v1.1.1: Security Fixes, Engine Enhancements & Performance Upgrades

🛡️ AuthWarden v1.1.1 Release Notes

This patch release addresses key operational and security bug fixes, expands scanning coverage for AI Agents & Lockfiles, introduces Shannon entropy analysis, and expands test coverage to 40 unit tests.

🐛 Bug Fixes

• CLI Arg Parsing: Fix target path resolution when options precede positional path argument (e.g. authwarden scan --format json .).
• Single File Scanning: Fix walkDirectory to properly support scanning single files directly (authwarden scan server.js) and error out cleanly on non-existent paths.
• BOLA / IDOR Early Break: Fix premature break; loop in apiAuthScanner that previously skipped subsequent findings in the same file.
• GCP API Key Regex: Fix character class regex to properly detect GCP keys containing hyphens.
• Database URI Regex: Support connection URIs without trailing paths (e.g. redis://user:pass@host:6379).
• Command Injection FP: Fix SAST-002 to avoid flagging benign constant template literals while supporting direct exec(req.query.cmd) calls.
• Multi-line TOCTOU: Fix LOGIC-002 to detect multi-line balance and coupon race conditions via sliding context window.
• OpenAPI YAML: Support SPEC-001 for OpenAPI/Swagger YAML specifications without external dependencies.
• GitHub Actions Integration: Support reading process.env.INPUT_* in action.yml.

🚀 New Features & Enhancements

• Shannon Entropy Analysis (SEC-010): Added native Shannon entropy calculation to detect generic high-entropy API secrets and private tokens.
• Lockfile SCA Scanning: Added package-lock.json v2/v3 support to uncover vulnerable transitive dependencies, with in-memory reachability caching.
• MCP Server Config Guard (MCP-003): Detect hardcoded secrets and API keys inside mcp.json and Claude Desktop manifests.
• Multi-stage Dockerfile Guard: Added USER directive tracking that resets across FROM build stages.
• Inline Suppression: Support developer inline suppression comments (// authwarden-disable-line, // authwarden-ignore, // authwarden-disable-next-line).
• Custom Rule Engine: Automatic loading of enterprise rules from rules/*.json.
• Gitignore Respect: Automatic respect for .gitignore and built-in exclusion of .DS_Store and past scan reports.

🧪 Test Suite

• Test coverage expanded from 15 to 40 automated tests with 100% pass rate in ~200ms.

v1.1.0 - Reachability SCA, Business Logic Guard, & OpenAPI Auditor 🚀

What's New in v1.1.0

📦 Software Composition Analysis (SCA) & Reachability-Aware CVEs

• Scans package.json, requirements.txt, go.mod, and composer.json for known high/critical CVEs.
• AST Reachability Analysis: Distinguishes between actively imported dependencies vs dormant packages to slash false-alarm noise by 80%.

⚖️ Business Logic & Workflow State Guard

• LOGIC-001: Detects client-manipulated payment and approval flags (req.body.is_paid, req.body.approved).
• LOGIC-002: Catches non-atomic Time-of-Check to Time-of-Use (TOCTOU) race conditions in financial balances and coupons.
• LOGIC-003: Arithmetic boundary checks for negative quantity/price tampering.
• LOGIC-004: Detects jwt.verify() calls missing explicit algorithm whitelists.
• LOGIC-005: Flags client-only logouts missing server-side session revocation.

📋 OpenAPI & API Contract Security Auditor

• Audits openapi.yaml, swagger.json, and Postman collections for unauthenticated sensitive operations.
• Identifies security scheme bypasses (security: []) and credentials leaked in URL query parameters.
• Flags insecure cleartext HTTP transport in API server URLs.

🎨 Design & Open Source Hygiene

• Redesigned pixel-perfect terminal demo with symmetric alignment.
• Added comprehensive SECURITY.md responsible disclosure policy.
• Added standard GitHub issue templates and pull request templates.
• Sub-20ms cold scan speed maintained with zero external dependencies.

v1.0.0 - Initial Release of AuthWarden 🛡️

🛡️ AuthWarden v1.0.0

We are thrilled to announce the official release of AuthWarden v1.0.0 — a developer-first, zero-dependency static security scanner specifically built to catch the #1 cause of modern cloud breaches: Broken Authorization (BOLA/IDOR), Shadow APIs, and Exposed Secrets.

---

🚀 Highlights

• ⚡ Blazing Fast (< 1s): Scans 50,000+ lines of code in under 1 second using pure, optimized JavaScript.
• 📦 Zero External Dependencies: Pure Node.js (>= 18) standard library. Zero supply chain attack surface.
• 🎯 API & Auth Focus (OWASP API Top 10):
  • Shadow Admin APIs: Flags endpoints like /admin, /billing, /manage lacking authentication middleware.
  • BOLA / IDOR Detection: Identifies unscoped database queries that query by object ID without tenant/owner filtering.
  • Next.js Server Actions Guard: Catches publicly invokable 'use server' mutations that execute without session checks.
• 🔑 Active Secret Verification (--verify):
  • Detects 30+ credential types across AWS, GitHub, Stripe, OpenAI, and Database URIs.
  • Safe, read-only live validation to check if exposed keys are currently active without performing state modifications.
  • Automatic redaction (sk_live_51M***...***) to protect logs.
• 🐳 IaC & Container Misconfiguration Doctor:
  • Flags Docker containers running as root.
  • Catches dangerous /var/run/docker.sock volume mounts and privileged container mode.
  • Audits Terraform S3 buckets for public-read ACLs.
• 🤖 AI Agent & MCP Tool Auditing (2025–2026 Trend):
  • Audits Model Context Protocol (mcp.json) configs for unsandboxed shell execution (bash, powershell) and root filesystem access.
• 🛠️ Seamless DX & Integrations:
  • 1-second Git pre-commit hook setup: npx authwarden init-hook.
  • Ready for GitHub Code Scanning with standard SARIF 2.1.0 export (--format sarif).
  • GitHub Actions pull request sticky comments (--format markdown).

---

⚡ Quickstart

Run directly in any repository root without installing:

npx authwarden scan .

To enable active live secret verification:

npx authwarden scan . --verify

Install as pre-commit hook:

npx authwarden init-hook

---

Full Changelog: https://github.com/manhnv-vnext/authwarden/commits/v1.0.0