the number (#81) by @hermanngeorge15 in #92
• docs: bring STATE.md up to date, and gitignore .gsd/ (#87) by @hermanngeorge15 in #93
• feat: role override as a matrix, not seven literals (#80) by @hermanngeorge15 in #94
• feat: exfiltration as a matrix, not five literals (#95) by @hermanngeorge15 in #96
• feat: instruction injection keys on authority claims, not imperative mood (#97) by @hermanngeorge15 in #98
• feat: jailbreak patterns match the exploit, not its name (#99) by @hermanngeorge15 in #100
• fix: false positives found by sweeping real third-party documentation (#102) by @hermanngeorge15 in #103

New Contributors

• @VedantMadane made their first contribution in #66

Full Changelog: v0.0.3...v0.1.0