blitzstrike 2.4.61 → 2.4.63

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.63] — 2026-09-14
+
+### Added — Variant corpus + detector coverage sweep (data-driven scaling)
+
+- New `intelligence/variants.json` — a corpus of 65 concrete real-world code
+  shapes (3-4 per class, multi-language: PHP/JS/Python/Java/Node) that each MUST
+  fire its class's detector. This is how the empirical grounding scales: more
+  shapes → more coverage, tested reproducibly.
+- New `scan_variants` MCP tool + `blitzstrike verify` now also sweeps the variant
+  corpus and reports per-class coverage, surfacing false negatives (a detector
+  missing a real shape) as a hard failure.
+- Detector coverage raised from 54% to 100% across the corpus, fixing real gaps:
+  multi-language sinks (pickle/yaml/readObject, jinja2/twig, axios/requests,
+  DocumentBuilderFactory), `$.extend`/`$twig->render` word-boundary bugs, JS `+`
+  concatenation in SQLi, `setcookie` CRLF, `mysqli_query`/`whereRaw` SQLi sinks,
+  dynamic field binding + `Model.create` mass-assignment, and a double-paren bug
+  in the upload sink regex. The corpus is the proof: every shape now fires.
+
+## [2.4.62] — 2026-09-14
+
+### Added — Deep empirical corpus (per-class bypass + crown jewels)
+
+- Enriched every pattern in `intelligence/patterns.json` with `bypass_techniques`
+  (the per-class bypass methods a senior hunter uses to defeat the class's
+  protections) and `crown_jewels` (the high-value assets/endpoints that class
+  typically hits). `pattern_lookup` now returns the full operator-depth record —
+  CWE + signature + chains + references + bypass + crown jewels — so a detector
+  hit is grounded in "what actually gets past the defenses and pays".
+
 ## [2.4.61] — 2026-09-14
 
 ### Added — Automated verification harness (`blitzstrike verify`)