v0.6.2

Changelog

All notable changes to this project will be documented here

0.6.2 - 2026-08-03

✨ New features

• Feat: add read-only token capability inference - (4b559f9)
• Feat: add gated multi-ecosystem package tampering - (ecf7598)
• Feat: add static package archive inspection - (3d6e390)
• Test: add RED release-intel dependency report coverage - (7ceed1d)
• Test: add RED coverage for cooldown CLI options - (1ede48a)
• Test: add RED registry metadata coverage - (b51e9b0)
• Feat: add dependency release age intelligence - (d7d7132)
• Test: add RED coverage for dependency release intelligence - (e7f5820)
• Test: add RED coverage for watch ref integration - (5f1a6db)
• Test: add RED coverage for GitLab ref snapshots - (5ee8dc2)
• Test: add RED coverage for release ref monitoring - (c422216)
• Test: add RED coverage for release governance - (2a9c1c1)
• Feat: add native SBOM and GitLab dependency reports - (8f6025d)
• Test: add RED coverage for dependency report formats - (59926dc)
• Test: add RED coverage for threat-feed IP and hash IOCs - (bc0d7ca)
• Test: add RED coverage for archived SBOM discovery - (f81cf3f)
• Test: add RED coverage for GitLab PAX archives - (b2e18f0)
• Test: add RED coverage for mutable release refs - (2a2804b)
• Test: add RED coverage for depx CLI and enumeration - (c8fe5fa)
• Test: add RED coverage for native depx scanning - (1d6c6b7)

✨: New features

• Feat: expose runner log sampling bounds - (308f30f)
• Feat: expose project-aware token validation - (65b6a6d)
• Feat: complete runner log fallback discovery - (356f866)
• Feat: expose package artifact verification - (b7a3097)
• Feat: verify package source and provenance - (1207d27)
• Feat: expand package persistence detection - (d4c4df4)
• Feat: expose dependency cooldown controls - (738e3aa)
• Feat: monitor release refs and workflow changes - (717f32e)
• Feat: collect GitLab ref snapshots safely - (8151774)
• Feat: detect release ref lifecycle anomalies - (bd7f967)
• Feat: audit publishing branch and tag governance - (9d04eb2)
• Feat: flag mutable include release refs - (c66a6ca)
• Feat: expose depx audits in CLI and enumeration - (f76af6b)
• Feat: integrate native depx dependency auditing - (f1c3bea)

🐛 Bug fixes

• Fix: reject shell metacharacters in package entry paths - (a159622)
• Fix: isolate package tamper previews - (40f40d6)
• Fix: avoid treating branch names as release tags - (a65bc56)
• Fix: keep watch JSON output machine readable - (7d42e08)
• Fix: include release intelligence in dependency reports - (b1f8549)
• Fix: preserve scoped package paths in registry queries - (ab003f4)
• Fix: consume threat-feed IP and hash indicators - (820c484)
• Fix: discover SBOMs in GitLab archives - (df42676)
• Fix: accept GitLab PAX archive metadata - (dd53721)

📚 Documentation

• Docs: document runner and token reconnaissance - (ea243f8)
• Docs: record package entry path hardening - (7a77950)
• Docs: document gated package tamper testing - (e2e907b)
• Docs: document static package artifact verification - (b9c1f09)
• Docs: record final P0 depx validation - (be559d6)
• Docs: document P0 release intelligence and monitoring - (b3efdd2)
• Docs: record P0 depx TDD evidence - (4261ebe)
• Docs: document native depx dependency auditing - (968a238)

🎨 Styling

• Style: format runner log test limits - (3d1ff5b)

🧪 Testing

• Test: expose runner log sampling bounds - (f4fd9b8)
• Test: expose project-aware token validation - (37d4cda)
• Test: specify read-only token capability inference - (2c42b03)
• Test: specify bounded runner log fallback - (b947552)
• Test: reject package entry shell expansion - (d4d56e1)
• Test: harden package tamper isolation and identity - (cd26224)
• Test: define safe multi-ecosystem package tampering - (9938b32)
• Test: exercise artifact verifier CLI end to end - (5fe69cc)
• Test: distinguish release tags from bare branches - (f636c0f)
• Test: harden artifact verifier boundaries - (062b375)
• Test: define artifact verifier CLI and taxonomy - (ba36f72)
• Test: define source and provenance verification - (abde8dd)
• Test: define bounded package artifact inspection - ([b410c60](b410c60...

v0.6.1

Changelog

All notable changes to this project will be documented here

0.6.1 - 2026-07-31

✨ New features

• Added logo, badges to readme, and plumber workflow - (58c3281)

⚙️ Miscellaneous

• Merge pull request #44 from mr-pmillz/release/v0.6.1 - (8bbcc04)
• Release/v0.6.1 - (8bbcc04)
• Chore: update changelog - (84ce15b)
• Merge pull request #43 from mr-pmillz/qa/updates - (dc34e6c)
• Qa/updates - (dc34e6c)
• Do not cache setup-go action on release job - (452d68a)
• Ci(deps): bump github actions - (02a7292)
• Astro version bump - (f639c7e)
• Use signed commits for gogatoz gh app changelog commit - (31f263f)
• Remove markdown file - (21e8e86)
• Merge pull request #36 from mr-pmillz/main - (efda828)
• Sync main back 2 develop - (efda828)

v0.6.0

Changelog

All notable changes to this project will be documented here

0.6.0 - 2026-07-20

✨ New features

• Add agent skills for codex - (fbcc5d5)
• Proper recursive descent parser (lexer + parser) that supports the full - (e6df569)
• Feat: add attack surface recommender to enumerate reports - (02d6c15)
• Feat: add --local flag for offline CI/CD enumeration - (0fb69e0)
• Feat: add validate command for token scope probing - (7d23daf)
• Feat: add pkg/validate for token scope probing - (bc6cecf)
• Feat: add --self and --all-projects flags to enumerate command - (e1dc31a)
• Fix: add env exfil artifacts and || true to 4 payload generators - (1dc573c)
• Revert "docs: add Phase 2 CTF expansion plan for 7 unused attack modes" - (bbe288b)
• Docs: add Phase 2 CTF expansion plan for 7 unused attack modes - (4fe2b68)
• Feat: add --auto-encrypt for automatic RSA-4096 encrypted exfiltration - (788899e)
• Feat: add artifact exfil to all 13 expansion payloads with varied techniques - (fafdb7d)
• Docs: add OIDC CE limitation note to ctf-qa-validation skill - (2966184)
• Docs: add cleanup and setup-lab.sh verification to ctf-qa-validation skill - (2c15db2)
• Docs: add CTF expansion design spec and implementation plan - (6caf6bf)
• Feat: add Sprint 4 attack vectors (V7, V11, V13) with analyzer rules - (b765967)
• Feat: add Sprint 3 attack vectors (V1, V4, V6) with analyzer rules - (b866ddd)
• Feat: add Sprint 2 attack vectors (V2, V9, V10) with analyzer rules - (430805e)
• Feat: add Sprint 1 attack vectors (V3, V5, V8, V12) - (cd9b015)
• Feat: add TLS support for pivot callback server and bump RSA default to 4096 - (2ed6f3e)
• • callback: add StartTLS() with --tls-cert/--tls-key for HTTPS callbacks - (2ed6f3e)
• • cmd/pivot: add --tls-cert and --tls-key flags - (2ed6f3e)
• Fix: address bugs, concurrency issues, API compatibility, and code quality - (4c8e566)
• • pipeline: add StopCacheEvictor() to allow stopping the background goroutine - (4c8e566)
• Feat: add group-level security dashboard (feature 23) - (e59f9bf)
• Feat: add CI/CD config drift detection (feature 24) - (b6ecfb6)
• Feat: add environment/deployment analysis with 4 finding rules - (4132e68)
• Feat: add CI/CD variable inheritance analysis (feature 28) - (bd86c0b)
• Feat: add SPDX 2.3 output and SBOM analyzer rules (feature 22) - (b76229f)
• Feat: add GitLab Pages CI/CD security analysis (feature 19) - (ba2adc0)
• Docs: add implementation plan for 6 new analysis features - (8467484)
• Docs: add design spec for 6 new analysis features - (98bbf0d)
• Refactor: address 8 code quality issues across analyze, attack, bloodhound, enumerate, pipeline, and pivot packages - (2ec3a94)
• Docs: add Phase 4 cleanup to ctf-qa-validation skill - (8e49d54)
• Refactor: address code review — fix bugs, reduce complexity, extract shared utilities - (1dd1411)
• • Fix callback correlation in pivot orchestrator: add Project field to - (cfe8cb7)
• Feat: add CWE/ATT&CK/OWASP CI/CD Top 10 taxonomy and dependency graph visualization - (4ffd2bd)
• Refactor: address code review items #15, #16, #17, #20 - (23554c7)
• Fix: address code review findings — bugs, dead code, and missing wiring - (31722e8)
• • ai_config.go: add //nolint:gosec for finding ID constants (#2) - (31722e8)
• Refactor: address code review — concurrent pivot, split attack.go, structured logging, and P2 fixes - (96f9487)
• • api/search.go, mcp/tools_search.go: add context cancellation in producer - (8f13068)
• • gitlabx/{search,tree,languages}.go, bloodhound/client.go: add io.LimitReader - (8f13068)
• • pipeline/resolve.go: add ClearRemoteCache() and max-entries eviction (1000 cap) - (8f13068)
• Feat: add supply chain attack surface detection and attack techniques - (8508079)

✨: New features

• Feat: replace rules:if evaluator with recursive descent AST parser - (e6df569)
• Feat: extract runner metadata from job logs as fallback - (469fc9e)
• Feat: integrate new findings into report pipeline and exploitable mappings - (525206d)
• Feat: implement 14 supply chain attack surface enhancements (M1-M14) - (6fe8849)

🐛 Bug fixes

• Fix(ctf): validate all challenge attack paths - (4576c80)
• Fix: stop truncating recommendation URLs in pterm output - (676f1e8)
• Fix: update logrunner regex for modern GitLab trace format - (6582c44)
• Files, parses them, and runs the full analysis pipeline. - (0fb69e0)
• Fix: make all expansion payloads work end-to-end against live CTF lab - (2fd2d1b)
• fix xargs -0 exfil fallback (pipe + -I{} instead of redirect) - (2fd2d1b)
• Fix: resolve all linter issues from attack vector expansion - (201616a)
• Fix: global cache detection, runner data gap, MR trigger arg; add chain poisoning detection - (80884d9)
• fields consistently across all runner scopes; consolidate into shared - ([80884d9](80884d9...

v0.5.9

Changelog

All notable changes to this project will be documented here

0.5.9 - 2026-07-15

✨ New features

• Feat: add missing attack modes to report + update BloodHound icons - (7a8e244)
• Report exploit map: add 9 new finding-to-attack mappings for LOTP, - (7a8e244)
• Added bump deps claude skill for dependabot alerts - (10bd467)
• Feat: add built-in listener for supply chain worm callback exfiltration - (3a785b5)
• --ror-listen, extended with Project field support for the - (3a785b5)
• Docs: add CTF lab screenshots to gogatoz Astro docs - (da02284)

🐛 Bug fixes

• Fixed bugs and improved features - (8a5f87a)
• Fix: auto-merge retry on 405 and pivot BFS project discovery at depth > 0 - (f63520b)
• Fix: correct pipeline URL reporting, cache-poison mkdir, and nested-runner download - (b460f90)
• Fix: worm listener should wait for callbacks regardless of promoted count - (82f9ad2)
• Fix: resolve remaining SA5011 staticcheck nil pointer warnings in test files - (79e036a)
• Files so staticcheck recognizes subsequent pointer dereferences as - (79e036a)
• Fix: correct FLAG regex and sanitize worm stage name extraction - (44b3284)
• • memorydump.go: fix broken ERE pattern FLAG+[^+]++ → FLAG[+][^+]+[+] - (44b3284)
• Fix: resolve SA5011 staticcheck nil pointer warnings in test files - (1d56868)
• Fix: prevent gitlab.com and seed nodes from polluting BloodHound graphs - (dd658b3)
• Fix: update BloodHound schema CICD_Project color and CICD_Job icon - (379055a)
• Fix: supply chain worm injected duplicate stages key breaking YAML - (a3a1908)
• Fix: multiple payload generators produced invalid YAML + runtime failures - (072fdff)
• The same YAML indentation bug: script content inserted into - | block - (072fdff)
• Fix: LOTP Phantom Gyp payload output was silently discarded - (80e38f1)

📚 Documentation

• Docs: update CLAUDE.md with payload generator gotchas from CTF session - (9be7b4f)

🛠 Improvements

• Update .gitignore - (e277b12)
• Update CLAUDE.md - (06d71ac)

⚙️ Miscellaneous

• Merge pull request #32 from mr-pmillz/release/v0.5.9 - (da023d8)
• Release/v0.5.9 - (da023d8)
• Chore: update changelog - (9f5fd6f)
• Merge pull request #31 from mr-pmillz/fix/bugz - (8a5f87a)
• Expand memory dump secrets grep - (10754bb)
• Go fix ./... - (473c126)
• • auto-merge retries MergeMergeRequest up to 10 times with backoff, - (f63520b)
• allowing the MR pipeline to complete before merging (fixes 405) - (f63520b)
• • pivot orchestrator discovers projects via token membership at - (f63520b)
• depth > 0 instead of re-scanning only the initial targets, enabling - (f63520b)
• full BFS lateral movement across gateway → middleware → crown - (f63520b)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (f63520b)
• • commit-ci now reports the CI-file pipeline instead of the stale - (b460f90)
• branch-creation pipeline by snapshotting the prior ID and waiting - (b460f90)
• for a newer one - (b460f90)
• • cache-poison default payload adds mkdir -p .git/hooks before writing - (b460f90)
• the post-checkout hook (fixes "No such file or directory") - (b460f90)
• • nested-runner payload checks for existing gitlab-runner binary before - (b460f90)
• downloading, falling back to system binary or fresh download - (b460f90)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (b460f90)
• When --webhook was provided but the worm propagated to 0 repos, the - (82f9ad2)
• Listener was immediately stopped without waiting. Now the listener - (82f9ad2)
• Always waits for the full timeout when --webhook is set, allowing - (82f9ad2)
• Callbacks from previously infected repos or manual testing. - (82f9ad2)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (82f9ad2)
• Add explicit return after t.Fatal/t.Fatalf in nil guards across 9 test - (79e036a)
• Unreachable. - (79e036a)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (79e036a)
• Resolve SA5011 staticcheck nil pointer warnings in test files - (cbffbe0)
• • supplychain_worm.go: validate detected stage name against safe pattern - (44b3284)
• to prevent YAML injection from crafted target CI configs - (44b3284)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (44b3284)
• Chore: apply linter auto-fixes to memorydump, worm, bloodhound, and exporter test - (b276879)
• Linter/formatter changes applied by golangci-lint and goimports. - (b276879)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (b276879)
• Add explicit return after t.Fatal/t.Fatalf in nil-check guard blocks. - ([1d56868](https://github.com/mr-pmillz/gogato...

v0.5.8

Changelog

All notable changes to this project will be documented here

0.5.8 - 2026-07-10

⚙️ Miscellaneous

• Merge pull request #27 from mr-pmillz/release/v0.5.8 - (5e291bb)
• Release/v0.5.8 - (5e291bb)
• Chore: update changelog - (0b3193d)
• Merge pull request #26 from mr-pmillz/fix/release_action_2 - (58ff1dd)
• Plz work - (58ff1dd)
• Plz work - (82ddceb)
• Merge pull request #25 from mr-pmillz/main - (09a00aa)
• Sync main back 2 develop - (09a00aa)

v0.5.3

Changelog

All notable changes to this project will be documented here

0.5.3 - 2026-07-09

✨ New features

• Docs: add 5 new attack modes + search flags to command reference - (b6b042b)
• • attack: add memory-dump, container-escape, supply-chain-worm, - (b6b042b)
• • search: add --language, --topic, --path-exists, --path-pattern, - (b6b042b)
• Docs: add command reference pages for explain, pbom, query, secretscan - (018c061)
• • enumerate: add Plumber compliance features (--score, --badge, - (018c061)
• • astro.config.mjs: add sidebar entries for all 4 new pages - (018c061)
• Fix: resolve 4 bugs in advanced attack modes — CLI flags, artifact support - (abc3687)
• • memory-dump: add artifacts block and copy memdump_* files to working - (abc3687)
• • container-escape: add artifacts block and copy escape_* files to - (abc3687)
• .gogatoz.yaml support for configurable forbidden tags, authorized registries, - (1d1f590)
• • 6 new renderPayload() cases for --payload-only support - (8a2ca6a)
• • attack: add Value field to injectVar struct (was using key as value) - (19abe8e)
• • attack: add 5 missing payload types to renderPayload switch - (19abe8e)
• • container_escape: add image name + sh -c wrapper to docker run - (19abe8e)
• • container_escape: add missing fi for privileged check block - (19abe8e)
• • query: add evidence column to findings table, handle unknown severities - (19abe8e)

✨: New features

• Feat: port Plumber compliance features — 11 new detections, SARIF/GLSAST/PBOM output, scoring, MR comments, badges, config system - (1d1f590)
• Feat: implement Shai-Hulud gap features — 6 new payload modules + enhancements - (8a2ca6a)

🐛 Bug fixes

• Fix: resolve 10 adversarial review findings in Plumber compliance port - (6c3e416)
• • fix UUID operator precedence in CycloneDX generateSerialNumber (94% invalid) - (6c3e416)
• • fix scoring inversion by grouping by code only, using worst severity weight - (6c3e416)
• • fix FP finding count inconsistency in report Summary vs severity breakdown - (6c3e416)
• • fix apk/apt-get extraCheck to examine all packages, not just the first - (6c3e416)
• Fix: resolve 7 adversarial review findings across attack modules - (41165b7)
• Fix: resolve all 15 golangci-lint issues + review Qwen3.6 Codex fixes - (3998aa8)
• Fix: resolve 25 bugs from code review (6 critical, 8 high, 11 medium) - (19abe8e)
• • ror_listener: fix timer leak in WaitFor (create timer once before loop) - (19abe8e)
• • ror_listener: fix data race on Listener.srv and len(l.results) - (19abe8e)
• • query: fix redactValue exposing full short secrets - (19abe8e)
• • variable_injection: fix callback JSON project field, fix URL encoding - (19abe8e)
• • attack: fix error message, remove unnecessary branch in variable-inject - (19abe8e)
• Fixes - (2dc3f5a)

🎨 Styling

• Style: gofmt whitespace fixes across 14 files - (f3e5fad)

🛠 Improvements

• Update CLAUDE.md CTF section to 26 flags / 9950 pts across 6 tracks - (f863782)
• Update .gitignore - (bfbcdcd)
• Update .gitignore - (747dd59)
• Update .gitignore - (bfe2177)
• Update .gitignore - (6397d10)

⚙️ Miscellaneous

• Merge pull request #9 from mr-pmillz/develop - (cc5ee5b)
• New attacks, fixes and updates - (cc5ee5b)
• Merge pull request #8 from mr-pmillz/feat/attack-fixes - (41ac58d)
• Feat/attack fixes - (41ac58d)
• variable-inject, c2-channel mode descriptions, option sections, - (b6b042b)
• and examples (#19-23) - (b6b042b)
• --output, --format flags and examples for code search, CI-only - (b6b042b)
• projects, and search-to-enumerate pipeline - (b6b042b)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (b6b042b)
• • explain: finding code lookup with --list, --all, --json - (018c061)
• • pbom: Pipeline Bill of Materials with CycloneDX 1.5 SBOM output - (018c061)
• • query: SQLite database queries for sessions, findings, secrets, - (018c061)
• credentials, attacks, exfil data (7 subcommands) - (018c061)
• • secretscan: clone + TruffleHog/Gitleaks/Titus scanning with - (018c061)
• project discovery, clone depth, offline mode - (018c061)
• --mr-comment, --format sarif|glsast, --log-scrape, --group, - (018c061)
• --filter-false-positives) with 7 new example sections - (018c061)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (018c061)
• Go fix ./... - (ac2c0e7)
• Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (f3e5fad)
• • container-escape: use --tags/--image CLI flags instead of hardcoded - (abc3687)
• ["docker"] and "docker:dind"; pass through ExfilMethod, ExfilTarget, - ([abc3687](abc...

v0.5.2

Changelog

All notable changes to this project will be documented here

0.5.2 - 2026-06-30

⚙️ Miscellaneous

• Merge pull request #6 from mr-pmillz/develop - (b24062b)
• Merge develop into main - (b24062b)
• Version bump actions - (85ff613)
• Merge pull request #4 from mr-pmillz/feature/output - (a46a295)
• Do not display built-in vars in attack --secrets - (a46a295)
• Do not display built-in vars in attack --secrets - (2a60552)
• Merge pull request #3 from mr-pmillz/main - (ab67f88)
• Sync main back to develop - (ab67f88)

v0.5.1

Changelog

All notable changes to this project will be documented here

0.5.1 - 2026-06-08

✨ New features

• Fix: add minID int64 parameter. In the secrets attack path, capture the - (c1a67e6)
• Feat: add LOTP detection rules, attack payloads, and exfil artifact download - (1a55605)

🐛 Bug fixes

• Fix: stealthy dynamic job names + WaitForExfilPipeline multi-pipeline search - (a3abe2a)
• Fix: WaitForPipelineForRef now skips pre-existing pipelines (minID param) - (c1a67e6)
• Fix: route secrets-mode progress output to stderr in --json mode - (54c02f9)
• Fix astro docs path for home page links - (8ab92a3)
• Fix astro docs path for github pages - (2b9a178)

🛠 Improvements

• Update docs trigger gitlab pages docs action - (22e35be)

⚙️ Miscellaneous

• Merge pull request #2 from mr-pmillz/develop - (109d54c)
• Merge develop into main - (109d54c)
• Merge pull request #1 from mr-pmillz/feature/lotp - (cf6284b)
• Retrieve artifacts after attack secrets and add LOTP findings/attacks - (cf6284b)
• Bug: EnsureBranch pushes the branch from main, triggering a pipeline with the - (a3abe2a)
• Original CI YAML that has no "exfiltrate" job. The subsequent UpsertFile - (a3abe2a)
• (exfil CI commit) creates a second pipeline. The old code tried to identify - (a3abe2a)
• The correct pipeline by ID, but race conditions made this fragile. - (a3abe2a)
• Fix (two-part): - (a3abe2a)
• 1. WaitForExfilPipeline replaces the old WaitForPipelineForRef + WaitForJobCompletion - (a3abe2a)
• pair for the --secrets path. It scans the 5 most recent pipelines on the branch - (a3abe2a)
• each tick and looks for a job with the target name — tolerating branch-creation - (a3abe2a)
• pipelines that appear first with no matching job. - (a3abe2a)
• Extracted into listRecentPipelines() and findJobInPipeline() helpers to keep - (a3abe2a)
• gocognit under threshold. - (a3abe2a)
• 2. Dynamic stealthy job names: GenerateExfilCI now uses a random "ci-XXXXXX" name - (a3abe2a)
• (e.g. "ci-a3f9b2") generated by GenerateExfilJobName(). The name is returned - (a3abe2a)
• from RunExfil() (new third return value) so the caller can pass it to - (a3abe2a)
• WaitForExfilPipeline. Job names look like routine CI infrastructure rather than - (a3abe2a)
• "exfiltrate" which is obviously suspicious. - (a3abe2a)
• ExfilOptions.JobName allows callers to pin the job name (empty = auto-generate). - (a3abe2a)
• RunExfil now returns (url, jobName, error) — all callers updated. - (a3abe2a)
• EnsureBranch() pushes the branch from main, triggering an immediate pipeline. - (c1a67e6)
• The subsequent UpsertFile() (exfil CI commit) triggers a second pipeline. - (c1a67e6)
• WaitForPipelineForRef was returning the branch-creation pipeline (wrong one), - (c1a67e6)
• Causing WaitForJobCompletion to look for "exfiltrate" in the wrong pipeline. - (c1a67e6)
• Latest pipeline ID before RunExfil(), then pass it as minID to ensure - (c1a67e6)
• WaitForPipelineForRef only returns a pipeline ID strictly greater than - (c1a67e6)
• Any pre-existing pipeline on the branch. - (c1a67e6)
• All callers updated; backward-compat: pass 0 for original behavior. - (c1a67e6)
• RenderInfo/renderWarning/renderExfilSecrets calls in the atkSecrets block - (54c02f9)
• Were writing to cmd.OutOrStdout() even when --json was set, contaminating - (54c02f9)
• The JSON output on stdout. Now uses cmd.ErrOrStderr() for progress messages - (54c02f9)
• When outputJSON is true, keeping stdout as clean JSON. - (54c02f9)

• Analysis (pkg/analyze) - (1a55605)

• • Add LOTP tool catalog (60+ tools) and 4 new detection rules: - (1a55605)
• LOTP_TOOL_EXEC, CACHE_KEY_INJECTION, OIDC_TOKEN_MR_RISK, TRIGGER_CHAIN_RISK - (1a55605)
• • Fix before_script/after_script blind spot: all injection/script rules - (1a55605)
• now use effectiveScripts() covering all three script phases - (1a55605)
• • Add WaitForJobCompletion() for polling pipeline job status - (1a55605)

• Attack payloads (pkg/attack/payloads) - (1a55605)

• • Add LOTP config-file payload generators: Phantom Gyp (binding.gyp + - (1a55605)
• index.js bypassing npm hook monitoring), npm postinstall, GNU Make - (1a55605)
• $(shell), pytest conftest.py, goreleaser before.hooks, Gradle exec, - (1a55605)
• Terraform null_resource local-exec - (1a55605)
• • Phantom Gyp technique: base64-encodes command in index.js to evade - (1a55605)
• string scanners; no preinstall/postinstall in package.json - (1a55605)

• Attack orchestration (pkg/attack, cmd/attack) - (1a55605)

• • Add LOTPAttack struct with InjectLOTPPayload() committing weaponized - (1a55605)
• config files to a branch - (1a55605)
• • New --lotp-inject mode with --lotp-tool flag - ([1a55605](https://github.com/mr-pmillz/gogatoz/c...

v0.5.0

Changelog

All notable changes to this project will be documented here

0.5.0 - 2026-06-03

✨ New features

• Add missing extra_files declaration - (af93e3a)
• Add changelog - (a8e787f)
• Added template removed from .gitignore - (6ea268e)

🐛 Bug fixes

• Fix Dockerfile.goreleaser - (9edd257)

🛠 Improvements

• Update readme - (dec19b8)
• Update docs - (8a986ac)
• Update release CI - (bba71c6)

⚙️ Miscellaneous

• Change unit test domain name to gitlab.local - (949aa69)
• Use token for git-cliff - (c30e5e4)
• Ignore linter warning for deprecated decryption method - (74ae95d)
• Ported self-hosted gitlab repo to github initial commit - (8f301bf)

v0.4.9

Changelog

All notable changes to this project will be documented here

0.4.9 - 2026-06-02

✨ New features

• Add missing extra_files declaration - (8fc0596)