Skip to content

Universal Dev Security 1.0.0

Choose a tag to compare

View all tags
@jet1x jet1x released this 14 Nov 10:10
· 4 commits to main since this release
v1.0.0
25355c7

First stable release of Universal Dev Security.

UDS runs Gitleaks, Semgrep, OSV-Scanner and Trivy on any project, normalizes their results, enforces a central security policy for Git and AI coding agents, and produces JSON, SARIF and an offline dark HTML dashboard.

Highlights

  • Central policy engine (allow / ask / deny); global rules cannot be weakened by project configuration or AI tools
  • Four scanner adapters with explicit states: clean, findings, not_installed, not_applicable, skipped, error
  • Severity only from scanners or the CVSS scale — never invented; no fake security score
  • Fail-closed Git pre-commit / pre-push secret hooks
  • Claude Code PreToolUse hook, verified in live Claude Code sessions: denies --no-verify and secret writes; requires approval for push, recursive deletes and .env reads
  • Dashboard with history, scan comparison, filters and exports; secrets marked "in Git" vs "local only"
  • Reversible fixes verified by your test suite; recovery checkpoints and rollback
  • CI green on Windows, Linux and macOS × Python 3.11–3.14, including real-scanner integration

Changes since 1.0.0rc1

  • Framework caches (.next/cache, .next/dev, .turbo, …) excluded from secret scanning — on a real Next.js project, noise dropped from 708 to 29 findings
  • Secrets distinguished as committed (urgent) or local-only; findings ordered by priority
  • Scan comparisons warn when the scan scope changed instead of reporting excluded findings as resolved
  • Scanners that did not run show — instead of 0

Install (Python 3.11+)

Download the wheel and SHA256SUMS into the same folder, then:

# Windows
.\scripts\install.ps1 -Wheel .\universal_dev_security-1.0.0-py3-none-any.whl
# Linux / macOS
sh scripts/install.sh --wheel ./universal_dev_security-1.0.0-py3-none-any.whl

Or directly: python -m pip install "universal-dev-security @ git+https://github.com/jet1x/Universal-Dev-Security.git@v1.0.0"

Then run uds doctor for scanner installation instructions.

Checksums (SHA-256)

d257478f346351fa19d9f23e70ac692c8fdbf5b9778501aed3574b06ae3bbcdf  universal_dev_security-1.0.0-py3-none-any.whl
184feae6bff3fe609fb2ff2c94c9bd39819f113694dee7b95f3e0f15b2f55f55  universal_dev_security-1.0.0.tar.gz

Known limitations

  • Claude Code runs project hooks only in trusted workspaces.
  • Local hooks are defense in depth; keep CI scanning and GitHub push protection enabled.

Full details: CHANGELOG.md · DEVELOPMENT_STATUS.md

Assets 5
Loading