Release TRAP v2.1.0 — sharper injection & cryptography coverage · bikr/TRAP

A methodology upgrade with no breaking changes — every v2.0.0 verdict still holds.

What's new

Cryptography control (Phase 3). Verifies algorithm use, not just presence: slow salted KDFs for passwords (not MD5/SHA), authenticated encryption modes with unique per-message nonces (not ECB/static IVs), constant-time secret comparison, and CSPRNG-sourced tokens.
Injection — trace it, don't spot it (Phase 3). Requires tracing at least one concrete untrusted-input path from source to sink per injection class, mirroring the existing cross-tenant authorization trace. "The library is safe" is not a trace.
Framework footguns + every-boundary validation. The Backend area now calls out stack-specific dangerous sinks (eval, template injection, unsafe deserializers, ORM raw escapes, prototype pollution) and requires validation at every trust boundary — webhooks, queues, file contents, inter-service calls — not just the browser edge.
Regression tests. The Remediation Loop now requires keeping a passing exploit test as a committed regression test, so fixed vulnerabilities can't silently return.