SecureCode Auditor 0.1.8

SecureCode Auditor 0.1.8 for Apple Silicon Macs.

If you installed 0.1.7, please replace it with this. That build reported its own version as 0.1.6, so it announces an update to itself and never stops offering one. Nothing else about it is wrong — the audit, the clean-up and the isolation all behave as described — but the version it tells you is not the version you have. The packaging script now refuses to build when the version in the code and the version in the project file disagree, which is how that got out.

After a clean-up, you can tell what is actually left

The day after cleaning a branch, the same serious finding comes back — from a commit behind the new tip — and nothing said so. It read as "the clean-up failed". It had not.

• A finding whose content is in no branch, tag or pull request's current files is now marked ONLY IN HISTORY on its own row, without opening it.
• Those rows sort below anything still live at the same severity, so what you can fix today is at the top.
• The list says the split plainly: "9 of 12 serious findings are only in the project's history, not in the current files."
• A filter shows only what is still in the current code — the question you actually have after a clean-up.

None of it is hidden by default, and none of it is called safe: the host keeps serving those objects, and every old copy still holds them, until the history is rebuilt and purged. Severity still comes first, because malware left in history is still malware.

A large folder is no longer refused

A 4.4 GB checkout used to be turned away: code is only ever read inside a sealed container, and that container's input lives in memory, which caps one pass at 1.8 GB.

Such a folder is now read in several sealed containers, one after another, and the results are added up. The isolation is unchanged — same filter, same arguments, same checks, no network, nothing read on your computer. The progress card says "part 2 of 3" so a long audit does not look stuck, and the coverage panel reports how many containers were used.

Checked against an audit of the same folder in one pass: the same files, the same findings, the same verdict. A single file too large to seal even on its own is reported as not inspected rather than quietly skipped.

Install: download SecureCode-Auditor-0.1.8-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — signed, not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 2e991e97938f41faeaaf48b91f14af02ea9f9ac7624e4daef1ee74f851cf9e65

SecureCode Auditor 0.1.7

Superseded by 0.1.8. This build reports its own version as 0.1.6, so it announces an update to itself and keeps offering one. Everything else in it behaves as described below. Please install 0.1.8 instead.

SecureCode Auditor 0.1.7 for Apple Silicon Macs. A clean branch is not a clean project — the app now says what is left to do.

Three rules also stopped judging code by what it is called.

After the push, the part no tool can do for you

Cleaning a branch on the server is the middle of the job, not the end. The app now says so in plain words, on the screen, as soon as the push has gone through:

• Every existing copy has to be deleted and cloned again. A pull does not fix one. It still holds the old commits, and pushing from it puts the malware back. The two commands are there to copy.
• Which other branches or tags still carry something. One clean-up covers one branch — the lease, the safety checks and the commit you approve are all about that one branch, and that is worth keeping. The next infected branch is now one tap, planned from the same audit. Decisions you made about the finished branch are cleared, because they were never made about this one.
• Which pull requests still hold it, and that only GitHub Support can clear those.
• That tokens and keys the infected code could read have to be changed.

The purge message now names everything

The message for GitHub Support used to name the branch tip and nothing else. On a real incident Support cleared that one commit and kept serving the three infected ones behind it. A scoped clean-up knows exactly which commits it replaced, and every one of those ids is now in the message. Pull-request refs are asked for by name too, with the reason they cannot be rewritten locally.

Fewer wrong calls on ordinary code

Measured on full-history audits of flask and vite — both clean, nothing malicious found in either, before or after:

• A test reading back what it just sent is test code. testsuite/, __tests__/, *.spec.* and conftest.py were not recognised as test locations, so 65 matches in a single flask test file were rated as a framework deserialising untrusted input.
• A createRequire shim declared at the top of a file and used three hundred lines down is in use. The check only looked within sight of the shim, which flagged 379 matches across four of vite's own source files. The two cases genuinely worth a look still stand: a shim passed into new Function, and one whose only use loads Node's module internals.
• A remote script tag now says which weakness it found — loaded over plain http, so it can be replaced in transit; or an unpinned path, so the CDN decides later what runs. Both stay serious: an unpinned path is a real technique, not noise. polyfill.io is deliberately not on the known-CDN list, because that is a host that was trusted until it was sold.

Every relaxation has an attack twin in the test corpus — malware in a test directory, a pinned library served over http, a leftover shim, a shim that loads child_process — and the guard that fails loudly if malware could ever be reclassified as harmless stays green. It refused a wider relaxation during this work, and was right to.

Install: download SecureCode-Auditor-0.1.7-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — signed, not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 de8b7978ae854c87571b88827974862f15c5cda175311aa5e0958851c90532f8

SecureCode Auditor 0.1.6

SecureCode Auditor 0.1.6 for Apple Silicon Macs. Cleaning a repository no longer costs you its history.

Until now there was one way to clean an infected branch: replace it with a single clean commit. That removes the malware and everything else with it — every message, every author, every date, the whole record of how the project got there.

The clean-up is now scoped by default. Only the commits that actually carry the malware are rebuilt, with the infected file restored or removed. Every other commit keeps its author, its dates and its message exactly. Commits before the first infection keep their original ids; later ones change id only because an ancestor did, which Git cannot avoid.

It proves this rather than promising it. Before a push is offered, five checks run against the original branch:

• every commit is still there
• author, dates and message unchanged on every commit
• no malicious object is reachable from the rebuilt branch
• each rewritten commit changed only the files you decided about
• how much history was kept, stated plainly ("101 of 128 commits keep their id; 1 carried the malware and was rebuilt")

The old behaviour is still available as a deliberate choice — Replace the branch with one clean commit — for when the history itself cannot be trusted. The screen says what each option costs before you pick one, and changing your mind discards any plan built for the other.

Still true of both: ids change from the infection point onward, so everyone with a copy must re-clone, and pull-request refs can only be cleared by GitHub Support.

Install: download SecureCode-Auditor-0.1.6-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — signed, not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 3e94a931402ed9495c91eec31ae195ea6b1b738fe958ffde101ad8f6a4f62d1a

SecureCode Auditor 0.1.5

SecureCode Auditor 0.1.5 for Apple Silicon Macs. One fix, and it matters.

A repository that defends itself against this malware is no longer called infected.

The loader-marker rule matched the marker global['!'] wherever it appeared — including inside a GitHub Actions workflow whose whole job is to grep for that marker, and inside an incident report describing it. One line of a defensive workflow was enough to turn an entirely clean repository into "Malicious code confirmed".

The rule now requires the marker to be used — assigned to, called, indexed or read as a property — which is what the real loader does (global['!']='9-5889-1';). Naming it is not carrying it.

Detection is unchanged: the marker is still caught when it is assigned with any spacing or escaping, when it is called, and when it appears inside a workflow as code that actually runs. Six cases were added to the test corpus to keep both halves true.

If you audited a repository with 0.1.4 and were told malware was confirmed in a security workflow or a security document, audit it again with this version.

Install: download SecureCode-Auditor-0.1.5-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — the app is signed but not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 edeca18d85dc068faac6b298761861298ff666ece0d49d8c637468f7c3d0186c

SecureCode Auditor 0.1.4

SecureCode Auditor 0.1.4 for Apple Silicon Macs. Four small things that make it quicker to start, and quicker to get unstuck.

• Drag a project onto the window. A folder becomes a folder audit, a ZIP becomes a ZIP audit, and anything else says so instead of doing nothing. Only the path is taken; the audit still reads everything inside the sealed container.
• Audit something again in one tap. The last few projects you audited are offered above the choices, named the way you would say them.
• Errors that offer the fix. A container app that is not running gets a Start it button; a scanner that has not been built gets Set up the scanner; a refused or oversized folder gets Choose a folder; a private repository points at the token. The scanner's own message is still shown underneath.
• A clean result reads like one — what was actually read (files, past versions, branches, pull requests), and a plain line that nothing matching was found, which is not the same as the code being proven safe.

Install: download SecureCode-Auditor-0.1.4-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — the app is signed but not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 53d4f549c04944b003fdce2b6ca6ed5b400a8c97691c9c4077362af8f4193e59

SecureCode Auditor 0.1.3

SecureCode Auditor 0.1.3 for Apple Silicon Macs.

Clean-up is now a walk-through. It used to be one screen with every control on it, which asked you to understand the whole procedure before the first click. Now it is one decision per step, with a row of steps along the top showing where you are.

• Cleaning a copy on your Mac is three steps: look, see exactly what would be deleted, done. The first step only looks — nothing changes until the step that says it will.
• Rebuilding a repository is five: check who can push (skippable), say who is making the change, decide any files the app will not guess about, read and approve the exact change, then ask GitHub to purge the old history.
• Finishing a step carries you to the next one; Back always works; and a step whose own answer is what you were waiting for — the GitHub check — keeps you there to read it.

Everything the clean-up could do before, it still does, with the same approvals and the same safety checks.

Install: download SecureCode-Auditor-0.1.3-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — the app is signed but not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 872043a85b90c688cfa9db4f2bea9bdf52dce97798298a7d05faf95717244a96

SecureCode Auditor 0.1.2

SecureCode Auditor 0.1.2 for Apple Silicon Macs. This one is about making the app easier to use.

New

• Try a sample project — one button on the start screen audits a small demonstration project, for real, in the sealed scanner. No repository of your own needed to see what an audit looks like. It is clearly marked as a demonstration, and contains no real malware.
• The verdict now tells you what to do — "Clean this up", "Save a report" and "Audit again" sit right under it, instead of behind Technical details.
• Findings in plain words — every finding is titled in ordinary English ("A file has hidden code pushed far off-screen"), with the rule name kept beside it for searching.
• Stop — a long audit can be stopped. The sealed container is ended, and nothing is left running.
• Recent audits — the last 20 results are kept on your Mac, so closing the window no longer loses them. Each can be reopened or deleted, all can be deleted at once, and Settings can switch the keeping off entirely (which deletes the saved ones too). They never leave your computer.
• A notification when a long audit finishes while the app is in the background. It carries the verdict only — no repository, path, file name or finding.

Unchanged: what the scanner finds, and how it reads code — only inside a sealed container, with nothing from your project ever run on your Mac.

Install: download SecureCode-Auditor-0.1.2-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — the app is signed but not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 d491a5c0a690d5ef32dbe284b50b6af2d1eb074111b68af1cbedb30b2f0ef893

SecureCode Auditor 0.1.1

SecureCode Auditor 0.1.1 for Apple Silicon Macs. It replaces 0.1.0, which has been withdrawn — if you installed 0.1.0, please install this version over it.

What changed

• The scanner engine now ships as compiled native code, and the sealed scanner's copy is built into its container image. Audit results are identical to 0.1.0.
• If an update brings a new scanner, the app replaces the sealed scanner image by itself, offline.

What it does

• Audits a folder, a ZIP or a repository online — every branch, tag, pull request and past version.
• Reads code only inside a sealed container: no network, read-only, no permissions. Nothing runs on your Mac.
• Plain-language verdict with what to do; the technical detail is one click away.
• Clean-up built in: removes leftovers from a local copy (backing up your own work first) and can rebuild a repository's history as one clean commit, with GitHub checks and the message for GitHub Support.
• Signed known-malware fingerprint updates, checked daily; offline first-run setup.

Install: download SecureCode-Auditor-0.1.1-apple-silicon.dmg, drag the app to Applications, and follow How to open (one-time "Open Anyway" in Privacy & Security — the app is signed but not yet notarised).

Needs: Apple Silicon (M1 or later), macOS 13+, and Docker Desktop, OrbStack, Colima or Podman.

SHA-256 176e6ae3f2872f625a918c8c84fd299ea4f85fdfb655a9fa6c6f8805bf408d1d