v0.10.0 — LiteLLM Proxy config scanning + 6 root-cause fixes from real-world regression testing

Static config scanning for LiteLLM Proxy, plus six false-positive/robustness bugs found and fixed by adding a large real-world repo (BerriAI/litellm) to the regression gate.

Added

• LLC001–LLC003: LiteLLM Proxy config.yaml scanning. New off-disk scanner (src/scanner/litellm-config-scanner.ts), following the same pattern as mcp-config-scanner.ts. Gated behind a structural check (model_list + litellm_params) so unrelated YAML files are never touched.
  • LLC001 (proven, critical): a hardcoded secret in litellm_params/general_settings instead of an os.environ/VAR_NAME reference.
  • LLC002 (proven, high): a provider api_base reachable over plaintext http:// (non-localhost).
  • LLC003 (heuristic, low, --paranoid only): no guardrails: section configured at all — absence of an optional control, not a proven gap.
  • New dependency: js-yaml (default-schema load(), no unsafe deserialization tags).

Fixed

Found by adding BerriAI/litellm — the official repo, ~7,000 TS/JS files plus a large Python codebase — to npm run regression, specifically to get real coverage for the new LLC rules:

• LLC001 line misattribution — findings could point at the wrong api_key: occurrence in a file with many entries. Now anchors on the flagged value, not the key name.
• LLC001 placeholder-value false positives — LiteLLM's own docs/tests use dummy values like fake-key, sk-lar1-demo. Added a placeholder-word check plus a "does this look like a random credential blob" heuristic.
• A rule crash was silently discarding every other rule's findings — a scan that goes quiet instead of erroring is worse than any false positive. Each rule now runs isolated; one failure logs a warning instead of aborting the whole scan.
• MCP001 (Python) module-scope false positive — an unrelated settings description was treated as MCP tool metadata because the scope-detection fallback covered the whole file. Capped to a small line window.
• MCP002 (TypeScript) blanket parameter taint — every function parameter was treated as user-controlled input regardless of context, flagging a pure URL-parsing utility. Removed the blanket taint; the known-vulnerable fixture never needed it.
• VEC001 (Python) re.search collision — stdlib regex search matched as a vector-store similarity search because a pattern string contained "vector". Excluded re.search/regex.search.
• AI003 (Python) missed FastAPI's idiomatic Depends(...) auth pattern in the route's parameter list — every health-check route in litellm's own proxy was flagged as unauthenticated despite being authenticated.

All six fixes shipped with a permanent fixture under test-fixtures/safe/.

Also

• Skill/MCP-server tool descriptions rewritten with explicit trigger phrasing for better auto-suggestion in Claude/Cursor.
• Real-world findings write-up: #19

Full changelog: https://github.com/akanthed/SecureAI-Scan/blob/main/CHANGELOG.md#0100--2026-08-19