Skip to content

Observer v0.3.0 — redesigned report, credible scoring, whole-stack coverage

Choose a tag to compare

View all tags
@sanks205 sanks205 released this 13 Jul 19:42
· 25 commits to main since this release
v0.3.0
c948a48
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Observer v0.3.0 — release notes

Paste into the GitHub release (Releases → Draft new release → tag v0.3.0).

Observer v0.3.0 — redesigned report, credible scoring, whole-stack coverage

Finds what's wrong — and shows you the fix. This release is a big one: a fully
redesigned report that stays readable on huge codebases, standards-aligned scoring you can
trust, and coverage that now spans your code, dependencies, config, and infrastructure.

✨ Highlights

  • Redesigned report — readable at any scale. Findings are now grouped by rule, so a
    project with thousands of findings collapses into a few dozen scannable groups instead of an
    endless wall (a real 6,600-finding app renders as ~13 groups in a 260 KB page). New
    "Fix These First" section surfaces the top issues, filters show per-severity counts,
    and the whole thing prints cleanly to PDF.
  • Standards-aligned Security Rating (A–E). Alongside the 0–100 scores, there's now a
    Security Rating based on the worst severity present (E = Critical … A = none) — the same
    model tools like SonarQube use, grounded in CVSS/CWE/OWASP. A short "How scoring works" note
    makes the methodology transparent.
  • Infrastructure & config scanning. Observer now inspects Dockerfiles, docker-compose,
    Kubernetes manifests, .env files, and nginx/Apache configs     for high-signal
    misconfigurations (running as root, :latest, exposed DB ports, committed secrets, directory
    listing, obsolete TLS, and more) — all in the same offline pass.
  • ESLint auto-detection (JS/TS). Completes the "bring your own engine" set — Observer now
    auto-detects Semgrep, PHPStan, Bandit, gosec, and ESLint if present and folds their findings in.
  • Lower noise. Two over-eager heuristics were right-sized so ratings reflect real risk
    rather than volume — without hiding anything.

🔒 Still true

Single self-contained binary. Fully offline (--assert-offline enforces it). No account, no
telemetry. Multi-language native rules (PHP, JS/TS, Python, Java, Ruby). Dependency CVEs via
OSV.dev. Every finding carries a before→after fix.

📦 Install

Download the binary for your OS below and run it — or use a package manager:

# Windows (Scoop)
scoop install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/scoop/observer.json
# macOS / Linux (Homebrew)
brew install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/homebrew/observer.rb
OS File
Windows x64 / ARM observer_windows_amd64.exe / observer_windows_arm64.exe
macOS Apple / Intel observer_darwin_arm64 / observer_darwin_amd64
Linux x64 / ARM observer_linux_amd64 / observer_linux_arm64

Binaries are unsigned — verify against SHA256SUMS.txt. Free & MIT. Optional one-time
Observer Pro add-ons (branded PDF, scheduled scans, premium framework rules for Laravel /
CodeIgniter / WordPress / Symfony / Django / Rails / Spring / Express).

Feedback welcome — especially on false positives and which rules/languages to add next.

Assets 9
Loading