Skip to content

v4.1.0 - Security Analysis Mode for cr-agent

Choose a tag to compare

View all tags
@sinewaveai sinewaveai released this 25 Mar 10:45
v4.1.0
53a5810

What's New

Security Analysis Mode for cr-agent (--mode security)

  • Dedicated security-focused LLM prompts with sink localization instructions
  • Post-filtering drops non-security findings unless they have CWE/OWASP mapping
  • Carrier/sink deduplication using heuristic scoring (file path, language signals, CWE)
  • Tiered guard recognition (strong/medium/weak) to reduce false positives on guarded code
  • Cross-file security context summaries for better LLM analysis

Usage

# Security-only mode — focused on exploitable vulnerabilities
npx cr-agent analyze ./path/to/project --mode security

# Shorthand
npx cr-agent analyze ./path/to/project --security-only

# SARIF output for CI (recommended with security mode)
npx cr-agent analyze ./path/to/project --format sarif --mode security

Bug Fixes

  • Fix crossFileDedup collapsing independent findings
  • Fix Math.random() map key collision risk
  • Fix duplicate extractImports logic
  • Fix double IO in context assembler
  • Fix mode validation and fallback behavior
  • Fix missing claude CLI flags (- stdin marker, --no-session-persistence)

Tests

  • 119 code-review-agent tests (30 new for postprocess, 11 for security-summary)
  • 1404 total tests passing

Full Changelog: v4.0.1...v4.1.0

Assets 2
Loading