v2.1.0

What's Changed

• plugin: a small plugin/ folder for the plugin directory; narrow the skill's allowed-tools by @danoszz in #173
• docs: roadmap track, --giants spec (approved) and E14 pre-registration by @danoszz in #175
• media: share images of the public benchmarks (cards, scatter charts, paper-style figures, screenshots) by @danoszz in #174
• docs(research): E15 candidate, indirect prompt injections hidden in what agents read by @danoszz in #179
• docs(roadmap): Supabase row-level security, KEV/EPSS ranking, Python rules up, wider E13 field by @danoszz in #181
• site: count checks and installs with cookieless Web Analytics events by @danoszz in #182
• --giants: run the free scanners you already have, in one report (2.1.0-rc work) by @danoszz in #180
• chore(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 in the actions group by @dependabot[bot] in #177
• chore(deps-dev): Bump the dev-dependencies group with 2 updates by @dependabot[bot] in #176
• release: 2.1.0-rc.1 (--giants, first-run fixes, benchmark pages, blog) by @danoszz in #184
• rc.2 batch: the agent brief, triage fixes, /upkeep, roadmap, E14 dev half by @danoszz in #187
• release: 2.1.0-rc.2 by @danoszz in #188
• Sprint: Pro as an experiment, Go Pro, /trust, governance, Clerk keys, Mintlify docs, E14 step 2 by @danoszz in #189
• docs: readable page names on docs.penthera.org by @danoszz in #190
• Publish the two benchmark posts by @danoszz in #191
• Specs and pre-registrations: penthera watch, E15 (draft), E17 (registered) by @danoszz in #192
• feat: scan Client JS bundles for provider keys(#6) by @divya-o in #183
• Road to 50k batch: E17 result, before-you-publish, agent-setup gaps, PR check by @danoszz in #193
• Site: the live check becomes the hero (poster is the check) by @danoszz in #194
• Pre-2.1.0: honest rank intervals, E17 normaliser fix by @danoszz in #195
• Release 2.1.0: research hub, research standard, E20 study page, footer, performance by @danoszz in #196

New Contributors

• @divya-o made their first contribution in #183

Full Changelog: v2.0.0...v2.1.0

Share this release

LinkedIn (552 characters)

Penthera v2.1.0 is out: open-source security for the apps and AI systems you ship.


What's new:
• penthera agents checks five more ways agent config runs code (ADR 0002): New rules, each with a test on a defanged fixture
• The agent config check on every pull request, in one file: docs/examples/github-actions-agents.yml runs npx --yes…
• Provider keys in client JavaScript: A URL scan now reads the scripts the home page loads from its own…

npm: https://www.npmjs.com/package/penthera
GitHub: https://github.com/danoszz/penthera/releases/tag/v2.1.0

X / Bluesky (254/280 characters)

Penthera v2.1.0 is out.
• penthera agents checks five more ways agent…
• The agent config check on every pull request, in…
• Provider keys in client JavaScript
https://www.npmjs.com/package/penthera
https://github.com/danoszz/penthera/releases/tag/v2.1.0

Drafted from the CHANGELOG. Edit, then post by hand once the npm release is approved.