Skip to content

ShipProof v0.6.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Aug 03:47
· 49 commits to main since this release
v0.6.0
5628223

ShipProof v0.6.0 — AI Agent Cost Engine, Worktree Sandbox & 150+ Enterprise Multi-Language Gate

ShipProof v0.6.0 is a major capability release expanding production-readiness gating for AI coding workflows, bringing token & financial cost modeling, Git worktree isolation sandboxing, shields.io status badges, Next.js 15 App Router protections, Cloud IaC, Edge Runtimes, Real-Time Concurrency, Cryptography, and 60 new enterprise static analysis rules (SP591 – SP650).

Highlights

  • AI Cost & Token Budget Engine (shipproof cost): Automatic context footprint estimation (~3.8 bytes/token), prompt caching discount models across frontier models (Claude 3.7/3.5, GPT-4o, Gemini 2.0/1.5, DeepSeek-V3/R1), multi-iteration cadence projections, and budget gate enforcement (--budget-usd).
  • Git Worktree Isolation Sandbox (shipproof worktree): Safe workspace isolation in .work/<task> with path traversal validation, UTF-8 non-ASCII directory hardening, pre-merge gate verification, and clean worktree teardown.
  • Production Status Badge (shipproof badge): Emits shields.io Markdown or JSON status badges for README.md.
  • Next.js 15 & TypeScript Enterprise Gate (SP591 – SP600): Server-only DB/ORM leakage in "use client" bundles (SP591), mutating route body casts to any (SP592), unawaited Next.js 15 route segment params (SP593), authenticated route caching (SP594), Server Action mutations missing revalidation (SP595), client React hooks in Server Components (SP596), sequential waterfall requests blocking SSR (SP597), cookie routes missing CSRF origin checks (SP598), TypeScript non-null assertions on API responses (SP599), Server Action IDOR on client-provided userId (SP600).
  • Multi-Language Enterprise Production Gate (SP601 – SP625): OWASP Top 10 for LLMs (SP601–SP605), Kubernetes & Cloud Hardening (SP606–SP610), GraphQL & gRPC API Resilience (SP611–SP614), OAuth2 / PKCE Security (SP615–SP617), Data Safety (SP618–SP620), and Multi-Language Failure Modes in Rust, Go, Java, Python, C# (SP621–SP625).
  • Cloud IaC, Edge Runtimes, Real-Time & Cryptography Gate (SP626 – SP650): S3 public wildcard permissions (SP626), unencrypted storage (SP627), open security group SSH/RDP ports (SP628), wildcard IAM policies (SP629), CloudFront HTTPS enforcement (SP630), Edge runtime Node module check (SP631), unbounded KV fetch loops (SP632), Edge Worker buffering (SP633), authenticated CDN caching (SP634), WebSocket heartbeat monitoring (SP635), Server-Sent Events close listeners (SP636), WebSocket auth verification (SP637), BroadcastChannel unmount leaks (SP638), legacy symmetric ciphers (SP639), weak RSA key lengths (SP640), static hardcoded IV reuse (SP641), broken MD5/SHA1 hashes (SP642), timing-unsafe secret comparisons (SP643), Svelte {@html} XSS (SP644), Android WebView file access (SP645), iOS SSL validation bypass (SP646), API proxy SSRF (SP647), React useEffect WebSocket teardown (SP648), multitenant query tenant scoping (SP649), and recursive JSON nesting bounds (SP650).

Compatibility

  • Node.js 20 or newer for the CLI.
  • Python 3.10 or newer for scan, policy, budget, capacity, worktree, and cost tools.
  • Config schema version 1 and evidence envelope 1.0.
Assets 3
Loading