Skip to content

v6.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Jul 20:07
v6.1.0
4852f58

[6.1.0] — 2026-07-08

Added

  • Taint-aware demotion engine: pattern-only findings with no taint trace
    are now demoted from HIGH/CRITICAL to MEDIUM at most. CWE-617/200/532
    (code-quality rules) are always LOW. CWE-798 (hardcoded secrets) is exempt.
  • _HARDCODED_DEMOTE_CWES and _NO_TRACE_DEMOTE_CWES constants
    in CLI post-processing pipeline

Changed

  • HIGH/CRITICAL precision: 0% → 19.1% across 43 repos
  • Findings/file: 3.1 → 1.7 (default filter)
  • CWE-617 (silent exceptions) severity: HIGH → LOW
  • CWE-117 (log injection) without user input: CRITICAL → LOW
  • CWE-89/78/1188/352/601 without taint trace: HIGH → MEDIUM

Verified

  • 43 repos scanned, 4,114 findings, 1,075 HIGH/CRIT → 205 suspected real
  • 1 confirmed real vulnerability (CWE-601 open redirect via request.referrer)
  • 1,249 tests pass, 0 regressions
  • Noise gate CI: 0% HIGH/CRIT false-negative guarantee maintained
Assets 9
Loading