Skip to content

v1.7.9

Choose a tag to compare

View all tags
@haggaiwambua haggaiwambua released this 06 May 16:06
Immutable release. Only release title and notes can be modified.
v1.7.9
6c36823
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • HSTSHeaderAnalyzer no longer false-negatives when a middleware file contains a comment referencing HSTS (e.g. // HSTS configuration) without actually setting the header — only the presence of Strict-Transport-Security in file content is treated as evidence the header is set; previously any mention of the string HSTS suppressed the missing-header finding.(#187)
  • HSTSHeaderAnalyzer no longer false-negatives when a security package such as bepsvpt/secure-headers appears only in require-dev — composer.json is now decoded and only the require section is checked; a dev-only package provides no HSTS protection in production.(#187)
Assets 3
Loading