Skip to content

v3.1.35

Choose a tag to compare

View all tags
@goklab goklab released this 07 Jun 08:21
v3.1.35
37109a4

False-positive precision on real production apps (no rule-count change):

  • Parameterized IN-clauses built from placeholder generation (id IN (${ids.map(() => '?')})) are no longer flagged as SQL injection
  • The debug-endpoint rule no longer fires on build/test config files; the Supabase .or() rule no longer collides with Zod's .or()
  • Cron and webhook rules now recognize Vercel/QStash signature verification, and the BOLA rule recognizes tenant compound-where ownership (projectId/workspaceId/teamId) — each verified to remove only false positives with zero true-positive loss
Assets 2
Loading