v2.5.0

CodeInspectus 2.5 hardens the security areas that can be verified from repository state, moves the project to Apache License 2.0, and expands deterministic coverage without changing the six MCP tools or V2 export/storage schemas.

Security hardening

• Evaluates effective Supabase RLS policy composition, roles, commands, migration ordering, renames, schema moves, explicit disables, and bounded analysis omissions.
• Honors Supabase Edge Functions' default JWT verification and adds handler-scoped authentication/authorization analysis for explicit anonymous Edge handlers plus conventional Next.js and import-proven Express admin routes.
• Detects exact modern Supabase secret keys across client source, bundles, Flutter, redaction, and Gitleaks while suppressing publishable keys and preserving every distinct remediation location within explicit bounds.
• Adds narrow findings for explicitly unsafe Referrer-Policy and Permissions-Policy literals. Missing or dynamic headers remain unverified.
• Keeps SPF/DMARC outside the zero-egress repository scanner because authoritative DNS state is external and DMARC p=none is a valid monitoring mode.

Licensing and attribution

• Relicenses CodeInspectus from MIT to Apache-2.0 with NOTICE, DCO contribution terms, and corrected third-party attribution.
• Documents Opengrep, Gitleaks, Trivy, OSV data, and runtime dependency provenance. Security-engine binaries remain separately licensed downloads and are not bundled in the npm package.

Release inventory

• Detection database 1.19.0: 94 curated detections (72 native, 18 Opengrep, 4 Gitleaks).
• JavaScript/TypeScript pack 1.9.0: 12 analyzers and 29 rules.
• Python AI/API pack 1.5.0; Flutter pack 1.1.0; aggregate native engine 5.19.0.
• Package, server, CLI, SDK, and registry manifest are synchronized at 2.5.0. Existing V2 export/storage schemas remain 2.0.0.

See the full changelog and release process.