burpctl 1.1.0 — hardening release

bp 1.1.0 — hardening release

Post-v1.0.0 hardening of the bp CLI + Kotlin Burp REST extension, driven by extensive adversarial
QA and iterative fix-and-verify cycles. Both test suites green (Python + Kotlin), mypy --strict + ruff clean.

Highlights

• IDOR detector, rebuilt. Full-body comparison (catches same-length/different-content records),
  case-insensitive --param matching with URL param-name preservation, and guards for empty bodies
  and non-2xx baselines — removing both false negatives and false positives.
• Principled decoder auto-detect. All-hex strings decide terminally (hex|plain, never base64
  garbage), unpadded/over-padded and URL-safe base64, UTF-8 gating, form-+ peeling, and no JDK
  class-name leaks.
• Secret redaction completed — and made JSON-safe. Now masks Cookie/Set-Cookie and
  Basic/Token/Digest credentials (header-line and JSON-embedded), and never breaks --format json
  structural validity.
• PII / output hygiene. bp check, bp req, and bp history replay no longer dump raw
  response bodies/headers (cookies, SSNs) to default stdout — they project to safe display fields.
• Ledger hardening. Survives a read-only ~/.bp, self-protects every write against sqlite3
  errors, strips URL credentials from the stored target, and the db/dir are now private
  (0o600/0o700).
• Exit-code contract. bp check exits 5 on findings (CI-gatable); Pro-only vs infra failures
  are distinguished (4 vs 1); a malformed server response is a clean error, not a traceback.
• Output contract (OUTPUT.md) compliance. Uppercase table headers, case-insensitive --fields,
  union-based unknown-field detection, one-word --format quiet verdict for bp check.
• Contract drift & doc honesty. Python models mirror the Kotlin nullability; the IDOR algorithm,
  decoder docs, and collaborator exit-code docs were corrected to match the shipped code.

See bp/CHANGELOG.md for the
full, themed changelog.

Full Changelog: v1.0.0...v1.1.0