Skip to content

v0.5.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Aug 15:33
· 70 commits to main since this release
v0.5.4
This tag was signed with the committer’s verified signature.
parousia8888 Yuxuan Shi
SSH Key Fingerprint: DmZYVL1dLhUmgaJnfZKpZIexgzMv5jk9+YCoBT3zRIg
Verified
Learn about vigilant mode.
d9ee538

v0.5.4 release evidence

Status: published. The signed tag, GitHub Release, npm package with provenance, verified installer
trust entry and signed v1 promotion are publicly verifiable.

Outcome

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

v0.5.4 expands the bounded automatic first pass. Five built-in rules cover exact Git tracking of
sensitive .env names, JavaScript session-secret/cookie settings and Python session-cookie/CSRF
settings. Eight project-owned Opengrep rules add same-file request-to-SQL, outbound-URL, file-path
and redirect flows across JavaScript/TypeScript and Python. --profile deep selects the built-in
detector plus the four existing external adapters without downloading them.

The release retains the corrected evidence claim: the self-authored planted suite is named
rule-contract conformance and reports literal positive/negative/state contract results. A separate
historical real-world regression corpus executes four minimized correctness failures and one
review-visible expected benign DOM-sink match against product code.

The main-branch try-now command follows npm latest. Reusable CI, signed release verification and the
trusted installer remain pinned to an immutable version or source commit.

Evidence sets

Neither evidence set is a representative production-vulnerability benchmark. Stable detector reach
is 25 built-in risk rules, 2 evidence-integrity rules and 16 opt-in external-adapter rules: 43 total.
Opengrep matches remain same-file suspected leads. A missing deep-profile prerequisite is explicit
unknown evidence and exit 3, never a clean result.

Published verification

The local release gates include:

npm run conformance:rules
npm run regressions:real-world
npm run check
/usr/local/bin/python3 /Users/kenn/.codex/skills/.system/skill-creator/scripts/quick_validate.py .

The release procedure additionally verifies the signed tag after it exists:

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.5.4

Public release facts

  • The SSH-signed v0.5.4 tag peels to source commit
    d9ee538089ac813dcd454d10b45f14b958c1ec19. Candidate CI run
    32648619071
    and CodeQL run
    32648619088
    passed before publication.
  • GitHub Release workflow
    32648846862
    published the source archive, SPDX 2.3 SBOM, manifest and checksums on 2026-08-23. The public
    asset SHA-256 values are 00742dfe4d0118e8361380314c4fe01ed4e3924db1015d080b882bd3841431a5
    (archive), cfa209b59004ce29bbf808eadc37b1fbb8bfd8eb162e462c29661e8d18a592e1
    (SBOM), f50d8b974666694ccaebdb583127cc62471536943b028f7057919cf47b4529c1
    (manifest) and cbd7d771f81cee065989dc386fef239fc65d2d0966b1ca23fb5c8b9f94bdce12
    (SHA256SUMS).
  • npm workflow
    32650181341
    published web-app-security-skill@0.5.4 at 2026-08-23T15:58:01.250Z through the configured
    GitHub OIDC trusted publisher. npm records shasum
    1fb71399684025257e069a63b46eb058cca590d1, integrity
    sha512-N9UlD9l05Mmm1El7VFf1CGR6nSSG8msea+JjwlN/uwv7rV8gUbGp3DZlEKO8yFMWw+uqLFyYYBocCD8PTRPUdA==
    and SLSA provenance.
    A fresh public tarball contained 140 files and matched the signed tag package payload file by file.
  • The signed movable v1 tag object is
    464ba64a4d256dbf3b26f78101730b24a4337bc4 and peels to the same immutable source commit.
    Public consumer run
    32650353548
    passed both the passive path and expected authorization rejection.

Artifact identity, signatures and provenance establish origin and byte identity. They do not prove
that every detector conclusion is correct or that a scanned project is secure.

Assets 6
Loading