Skip to content

v0.7.0 — Dataflow diagrams + cross-file AI001 tracing

Marketplace
Marketplace

Choose a tag to compare

View all tags
@akanthed akanthed released this 01 Aug 18:39
· 19 commits to main since this release
v0.7.0
036d83c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SecureAI-Scan can now show, not just claim, how a vulnerability's data flows through your code.

  • HTML reports (--output report.html) now render every finding's source→flow→sink trace as an inline SVG node-link diagram instead of a flat text list, with a dashed "cross-file" arrow wherever a step crosses a file boundary.
  • Trace coverage extended to four more rules — MCP003 (tool result elevated to system-role), AI005 (unsafe output handling), AI012 (unvalidated structured output), and VEC003 (user content ingested into a vector store) — matching AI001's existing dataflow evidence.
  • AI001 now traces tainted values across function and file boundaries: when a tainted parameter is passed into a locally-resolved helper (same project, import-resolved — never a name guess), the scanner follows the call up to 2 hops and builds a real multi-file trace, capped at likely evidence (never proven) and cycle-safe against mutual recursion.
  • Fixed: AI012 could never fire — its own JSON.parse detection collided with its .parse( validation-pattern check, silencing the rule regardless of input.

Note: the interprocedural AI001 tracer mainly adds an accurate, honestly-capped cross-file trace — not new recall on its own, since the base rule's existing per-parameter taint fallback already flagged those same sink locations in isolation.

What's Changed

  • chore(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #10
  • chore(deps): bump github/codeql-action from 3 to 4.37.3 by @dependabot[bot] in #9
  • chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @dependabot[bot] in #8
  • chore(deps-dev): bump @types/node from 22.19.17 to 26.1.2 by @dependabot[bot] in #7
  • chore(deps): bump commander from 14.0.3 to 15.0.0 by @dependabot[bot] in #6
  • chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #5
  • chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4
  • Add SVG dataflow diagrams, extend trace coverage, and trace AI001 acr… by @akanthed in #11

New Contributors

Full Changelog: v0.6.0...v0.7.0

Contributors

dependabot and akanthed
Assets 2
Loading