Skip to content

Secure Engine 0.1.7

Choose a tag to compare

View all tags
@danielcadev danielcadev released this 19 Jul 18:27
v0.1.7
This tag was signed with the committer’s verified signature.
danielcadev Daniel Castrillon
SSH Key Fingerprint: dFNF3ps9kjbwqLKysQOi5q/SlnGq3phEQ5Js0TH0QGk
Verified
Learn about vigilant mode.
1e3d300
This commit was signed with the committer’s verified signature.
danielcadev Daniel Castrillon
SSH Key Fingerprint: dFNF3ps9kjbwqLKysQOi5q/SlnGq3phEQ5Js0TH0QGk
Verified
Learn about vigilant mode.

Secure Engine 0.1.7 completes the Phase 6.11 generalization work and keeps the existing public report, schema, taxonomy, SARIF, rule-ID, baseline, history, suppression, privacy, cancellation, and disabled-by-default AI contracts stable.

Highlights:

  • bounded local convergence independent of configured call depth;
  • authorization bound to the same protected resource;
  • structural resolution of a final unshadowed dynamic sequence-expression callee;
  • composed filesystem path identity with separator-aware confinement;
  • exact-origin proof for constructed redirects over the same URL value;
  • outbound property and destructuring connectivity through supported helpers and imports; and
  • private parse cache v10, with older cache envelopes producing safe misses.

Verification

  • Candidate commit: 1e3d300cb7092097f21be164b6c403b71f2b2520
  • Candidate tree: 8f08ac800a43afcd39eb70cecd29c8643a24157b
  • GitHub Actions CI: formatting, strict Clippy, tests, RustSec, and cargo-deny passed.
  • Two clean Fedora 44 x86_64 package builds produced byte-identical RPMs.
  • RPM SHA-256: 8f26b69981c7ba88081496b0c1dd1fce9da62c03a38927e07b3d64541cf45f75

Post-freeze holdout evidence

After the release candidate was frozen, it was evaluated once on a new 56-pair/112-case holdout in its native lane. The certified result was TP 23, FP 9, TN 47, FN 33: precision 0.718750, recall 0.410714, F1 0.522727, specificity 0.839286, and balanced accuracy 0.625000.

The evaluation required a post-open recovery of one preserved raw observation and a later evidence-only certification of the CLI's documented exit-status semantics. Across the complete study, every scanner/case combination was executed at most once and no scanner was retried.

Native and capability-normalized lanes remain methodologically separate. These results do not support a direct ranking or superiority claim against other scanners, nor claims of complete coverage or production readiness.

Known limits

Computed dispatch, computed or dynamic properties, reflection, ambiguous calls/imports, unresolved callbacks, and unproven runtime filesystem behavior remain conservative limitations.

Assets 4
Loading