blitzstrike 2.4.66 → 2.4.67

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.67] — 2026-09-14
+
+### Fixed — Whole-code interconnection audit (2 bugs)
+
+- `submission_gate` is now FAIL-CLOSED: a question passes only when EXPLICITLY
+  asserted true (`=== true`, not `!== false`), so an empty/unset finding fails the
+  gate instead of passing 7/7 by default. One false = kill, and a missing field is
+  a false.
+- Redaction now covers detection end-to-end: 6 secret formats the detector found
+  but the redactor did not strip (Slack webhook URL, Firebase URL, basic-auth URL,
+  Sentry DSN, ngrok auth token, Discord bot token) now redact — the invariant
+  "every secret the detector finds is stripped from reports/logs" is restored.
+- Added a whole-code interconnection audit (detectors ↔ CWE ↔ patterns ↔ chains ↔
+  variants ↔ synonyms ↔ severity ↔ secrets + edge cases) + regression tests for
+  both fixes.
+
 ## [2.4.66] — 2026-09-14
 
 ### Added — Per-engagement pattern recall (intelligence ledger)

package/dist/index.js

@@ -7495,6 +7495,12 @@ var init_secrets = __esm(() => {
     [/\blin_api_[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
     [/\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, "[REDACTED]"],
     [/\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, "[REDACTED]"],
+    [/\b[12][A-Za-z0-9]{26}_[A-Za-z0-9]{32,}\b/g, "[REDACTED]"],
+    [/\b[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}\b/g, "[REDACTED]"],
+    [/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9\/]+/g, "[REDACTED]"],
+    [/\bhttps?:\/\/[a-z0-9-]+\.firebaseio\.com\b/g, "[REDACTED]"],
+    [/https:\/\/[a-f0-9]+@o[0-9]+\.ingest\.sentry\.io\/[0-9]+/g, "[REDACTED]"],
+    [/https?:\/\/[^/\s:@]+:[^/\s:@]+@[^/\s]+/g, "[REDACTED]"],
     [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
   ];
@@ -57818,37 +57824,37 @@ function submissionGate(input) {
   const questions = [
     {
       q: "Reproducible — a copy-paste-ready request or step list triggers it?",
-      pass: input.reproducible !== false,
+      pass: input.reproducible === true,
       reason: "Without an exact reproduction the finding is a hypothesis, not a result."
     },
     {
       q: "In scope — the vulnerable asset is in the engagement scope?",
-      pass: input.in_scope !== false,
+      pass: input.in_scope === true,
       reason: "Out-of-scope assets must not be submitted."
     },
     {
       q: "Real impact — maps to an accepted-impact class, not informational?",
-      pass: input.real_impact !== false,
+      pass: input.real_impact === true,
       reason: "Informational-only findings dilute the validity ratio."
     },
     {
       q: "No privileged assumption — works without unrealistic attacker prerequisites?",
-      pass: input.no_privileged_assumption !== false,
+      pass: input.no_privileged_assumption === true,
       reason: "'Admin can do X' is a centralization risk, not a vulnerability."
     },
     {
       q: "Verified live — confirmed with a marker + negative control, not just a static hint?",
-      pass: input.verified_live !== false,
+      pass: input.verified_live === true,
       reason: "A static hit is a hypothesis until verified live (strike_verify / browser_validate)."
     },
     {
       q: "Evidence attached AND redacted — secrets/PII stripped, integrity-tagged?",
-      pass: input.evidence_redacted !== false,
+      pass: input.evidence_redacted === true,
       reason: "Evidence must carry SHA-256-tagged, redacted records — no leaked secrets or victim PII."
     },
     {
       q: "Severity derived — CVSS/confidence computed, not guessed?",
-      pass: input.severity_derived !== false,
+      pass: input.severity_derived === true,
       reason: "Severity is not confidence; derive it, don't assert it."
     }
   ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.66",
+  "version": "2.4.67",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {