Three themes: new data-exfiltration rule, FP reduction tuned against real OSS repos, and recall improvements driven by 9 new real-CVE fixtures.
New: data-exfiltration rule
- Separate from SSRF. Fires when sensitive sources (cookie, header, env, file, db, caught exception) reach outbound HTTP body / headers / json across all 10 languages.
- Plain user-input echoed upstream is suppressed at emission.
- Sinks: fetch, XHR.send, requests.post, HttpClient.send, OkHttp, RestTemplate, WebClient, http.Post, reqwest/ureq/surf/hyper, Net::HTTP.post, RestClient, libcurl POSTFIELDS.
- Three suppression knobs: sanitizer convention, trusted-destination allowlist, detector toggle.
False-positive reductions (validated against real OSS repos)
- C++ reinterpret_cast: suppress on byte-pointer / void* / uintptr_t / sockaddr targets. ~70% over-fire reduction on serialization, IPC, socket code.
- PHP md5/sha1: suppress in non-crypto contexts (cache keys, ETags, dedup IDs). Tuned against phpmyadmin and nextcloud.
- Path traversal: canonicalize-and-rooted shapes (File.expand_path + start_with?, os.path.realpath + startswith, path.resolve + startsWith) clear FILE_IO. Branch-narrowing flips lock under negation.
- Go field-LHS resource acquires (b.cpuprof = os.Create(...)) treated as ownership transfer to enclosing struct. Production trigger: prometheus tsdb profiler.
- Rust missing_ownership_check: caller-scope-entity exemption for organization/project/team/workspace/tenant; non-web Rust crates gated by Cargo.toml + per-file framework import probe; Flask test-decorator denylist (mock.patch). Reduced FP flood
across Sentry / Saleor / Discourse / Mastodon / zed-shaped repos. - JS/TS empty-string fallback secret no longer fires on
process.env.X || "".
Recall (9 new real-CVE fixtures, 21 → 29 total)
- CVE-2023-22621 (Strapi / lodash _.template SSTI → RCE)
- CVE-2026-25544 (Payload CMS Drizzle SQLi via helper-validator)
- CVE-2021-21288 (CarrierWave SSRF via OpenURI.open_uri)
- CVE-2023-38337 (rswag path traversal)
- CVE-2022-1471 (SnakeYAML deserialization)
- CVE-2022-42889 (Apache Commons Text RCE)
- and 3 more.
- Cross-function helper-validation propagation (validated_params_to_return) recognizes regex-allowlist guards on params reaching return value.
- Ruby OpenURI.open_uri + chained-call wrapper classification.
- Lodash _.template gated CODE_EXEC sink.
Other
- Action download warning bumped to v0.6.0.
Full changelog: CHANGELOG.md