v0.11.15

NanoMind Semantic Compiler

HackMyAgent is now powered by the NanoMind Semantic Compiler -- a compiler-style architecture where NanoMind understands artifacts semantically and ALL scanners query the Abstract Security Tree instead of raw text.

What's New

• 28 AST-based security checks across 6 analyzers (capability, credential, governance, scope, prompt, code)
• Self-securing CLI: verifies its own binary integrity on every startup. QUARANTINE mode on tamper detection.
• Defense-in-depth: NanoMind can upgrade findings but NEVER suppress static analysis results
• Input sanitization: defends NanoMind itself against prompt injection via malicious artifacts
• Tamper-evident event chain: rolling SHA-256 hashes detect log modification
• AST signing: every compiled artifact is cryptographically signed
• Secret redaction: credentials stripped before NanoMind processes content

Architecture

Artifact → Secure Ingestion → NanoMind Compiler → Signed AST → Analyzers → Findings
                                                                    ↑
                                                    Static checks run alongside (defense-in-depth)

Self-Securing

A security tool that can be silently compromised is worse than no tool. HackMyAgent verifies itself:

• Binary hash verification against signed manifest
• Model integrity check before loading
• QUARANTINE mode: tampered binary refuses to run (exit code 3)
• DEGRADE mode: tampered model falls back to baseline

1,285 tests passing.