v6.4.0

[6.3.0] — 2026-07-13

Added

• CWE-639 IDOR Detection — World-first among open-source SAST tools. Detects
  Insecure Direct Object Reference patterns across Express/DAO (JS), Django ORM
  (Python), Flask-SQLAlchemy (Python), and Spring Boot JPA (Java). Identifies route
  parameters used in database queries without session/ownership verification.
• Variable propagation in fallback detectors — All three language analyzers
  (JS, Python, Java) now trace taint through variable assignments, enabling detection
  of patterns like const x = req.query.file → fs.readFile(x).
• Struts2/Spring parameter binding detection — Java fallback now recognizes
  implicit taint sources from framework parameter binding (setters, @RequestParam,
  @PathVariable) in addition to explicit getParameter() calls.
• Django ORM .raw() propagation — Multi-hop taint tracing through string
  concatenation assignments: name = request.GET.get('q') → sql = "SELECT..." + name
  → Model.objects.raw(sql).

Improved

• Known-vulnerability detection: 88.6% → 91.4% across 4 test applications
  (NodeGoat, goof, pygoat, dvja) covering 35 CWE instances.
• Production noise: 0.04 findings/kLOC — Verified across 16 real production
  repositories (366,638 LOC). Scanner correctly identifies well-written production
  code as clean.
• Python fallback cap — Increased from 20 to 25 with injection CWE prioritization
  to prevent CWE-89/CWE-78 truncation.
• Java Runtime.exec() pattern — Now matches runtime.exec(command) where
  command is a variable, not just chained .exec(var + "...").

Fixed

• Confidence pipeline bug — pattern-rust analysis kind now recognized as
  structural evidence, preventing false demotion of legitimate findings.
• Paren-location bug — _arg_contains_taint now correctly locates the opening
  parenthesis in regex-matched sink patterns across all three language fallbacks.
• SQLAlchemy parameterized query FP — .execute(text(...), {'key': var}) now
  correctly identified as safe (parameterized).
• CWE-22 method-call FP — f.read(), obj.write() patterns no longer flagged
  as path traversal.
• Python CWE-22 secure_filename guard — Files using werkzeug.utils.secure_filename
  are now correctly excluded from path traversal detection.

Performance

• 1,215 tests passing (96.4%)
• CVE recall: 100% (164/164 across 5 languages)
• 16-repo production benchmark: 0.04 findings/kLOC average