Skip to content

v0.1.1

Choose a tag to compare

View all tags
@kidsmeal kidsmeal released this 30 Jun 03:25
· 31 commits to main since this release
v0.1.1
060f378

Bug-fix release. No new checks. Scan output changes vs v0.1.0: some findings are now correctly critical (were under-rated), and secrets in minified bundles are now found, so scanning the same repo may surface more than before.

Fixed

  • Severity drift (correctness). 26 of 80 patterns emitted a severity one level below the source-of-truth check library (service-role-key-in-client was high vs the library's critical), under-grading findings. Synced to checks.data.json.
  • Incomplete redaction (safety). A SendGrid / Twilio / DigitalOcean token on a line that also matched a non-secret pattern printed in cleartext, because the global scrub regex wasn't a superset of the formats the patterns detect. Added the missing formats.
  • Minified-bundle coverage. A secret past byte 5000 of a one-line bundle was missed because each line was truncated before matching. Long lines are now scanned in overlapping windows, so the whole line is covered while each match stays bounded.

Tests

Findings are asserted against exact (id, file, line, severity) goldens, with locks for severity sync, scrub coverage, redaction, and long-line bundle coverage. Each fix is proven non-vacuous (the test fails when the bug is reintroduced).

Full detail in CHANGELOG.md.

Install (pinned)

git clone --branch v0.1.1 https://github.com/kidsmeal/git-gud-security ~/.claude/skills/git-gud-security
Assets 2
Loading