@xenos1996/usa 2.26.0 → 2.26.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +9 -5
- package/rules/core/security.yaml +1 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xenos1996/usa",
|
|
3
|
-
"version": "2.26.
|
|
3
|
+
"version": "2.26.2",
|
|
4
4
|
"description": "Universal Software Auditor — an open-source, self-adapting audit framework for any project, any stack, any stage",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -47,12 +47,12 @@
|
|
|
47
47
|
"author": "",
|
|
48
48
|
"repository": {
|
|
49
49
|
"type": "git",
|
|
50
|
-
"url": "git+https://github.com/
|
|
50
|
+
"url": "git+https://github.com/STEMORG2026/universal-software-auditor.git"
|
|
51
51
|
},
|
|
52
52
|
"bugs": {
|
|
53
|
-
"url": "https://github.com/
|
|
53
|
+
"url": "https://github.com/STEMORG2026/universal-software-auditor/issues"
|
|
54
54
|
},
|
|
55
|
-
"homepage": "https://github.com/
|
|
55
|
+
"homepage": "https://github.com/STEMORG2026/universal-software-auditor#readme",
|
|
56
56
|
"engines": {
|
|
57
57
|
"node": ">=20.0.0"
|
|
58
58
|
},
|
|
@@ -104,8 +104,12 @@
|
|
|
104
104
|
"docs:cli": "node scripts/gen-cli-docs.mjs --check",
|
|
105
105
|
"docs:sample": "node scripts/gen-sample-report.mjs --check",
|
|
106
106
|
"docs:asvs": "node scripts/gen-asvs-coverage.mjs --check",
|
|
107
|
+
"docs:manifest": "node scripts/check-manifest.mjs",
|
|
107
108
|
"docs:links": "node scripts/check-links.mjs",
|
|
108
|
-
"
|
|
109
|
+
"protocol:check": "node scripts/check-protocol.mjs",
|
|
110
|
+
"protocol:start": "node scripts/check-session-start.mjs",
|
|
111
|
+
"protocol:auto-update": "node scripts/auto-update-state.mjs",
|
|
112
|
+
"docs:all": "npm run docs:adrs && npm run docs:check && npm run docs:cli && npm run docs:sample && npm run docs:asvs && npm run docs:manifest",
|
|
109
113
|
"changeset": "changeset",
|
|
110
114
|
"version-packages": "changeset version && pnpm run format",
|
|
111
115
|
"release": "pnpm run build && changeset publish"
|
package/rules/core/security.yaml
CHANGED
|
@@ -534,7 +534,7 @@ rules:
|
|
|
534
534
|
assert: { rule: SEC-014, status: [PASS] }
|
|
535
535
|
why: 'Sound tokens with expiry but no rate limiting leave a credential-stuffing window: each token check passes, the login endpoint still takes unlimited guesses.'
|
|
536
536
|
remediation: 'Rate-limit failed authentication (see SEC-014) on every endpoint that accepts these tokens.'
|
|
537
|
-
references: ['CWE-307'
|
|
537
|
+
references: ['CWE-307']
|
|
538
538
|
|
|
539
539
|
- id: INV-SEC-003
|
|
540
540
|
title: Validated input is also encoded on output
|