v2.0.0

What's Changed

• ci: upgrade test from 1.9.0 by @danoszz in #150
• chore: root .mcp.json with Penthera's pinned MCP server by @danoszz in #151
• feat: Gemini CLI extension, and proof up front in the README by @danoszz in #152
• docs(mcp): ready for the Docker and Cline MCP catalogs by @danoszz in #153
• docs(readme): a status per part, and verify it yourself by @danoszz in #154
• fix(deps): IOC hosts match whole hostnames only (false litellm alarm) by @danoszz in #156
• site: HSTS preload for penthera.org by @danoszz in #157
• fix(cli): --json to a pipe is no longer truncated at 64 KiB by @danoszz in #158
• feat(secrets): read key files, PHP, C#, configs and docs (E11b pass 1) by @danoszz in #159
• feat(secrets): a finding lists every line it hit, plus ADR 0001 (E11b A6, stacked on #159) by @danoszz in #160
• docs(readme): drop the One real fix section by @danoszz in #161
• feat(scan): library mode, exported parameters as sources (E11b D1+D2) by @danoszz in #162
• feat(secrets): password, key-variant and API-key rules (E11b pass 2) by @danoszz in #163
• feat(deps): malicious-package detection, E11b passes A–D and C1 by @danoszz in #164
• chore(audit): package budget 900 KB / 2.4 MB (E11b round 2) by @danoszz in #168
• feat(scan): library mode follows one helper call and this (E11b round 2) by @danoszz in #165
• feat(secrets): provider and generic API key detection (E11b round 2) by @danoszz in #166
• feat(deps): PyPI malware and compromised-release detection (E11b round 2) by @danoszz in #167
• E11: Penthera on public benchmarks (pre-registration, runner, results) by @danoszz in #155
• Publish the E11b public benchmark results (README, site, docs) by @danoszz in #169
• release: 2.0.0-rc.1 by @danoszz in #170
• release: 2.0.0 (with the translation-file fix and #171) by @danoszz in #172

Full Changelog: v1.9.0...v2.0.0

Share this release

LinkedIn (600 characters)

Penthera v2.0.0 is out: open-source security for the apps and AI systems you ship.

Everything in 2.0.0-rc.1 below, plus:

What's new:
• Copied commands always install: While main carries a release candidate, the site and its mirrors pin the latest stable release instead of a…
• Penthera in your coding tool: one page with the setup for Claude Code, Cursor, VS Code, Codex, Gemini CLI, Antigravity, Windsurf, Cline…
• No more password alarms in translation files: A translation's "password"

npm: https://www.npmjs.com/package/penthera
GitHub: https://github.com/danoszz/penthera/releases/tag/v2.0.0

X / Bluesky (229/280 characters)

Penthera v2.0.0 is out.
• Copied commands always install
• Penthera in your coding tool
• No more password alarms in translation files
https://www.npmjs.com/package/penthera
https://github.com/danoszz/penthera/releases/tag/v2.0.0

Drafted from the CHANGELOG. Edit, then post by hand once the npm release is approved.