GrantTrace v2.5.3

GrantTrace v2.5.3

This release focuses on release consistency, security hardening, and distribution improvements.

Security improvements

• Improved authorization judgment handling
• Improved read-only request safety checks
• Improved path safety validation

Engineering improvements

• Updated release metadata and documentation
• Updated Windows portable package workflow
• Improved release verification records
• Added v2.5.3 publishing support

Validation

• 634 tests passed
• 1176 sub-tests passed
• Branch-aware coverage: 86.49%
• Windows portable package verified
• Package build and installation checks completed

GrantTrace v2.5.2

GrantTrace v2.5.2

v2.5.2 is a documentation and distribution metadata maintenance release.

Maintenance

• Refresh the PyPI project description with the current README.
• Align package/runtime versions and Windows portable filenames at 2.5.2.
• Keep the corrected Windows download instructions, SmartScreen notice, macOS/Linux installation guidance, and workflow overview.
• No changes to BOLA / IDOR / Mass Assignment detection, the security model, default read-only behavior, or CLI semantics.

Windows portable

Windows 10 / 11 64-bit users can download:

GrantTrace-v2.5.2-Windows-x64.zip

Extract the ZIP completely, then double-click Start-Demo.bat.

No Python installation is required.

Verify the download with SHA256SUMS.txt.

GrantTrace v2.5.1

GrantTrace v2.5.1

v2.5.1 is a maintenance release focused on validation correctness, recovery safety, and release hardening.

Fixed

• Reject unsafe Merge Patch probes before writes when the original state cannot be restored exactly.
• Preserve array record associations during BOLA comparison to avoid overstating confirmed authorization bypasses.
• Harden report target and metadata redaction for known credentials.
• Prevent report outputs from overwriting specification, configuration, or loaded local $ref inputs.
• Improve local and conditional schema resolution and configuration-to-spec operation validation.
• Preserve legacy v2.5.0 scalar parameter configurations while applying strict schema-aware validation.
• Preserve Swagger 2.0 uniqueItems constraints so duplicate configured arrays are rejected before any request is sent.

Verification

• 560 tests passed
• Python 3.9 / 3.12 / 3.14 CI passed
• Mypy passed
• Ruff passed
• Runtime dependency audit passed
• CodeQL passed
• Branch-aware coverage: ~85.27%

Safety

GrantTrace remains read-only by default. Active PATCH testing still requires explicit opt-in and rollback verification.

Windows portable

Windows 10 / 11 64-bit users can download GrantTrace-v2.5.1-Windows-x64.zip.

No Python installation is required. Extract the ZIP completely, then double-click Start-Demo.bat to run the built-in demo and open the HTML report.

Verify the download with SHA256SUMS.txt.

Full Changelog: v2.5.0...v2.5.1

GrantTrace v2.5.0

Highlights

• Export SARIF 2.1.0 alongside HTML and JSON reports with --export-sarif. Only CONFIRMED BOLA / IDOR and Mass Assignment findings become SARIF results (GT-BOLA-001 / CWE-639 and GT-MASS-001 / CWE-915).
• Use a workspace-local OpenAPI specification as a safe relative artifact location for GitHub Code Scanning. No source lines are invented; workspace-external specs never expose absolute local paths.
• Copy safe cURL reproduction templates from confirmed HTML findings, using the tested URL and confirmed payload where safe, Visitor credential placeholders, POSIX quoting and offline clipboard fallback.
• Follow clearer configuration onboarding: generate and review a draft, validate it, inspect an offline dry-run, then start with a read-only scan. Configuration formats remain unchanged.

Safety

• Scans of users' APIs remain read-only by default. Active PATCH testing requires explicit --allow-write-tests opt-in and an explicit write allowlist.
• Independent GET readback, original-state snapshots, rollback and rollback verification remain required. Failed recovery blocks subsequent writes.
• BOLA / IDOR and Mass Assignment verdict semantics and the TLS / HTTP / redirect / proxy boundaries are unchanged.
• No active POST / PUT testing or automated login / OAuth lifecycle is added.
• SARIF, cURL and onboarding output retain credential minimization. cURL templates keep credential placeholders even when sensitive report evidence is enabled; onboarding omits configured resource values.
• Validation and dry-run stay offline; dry-run sends zero requests. The bundled demo uses a disposable dynamic 127.0.0.1 server without user credentials or an external target.

Quality

• 486 tests across Python 3.9 / 3.12 / 3.14.
• Branch-aware coverage is 82.77%–82.78%, with the existing minimum 80% gate.
• Blocking mypy: 0 errors in 18 source files. Ruff, Runtime dependency audit and CodeQL checks pass.
• Installed-wheel validation runs outside the source checkout: read-only demo sends 0 PATCH requests; active demo verifies rollback, full database restoration and server shutdown.

Upgrade

GrantTrace v2.5.0 is available on PyPI:

python -m pip install --upgrade granttrace
granttrace --version
granttrace demo

PyPI: granttrace 2.5.0

GrantTrace v2.4.1

GrantTrace v2.4.1

GrantTrace v2.4.1 improves the installed-package demo experience and strengthens project quality gates while preserving the existing authorization detection and write-safety semantics.

Highlights

• Add granttrace demo for a one-command installed-package demonstration.
• Package fictional OpenAPI, configuration and mock data with the distribution.
• Run the demo only on a dynamic 127.0.0.1 loopback server.
• Add --output-dir and --read-only controls.
• Resolve the previous 20 mypy errors across six files.
• Make mypy a blocking CI quality gate.
• Enforce a minimum 80% test coverage threshold.
• Add weekly Dependabot checks for Python dependencies and GitHub Actions.

Safety

• Default auditing remains read-only.
• The built-in demo accepts no external target or user credentials.
• Existing BOLA / IDOR and Mass Assignment detection semantics are unchanged.
• Existing allowlist, independent GET readback, snapshot, restoration and rollback verification remain in place.
• OAuth / mTLS automation, POST / PUT active testing, GraphQL, gRPC and SARIF are not included in this release.

Verification

Release source commit:

8ba6cb46c9bbd670449989a5bd54fb233543d81f

• Python 3.9 / 3.12 / 3.14 passed
• 304 tests passed
• Mypy: 0 errors
• Ruff: passed
• Runtime dependency audit: passed
• CodeQL: passed
• Coverage: 80.83%–80.85%
• Read-only demo: 0 PATCH
• Active demo: rollback_verified=true
• Full mock database restoration verified
• Wheel and sdist passed twine check --strict

Install

After PyPI publication:

pip install granttrace
granttrace demo

GrantTrace v2.4.0

GrantTrace 2.4.0 is a safety-first, evidence-driven OpenAPI / Swagger authorization auditing tool for BOLA, IDOR and Mass Assignment. The project remains Beta.

Compare Owner / Visitor / Anonymous access to the same resource, verify persisted side effects through independent GET readback, and record rollback verification. Default scans are read-only; active JSON PATCH requires explicit allowlists, original-state snapshots and verified restoration. A failed recovery halts further writes.

This release packages the previously verified development work. Release preparation preserves core detection criteria and safety limits; no POST/PUT active testing, automated authentication, or other new scanner capability was added.

Added

• Generate offline OpenAPI configuration drafts and missing-input checklists;
  reject unresolved drafts and refuse to overwrite existing files.
• Add offline HTML report search/status filters and compact severity labels.
• Support strict OpenAPI style/explode and Swagger collectionFormat parameter
  serialization in scans/readbacks, including arrays and lowercase booleans;
  decline unsupported or ambiguous formats before sending requests.
• Add explicit per-pair expected_visitor_access for legitimate sharing/admin
  reads, recorded as AUTHORIZED, and six local authorization truth fixtures with
  false-positive/false-negative accounting.
• Add mandatory Ruff checks, real unittest branch coverage with text/XML/JSON
  evidence, runtime dependency auditing with pip-audit, and a Python CodeQL
  workflow. Keep mypy advisory while recording existing type debt.
• Add simple issue templates and contribution guidance with private vulnerability
  reporting and reminders to exclude credentials and sensitive target data.

Changed

• Promote the previously identified 2.4.0.dev0 development build to 2.4.0 across
  runtime, package metadata and reports; retain api_sentinel.py and
  APISentinelAuditor compatibility.
• Use granttrace_report.html when no output path is supplied and align package
  description, version status and GrantTrace branding.
• Keep a concise five-minute README walkthrough, add identity/readback/restoration
  highlights, and preserve the visible report preview and detailed guide links.
• Explain identity/resource access, changed fields, restoration and next steps
  before raw evidence. JSON report schema is version 2.
• Remove tests' dependence on untracked config.json; automate JSON/YAML mock
  restoration and clean wheel installation outside the checkout in CI.
• Maintain reproducible release verification and local-output ignore rules;
  remove an unused demo image while preserving the report preview.
• Include example configuration, guides and verification scripts in the source
  distribution so its documented local checks can be reproduced.

Security / Safety

• Preserve default read-only auditing and explicit allowlisted JSON PATCH checks;
  active POST/PUT checks and automated authentication are not added.
• Preserve independent GET readback, original-state snapshots, finally-protected
  restoration and rollback verification. Failed recovery halts subsequent writes.
• Preserve TLS verification by default, explicit non-loopback HTTP opt-in and
  minimized/redacted evidence by default.
• Retain denial, anonymous-leak and invalid-baseline boundaries without changing
  the BOLA / IDOR or Mass Assignment detection criteria during release preparation.

Historical release tags and assets, including v2.3.1, remain unchanged.

Release verification

• Release PR #12 merged after all formal checks passed.
• Final main: 664412c; annotated v2.4.0 points to this commit.
• Main CI: Python 3.9 / 3.12 / 3.14 each passed 268 tests, zero failures/errors/skips, business scenarios, JSON/YAML mock restoration and independent wheel installation. Ruff and runtime pip-audit passed.
• Code coverage: 79.66% total, 82.66% statements, 74.02% branches, unchanged. These are code coverage figures, separate from endpoint coverage.
• CodeQL completed; the release PR introduced no new alerts. One existing synthetic-test sanitization alert remains open and is documented in VERIFICATION.md.
• Mypy remains advisory with 20 historical issues in six files.
• Wheel/sdist passed strict metadata checks; the exact attached wheel was installed in a fresh environment outside the checkout. CLI, Banner, package/runtime metadata, HTML, JSON tool_version and User-Agent all agree on 2.4.0; read-only PATCH=0, active PATCH=3, full mock state restored.
• The extracted sdist passed the full tests and local scenario/example verification. No production API or real target credentials were used.

Install

Download the attached wheel and run:

python -m pip install granttrace-2.4.0-py3-none-any.whl
granttrace --version

Expected output: GrantTrace 2.4.0. Verify attachments with SHA256SUMS.

PyPI publication is pending safe publishing authentication / Trusted Publishing setup. This GitHub release does not claim that pip install granttrace==2.4.0 from PyPI is available.

GrantTrace v2.3.1

GrantTrace v2.3.1

First public release of GrantTrace.

GrantTrace is an evidence-driven API authorization security auditing tool focused on:

• BOLA / IDOR testing
• Mass Assignment testing
• OpenAPI / Swagger parsing
• Read-only auditing by default
• Controlled write testing with explicit allowlists
• JSON and HTML audit reports
• Offline configuration validation

Highlights

• Safety-first design with read-only behavior by default
• OpenAPI 3.x and Swagger 2.0 support
• Evidence-based authorization findings
• Configuration schema validation
• 223 automated regression and security-hardening tests
• Apache License 2.0

Version

v2.3.1