ai-security-scanner 0.1.7

ai-security-scanner 0.1.7

Source: 2e25a8fab7a5663d7143c6ba5a2cdaa139688dca

Hands-on Windows testing pre-release. This build carries the Candidate 11 product
repairs produced by operating the real app end to end, then extends those repairs across
the shared scan lifecycle.

First launch recognizes prerequisites that are already available and prepares the private
scan tools before presenting a scan as ready. A scan starts from the action the user chose,
and startup listeners are attached early enough to preserve fast progress and failure events.

Public and internal network checks accept an IP address or domain. Domain resolution is
frozen into the exact run, and the guided common-port inventory remains bounded. If a check
stops, the app preserves saved evidence, shows a useful next step, and offers a redacted
technical log without targets, paths, secrets, or raw scanner messages.

When trusted ignore-rule evaluation is unavailable, files are retained rather than silently omitted.
Windows runtime recovery also treats initialization
proof as one-shot state; a stale journal is never permission to delete WSL state.

AI app and agent checks reuse the existing code, secret, package, and deployment routes.
Applicable findings can carry AIDEFEND references beside NIST CSF and ISO 27001 references.
The managed Gitleaks path remains network-disabled and fully redacts detected secret values.

Existing local cases, cleanup obligations, evidence snapshots, and provenance remain intact.

These desktop installers are built for Linux x86-64, universal macOS (Intel + Apple silicon),
and Windows x86-64. Verify the selected file against SHA256SUMS.txt and the public GitHub
artifact attestation before installing.

Fresh GitHub-hosted qualification jobs independently installed the Debian package, macOS DMG,
Windows MSI, and Windows NSIS Setup executable. Linux and both Windows installers completed
managed-runtime install, start, status, fixed no-upstream managed egress gateway readiness,
network-disabled Gitleaks container execution, stop, uninstall with image-cache purge, and
private-state cleanup. The universal macOS artifact's DMG installation, bundled layout, exact
runtime manifest, CLI, desktop startup, and cleanup passed on GitHub's Intel macos-15-intel
runner. Its managed-runtime, egress gateway, and container lifecycle is explicitly recorded as not observed
because GitHub-hosted macOS does not support the nested virtualization required by AppleHV.
This limited macOS evidence is accepted only for a pre-release. Exact evidence is published
per installer.

The current installers are not signed with Apple Developer ID or Windows Authenticode and
are not Apple-notarized. Application update payloads are separately signed with the updater
key, but the operating system may still show an unidentified-developer warning. No scanner
engine image is bundled.

The first-party ai-security-scanner-egress-gateway, isolated
ai-security-scanner-bootstrap-broker, and local ai-security-scanner-cli companion
executables are installed beside the desktop executable.
Platform copies and hashes are included as release evidence and SBOM entries.

CycloneDX and SPDX JSON SBOMs, generated third-party notices, engine reference notices, and
machine-readable release metadata accompany the installers.

Known Linux pre-release dependency risk

The Linux desktop bundle includes glib 0.18.5 transitively through Tauri’s GTK3/WebKitGTK stack. This version is covered by RUSTSEC-2024-0429, an unsoundness in VariantStrIter. Static review found no product or downloaded production-dependency call to the affected iterator API; the Windows and macOS dependency trees do not contain this crate. The Dependabot alert remains open and this risk is not presented as fixed. A reviewed backport or upstream stack migration remains follow-up work.