GrantTrace v2.4.0

GrantTrace 2.4.0 is a safety-first, evidence-driven OpenAPI / Swagger authorization auditing tool for BOLA, IDOR and Mass Assignment. The project remains Beta.

Compare Owner / Visitor / Anonymous access to the same resource, verify persisted side effects through independent GET readback, and record rollback verification. Default scans are read-only; active JSON PATCH requires explicit allowlists, original-state snapshots and verified restoration. A failed recovery halts further writes.

This release packages the previously verified development work. Release preparation preserves core detection criteria and safety limits; no POST/PUT active testing, automated authentication, or other new scanner capability was added.

Added

• Generate offline OpenAPI configuration drafts and missing-input checklists;
  reject unresolved drafts and refuse to overwrite existing files.
• Add offline HTML report search/status filters and compact severity labels.
• Support strict OpenAPI style/explode and Swagger collectionFormat parameter
  serialization in scans/readbacks, including arrays and lowercase booleans;
  decline unsupported or ambiguous formats before sending requests.
• Add explicit per-pair expected_visitor_access for legitimate sharing/admin
  reads, recorded as AUTHORIZED, and six local authorization truth fixtures with
  false-positive/false-negative accounting.
• Add mandatory Ruff checks, real unittest branch coverage with text/XML/JSON
  evidence, runtime dependency auditing with pip-audit, and a Python CodeQL
  workflow. Keep mypy advisory while recording existing type debt.
• Add simple issue templates and contribution guidance with private vulnerability
  reporting and reminders to exclude credentials and sensitive target data.

Changed

• Promote the previously identified 2.4.0.dev0 development build to 2.4.0 across
  runtime, package metadata and reports; retain api_sentinel.py and
  APISentinelAuditor compatibility.
• Use granttrace_report.html when no output path is supplied and align package
  description, version status and GrantTrace branding.
• Keep a concise five-minute README walkthrough, add identity/readback/restoration
  highlights, and preserve the visible report preview and detailed guide links.
• Explain identity/resource access, changed fields, restoration and next steps
  before raw evidence. JSON report schema is version 2.
• Remove tests' dependence on untracked config.json; automate JSON/YAML mock
  restoration and clean wheel installation outside the checkout in CI.
• Maintain reproducible release verification and local-output ignore rules;
  remove an unused demo image while preserving the report preview.
• Include example configuration, guides and verification scripts in the source
  distribution so its documented local checks can be reproduced.

Security / Safety

• Preserve default read-only auditing and explicit allowlisted JSON PATCH checks;
  active POST/PUT checks and automated authentication are not added.
• Preserve independent GET readback, original-state snapshots, finally-protected
  restoration and rollback verification. Failed recovery halts subsequent writes.
• Preserve TLS verification by default, explicit non-loopback HTTP opt-in and
  minimized/redacted evidence by default.
• Retain denial, anonymous-leak and invalid-baseline boundaries without changing
  the BOLA / IDOR or Mass Assignment detection criteria during release preparation.

Historical release tags and assets, including v2.3.1, remain unchanged.

Release verification

• Release PR #12 merged after all formal checks passed.
• Final main: 664412c; annotated v2.4.0 points to this commit.
• Main CI: Python 3.9 / 3.12 / 3.14 each passed 268 tests, zero failures/errors/skips, business scenarios, JSON/YAML mock restoration and independent wheel installation. Ruff and runtime pip-audit passed.
• Code coverage: 79.66% total, 82.66% statements, 74.02% branches, unchanged. These are code coverage figures, separate from endpoint coverage.
• CodeQL completed; the release PR introduced no new alerts. One existing synthetic-test sanitization alert remains open and is documented in VERIFICATION.md.
• Mypy remains advisory with 20 historical issues in six files.
• Wheel/sdist passed strict metadata checks; the exact attached wheel was installed in a fresh environment outside the checkout. CLI, Banner, package/runtime metadata, HTML, JSON tool_version and User-Agent all agree on 2.4.0; read-only PATCH=0, active PATCH=3, full mock state restored.
• The extracted sdist passed the full tests and local scenario/example verification. No production API or real target credentials were used.

Install

Download the attached wheel and run:

python -m pip install granttrace-2.4.0-py3-none-any.whl
granttrace --version

Expected output: GrantTrace 2.4.0. Verify attachments with SHA256SUMS.

PyPI publication is pending safe publishing authentication / Trusted Publishing setup. This GitHub release does not claim that pip install granttrace==2.4.0 from PyPI is available.