blitzstrike 1.0.69 → 1.0.70

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.70] — 2026-09-13
+
+### Fixed — polish from live LLM-driven verification
+
+- `scope_check` now recognizes filesystem paths (static source) as always
+  in-scope instead of refusing with a misleading empty-host message.
+- `blitz_scan` (breadth) now matches Laravel static DB facade sinks
+  (`DB::select`/`DB::raw`/`DB::statement`/`DB::insert`/`DB::update`/
+  `DB::unprepared`, `->selectRaw`) — consistent with the depth layer.
+- `generate_report` no longer renders `undefined` for findings that lack
+  `status`/`confidence`/`id`; it defaults to `detected` / `unscored` / `(no id)`.
+
 ## [1.0.69] — 2026-09-13
 
 ### Changed — agent-native skills polish

package/dist/index.js

@@ -7209,6 +7209,13 @@ var init_scanner = __esm(() => {
     "$wpdb->get_results(": "SQL injection (unprepared query)",
     "->query(": "SQL injection (query builder)",
     "->whereRaw(": "SQL injection (raw where)",
+    "->selectRaw(": "SQL injection (raw select)",
+    "DB::select(": "SQL injection (raw query)",
+    "DB::raw(": "SQL injection (raw expression)",
+    "DB::statement(": "SQL injection (raw statement)",
+    "DB::insert(": "SQL injection (raw insert)",
+    "DB::update(": "SQL injection (raw update)",
+    "DB::unprepared(": "SQL injection (raw unprepared query)",
     "wp_remote_get(": "SSRF (unvalidated URL fetch)",
     "wp_remote_post(": "SSRF (unvalidated URL fetch)",
     "file_get_contents(": "SSRF / file read",
@@ -30486,7 +30493,7 @@ function summarize(findings) {
   const bySeverity = {};
   let evidenceArtifacts = 0;
   for (const f of findings) {
-    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
+    byStatus[f.status ?? "detected"] = (byStatus[f.status ?? "detected"] ?? 0) + 1;
     const sev = f.classification?.severity ?? "informational";
     bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
     evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
@@ -30555,10 +30562,10 @@ function reportMarkdown(findings, opts = {}) {
 `;
   }
   for (const f of findings) {
-    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
+    lines.push(`### ${f.id ?? "(no id)"} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
     lines.push("");
-    lines.push(`- **Status**: \`${f.status}\``);
-    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
+    lines.push(`- **Status**: \`${f.status ?? "detected"}\``);
+    lines.push(`- **Confidence**: ${f.confidence ?? "—"} (${f.confidence_level ?? "unscored"})`);
     if (f.classification?.cwe)
       lines.push(`- **CWE**: ${f.classification.cwe}`);
     if (f.classification?.cvss_score != null)
@@ -30796,6 +30803,9 @@ function loadChains() {
   }
 }
 function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  if (target.startsWith("/") || target.startsWith("./") || target.startsWith("../") || target.startsWith("~") || /^[a-zA-Z]:[\\/]/.test(target)) {
+    return { target, allowed: true, enforcement: "off", reason: "static source path — always in-scope" };
+  }
   let result;
   if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
     result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.69",
+  "version": "1.0.70",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {