VardrGate v0.1.0

VardrGate v0.1.0

Released 2026-10-14. The first packaged release includes the API authorization
engine, reviewed policies/cases, ownership and tenant checks, body-aware denial,
property-exposure candidates, setup steps, spec discovery/import and the optional
standalone queue. Findings are candidates for human verification, not proof that
an API is secure or that a methodology is covered.

Reviewed identity preflight checks a same-origin session endpoint and public
principal metadata before resource tests. A failed check retains safe diagnostics
and exits 3 without resource executions/findings. Runner 0.47.0 uploads that
artifact and keeps the job failed through recovery. The matching Map backend
must be deployed first. This does not add login, refresh or automatic retries.

Downloads

Archives are available from the release.
They include the binary, README and Apache-2.0 license. No Go runtime is required.

System	Archive
Linux amd64	vardrgate_0.1.0_linux_amd64.tar.gz
Linux arm64	vardrgate_0.1.0_linux_arm64.tar.gz
macOS Intel	vardrgate_0.1.0_darwin_amd64.tar.gz
macOS Apple Silicon	vardrgate_0.1.0_darwin_arm64.tar.gz
Windows amd64	vardrgate_0.1.0_windows_amd64.zip

For example, with GitHub CLI on Linux amd64:

gh release download v0.1.0 --repo VardrSec/VardrGate \
  --pattern vardrgate_0.1.0_linux_amd64.tar.gz --pattern SHA256SUMS
grep ' vardrgate_0.1.0_linux_amd64.tar.gz$' SHA256SUMS | sha256sum -c -
gh attestation verify vardrgate_0.1.0_linux_amd64.tar.gz --repo VardrSec/VardrGate
tar -xzf vardrgate_0.1.0_linux_amd64.tar.gz
./vardrgate version

Put the verified executable in a directory on your PATH. On Windows, compare
Get-FileHash .\vardrgate_0.1.0_windows_amd64.zip -Algorithm SHA256 with its
line in SHA256SUMS, verify provenance with the same gh attestation verify
command and use Expand-Archive to extract it.

Alternatively, source installation requires Go 1.25 or newer:

go install github.com/VardrSec/vardrgate/cmd/vardrgate@v0.1.0

The standalone HTTP /tests/execute endpoint remains open; bearer tenancy applies
to its queue endpoints. Private targets remain blocked unless locally opted in.
See README for transport and mutation safeguards. These binary
archives are not OS code-signed; checksums and GitHub provenance verify the
published build, and OS execution policies still apply.