Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Aug 19:15
· 59 commits to main since this release
v0.6.0
This tag was signed with the committer’s verified signature.
parousia8888 Yuxuan Shi
SSH Key Fingerprint: DmZYVL1dLhUmgaJnfZKpZIexgzMv5jk9+YCoBT3zRIg
Verified
Learn about vigilant mode.
7521e06

v0.6.0 release evidence

Status: published and promoted. The signed tag, GitHub Release, npm package/provenance, immutable
verified-installer/bootstrap chain, immutable Action consumer and signed v1 consumer are publicly
retrievable and verified.

Outcome

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

v0.6.0 adds a framework-aware route-security review beside the existing finding report. It extracts
bounded Express, NestJS and Next.js App Router syntax into separate JSON and Markdown artifacts,
maps supported authentication and route-authorization signals, keeps object authorization distinct,
and orders human review work without turning review priority into vulnerability severity.

The release does not infer that a missing visible control is a confirmed vulnerability. Custom or
unresolved controls remain review candidates, and the direct Prisma object-authorization lead stays
experimental because the bounded ordinary-project review produced no ordinary-project matches.

Evidence sets

  • v0.6.0 route review: 57 manually reviewed routes at three
    immutable public commits, with 51 detected routes and six explicit misses.
  • v0.6.0 route regressions: six minimized
    route-extraction and classification failures retained as deterministic regressions.
  • v0.6.0 rule-contract conformance: 25
    built-in risk and three evidence-integrity planted positive/negative/state contracts.
  • Known limitations: exact supported syntax, parser, incremental,
    evidence-state and object-authorization boundaries.

The route review is purposive source-only evidence, and the planted suite is author-maintained rule
contract evidence. Neither is a representative production-vulnerability benchmark or a claim of
whole-program data flow, reachability, exploitability, precision, recall, DAST or project safety.

Published verification

The bounded local gate included:

npm run check
/usr/local/bin/python3 /Users/kenn/.codex/skills/.system/skill-creator/scripts/quick_validate.py .
npm pack --dry-run --json
git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.6.0

Package and verified-Skill clean-room runs produced equivalent route artifacts on the same owned
fixture before publication.

Public release facts

  • The SSH-signed v0.6.0 tag peels to source commit
    7521e0699eefe26d23a7972fbee6fb37b46fdfe2. Candidate CI run
    32660512207
    and CodeQL run
    32660512188
    passed before publication.
  • GitHub Release workflow
    32660619413
    published the reproducible source archive, SPDX 2.3 SBOM, manifest and checksums on 2026-08-23.
    Public SHA-256 values are 65da7ce8f88f7ece030e671973235e1ae3c318c2b49cb8d1f53382714191a26c
    (archive), 092fa41f2af42a3da5cdb88769c0d101fb659e3eb080de61351630594ad57a9b
    (SBOM), 0e89c158688e3211eb02fb9fa54c7d7f452300f30b5906c4fe44f7d46e4a2140
    (manifest) and 40daac6af415136e37e28aa15724bdfb8dd3fc3050691c3a66dbeba7b2e2093d
    (SHA256SUMS). Fresh downloads passed checksums and GitHub attestation verification.
  • npm workflow
    32660739200
    published web-app-security-skill@0.6.0 at 2026-08-23T19:17:13.071Z through GitHub OIDC
    trusted publishing. npm records shasum 6d83dba33b0d1349873e9b77ffd73da6f88b7396, integrity
    sha512-oe0uooh3BWRiHAsmUk9/JIJoFac7pK/2Ey4SEalos2a7Q1JGBoiDfj8FujlveMkXdBxrF4MpwflqlRwaLkiSJg==
    and SLSA provenance.
    The fresh registry tarball is byte-identical to a package built at the signed source commit.
  • Published-state commit a9afb943298d70f1d5a2d8005a4d0a928acb3de8 contains the v0.6.0
    verifier trust entry; scripts/install-verified.mjs at that commit has SHA-256
    1bcc929e7b939c6f5b300d91b928467be4ad809856611bfb53c96e1c39f60e5c. Bootstrap commit
    3fa12244dfb70e0588ccf0e645bf5c75b6148b01 pins that verifier and has bootstrap SHA-256
    22df4c865d01f51b64066c8e53beaa9bb3cb3c29ef431c6b8a3aa56074dab65c.
  • Final pinning CI run
    32661555145
    passed all four Node 22/24 by Ubuntu/macOS jobs; CodeQL run
    32661555143
    passed. Immutable Action run
    32661706137
    reproduced one owned GET /api/orders/[id] route with authentication and authorization both
    not_observed, priority review_next, and no confirmed vulnerability created from those states.
  • A fresh exact-version npx run and a fresh public-bootstrap CLI install both returned v0.6.0 and
    produced the same route semantics and parser identity: @babel/parser 7.28.4 with bundle SHA-256
    f8d700c78a6d0a50513a672b419074a87597093733d2d69ecee92675d8139698. The isolated installer
    explicitly reported that GitHub attestation verification did not run because gh was not
    authenticated there; fixed checksums, manifest, SBOM, tag and source identity still verified,
    while public release attestations had already been verified separately.
  • Signed movable tag v1 has tag object 1ec4442b72a8d36ba9765d88f7d63108e91d6d02
    and peels to the immutable v0.6.0 source commit
    7521e0699eefe26d23a7972fbee6fb37b46fdfe2. Public consumer run
    32661836371
    passed the passive-crawl, authorization-rejection and immutable route jobs after promotion.

Artifact identity, provenance and passing consumers do not prove every detector conclusion correct
or an audited project secure. v1 is intentionally movable; use the full source commit when a
workflow must remain immutable.

Assets 6
Loading