cleartoship 0.10.2 → 0.10.4

package/README.md

@@ -218,7 +218,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.2
+      - uses: murtazaozdemir/cleartoship@v0.10.4
         with:
           fail-on: critical
           comment: true
@@ -240,7 +240,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.10.2` runs `cleartoship@0.10.2` and pinning the ref pins the behaviour. If
+`@v0.10.4` runs `cleartoship@0.10.4` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 
@@ -303,6 +303,18 @@ uploaded, and no database is connected to.
   call chained to it, and stand down when the values are bound. They still fire
   when any interpolation reads from the request, so a query that binds one value
   and concatenates another is reported.
+- **The scan stays inside the directory you pointed at.** A symlink that
+  resolves outside the scan root is not followed. It sounds academic until you
+  run this in CI on a pull request: `vendor-config -> /home/runner/.ssh` would
+  otherwise be read, and quoted, into a public comment. Symlink loops are walked
+  once rather than a dozen times, and the report says how many links were
+  refused.
+- **A match in a comment is prose about code, not code.** The scanner lexes each
+  file once for strings and comments — properly, tracking quotes, so a URL
+  inside a string is not mistaken for the start of one — and a community rule
+  that matched inside a comment is dropped. Our own source found this: a comment
+  reading *"merely calling `jwt.verify(token, secret)`"* was reported as a JWT
+  vulnerability.
 - **A rule that cannot apply here is not run.** The vendored ruleset covers
   ground this project may not stand on: certificate pinning and WebView
   hardening are React Native concerns, and a browser will not let a page pin a

package/SECURITY.md

@@ -22,7 +22,7 @@ supported one; older versions are not backported.
 | **Never writes to the scanned project** | The only writes in the codebase are the report file you ask for with `--output <path>` and the registry cache. Verify: `grep -rn "writeFileSync\|mkdirSync\|rmSync\|unlink" src/ --exclude-dir=vendor` — five lines, of which two are imports and three are those call sites. Neither path is derived from the scan root. |
 | **Never executes your code** | The scanner has no `child_process`, `exec`, `spawn`, `eval`, `new Function`, or dynamic `import()` of scanned files. Your code is read as text, parsed by Babel into an AST, and matched against regexes. Verify: `grep -rn "child_process\|execSync\|spawn\|eval(\|new Function" src/ --exclude-dir=vendor` — one hit, and it is a *pattern string* in the rule that detects those calls in **your** install hooks. (Drop `--exclude-dir=vendor` and the extra hits are rule text in the vendored ruleset, matched against your code, never run.) |
 | **Never connects to your database** | The Row Level Security scanner replays your `.sql` migration files to model the resulting schema. There is no database driver in the dependency tree and no connection string is ever read. |
-| **Reads only what it scans** | Files are gathered by walking the scan root, skipping `node_modules`, build output, virtualenvs and anything your own `.gitignore` excludes. Ignore rules are read from the scan root downwards only — never from a parent directory — so nothing outside the root is read except the cache directory. |
+| **Reads only what it scans** | Files are gathered by walking the scan root, skipping `node_modules`, build output, virtualenvs and anything your own `.gitignore` excludes. Ignore rules are read from the scan root downwards only — never from a parent directory. **A symlink that resolves outside the root is not followed**, so a repository cannot make the scanner read `~/.ssh` and quote it back into a report; the count of refused links appears in the output. Nothing outside the root is read except the cache directory. |
 
 ## What leaves your machine
 
@@ -65,6 +65,9 @@ are visible in the diff and cannot change under you between releases:
   categories no static scanner can reach.
 - **Not a sandbox.** It reads whatever you point it at. Pointing it at a
   repository you do not trust is as safe as opening that repository in an
-  editor — no more, and no less.
+  editor — no more, and no less. What it will not do is read *beyond* what you
+  pointed it at: symlinks out of the tree are refused, and a malformed pattern
+  in the repository's own `.gitignore` is skipped rather than allowed to end
+  the scan.
 - **Not a secret scanner of record.** Secrets already committed to git history
   are out of scope; ClearToShip reads the working tree, not past commits.

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.10.2` runs cleartoship@0.10.2. Set
+      action's own ref declares, so `uses: …@v0.10.4` runs cleartoship@0.10.4. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.10.2` runs cleartoship@0.10.2 instead of
+        # `uses: <owner>/cleartoship@v0.10.4` runs cleartoship@0.10.4 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/report.js

@@ -118,6 +118,7 @@ export function renderJson(scan) {
         framework: scan.framework,
         fileCount: scan.fileCount,
         gitIgnoredCount: scan.gitIgnoredCount,
+        escapingSymlinkCount: scan.escapingSymlinkCount,
         durationMs: scan.durationMs,
         verdict: scan.counts.critical > 0 ? 'hold' : scan.counts.high > 0 ? 'conditional' : 'clear',
         counts: scan.counts,

package/dist/scan.d.ts

@@ -19,6 +19,8 @@ export interface FullScan {
     fileCount: number;
     /** Paths left unscanned because the repository's own ignore rules exclude them. */
     gitIgnoredCount: number;
+    /** Symlinks that pointed outside the scan root and were not followed. */
+    escapingSymlinkCount: number;
     findings: Finding[];
     checks: CheckSummary[];
     warnings: string[];

package/dist/scan.js

@@ -13,6 +13,7 @@ export async function scan(options) {
     const walked = roots.map((r) => walk(r, { respectGitignore: !options.noGitignore }));
     const files = [...new Set(walked.flatMap((w) => w.files))];
     const gitIgnoredCount = walked.reduce((n, w) => n + w.gitIgnored, 0);
+    const escapingSymlinkCount = walked.reduce((n, w) => n + w.escapingSymlinks, 0);
     const framework = detectFramework(root, files);
     const ctx = {
         root,
@@ -76,6 +77,14 @@ export async function scan(options) {
                 'checkout. Use --no-gitignore to scan them anyway.',
         });
     }
+    if (escapingSymlinkCount > 0) {
+        checks.push({
+            label: `Symlinks leaving the scan root not followed (${escapingSymlinkCount})`,
+            passed: true,
+            note: 'they point outside the directory you asked about, so their contents are not ' +
+                'this project and are never read or quoted in this report',
+        });
+    }
     const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
     for (const f of filtered)
         counts[f.severity]++;
@@ -84,6 +93,7 @@ export async function scan(options) {
         framework: framework.describe(),
         fileCount: files.length,
         gitIgnoredCount,
+        escapingSymlinkCount,
         findings: filtered,
         checks,
         warnings,

package/dist/scanners/community.js

@@ -1,6 +1,7 @@
 import { read, rel, lineAt, snippetAt, languagesFor } from '../utils/files.js';
 import { Suppressions } from '../utils/suppress.js';
 import { adjustForPath } from '../utils/paths.js';
+import { commentStyleFor, lexSpans, isInside } from '../utils/spans.js';
 import { GUARDVIBE_RULES, GUARDVIBE_ATTRIBUTION, GUARDVIBE_REACT_NATIVE_RULE_IDS, GUARDVIBE_CVE_RULE_IDS, } from '../vendor/guardvibe/index.js';
 import { emptyResult } from '../types.js';
 /**
@@ -160,6 +161,15 @@ function isParameterized(statement) {
     // '?').join(',')})`, or a constant SQL fragment interpolated beside binds.
     if (/\.\s*bind\s*\(\s*[^)\s]/.test(statement))
         return true;
+    // The other calling convention: the values follow the query.
+    // `$executeRawUnsafe(\`… VALUES ${placeholders}\`, ...params)`,
+    // `db.query(sql, [id])`. A closing backtick with an argument after it.
+    if (/`\s*,\s*[^)\s]/.test(statement))
+        return true;
+    // An interpolation that builds placeholders is parameterizing too:
+    // `chunk.map(() => "(?, ?, ?)").join(", ")`.
+    if (/\$\{[^}]*['"][^'"]*\?[^'"]*['"]/.test(statement))
+        return true;
     // Otherwise look for the placeholders themselves — with interpolations
     // dropped first, so a JavaScript ternary is not read as a `?` parameter.
     return BIND_PLACEHOLDER.test(statement.replace(/\$\{[^}]*\}/g, ' '));
@@ -171,26 +181,6 @@ function sqlGuard(match, source, index) {
         return false;
     return !isParameterized(statementAround(source, index));
 }
-/** Whether `index` falls inside a quoted string on its own line. */
-function insideStringLiteral(source, index) {
-    const lineStart = source.lastIndexOf('\n', index - 1) + 1;
-    let quote = null;
-    for (let i = lineStart; i < index; i++) {
-        const ch = source[i];
-        if (ch === '\\') {
-            i++;
-            continue;
-        }
-        if (quote) {
-            if (ch === quote)
-                quote = null;
-        }
-        else if (ch === '"' || ch === "'" || ch === '`') {
-            quote = ch;
-        }
-    }
-    return quote !== null;
-}
 /**
  * Per-rule filters for a match shape the upstream regex cannot exclude on its
  * own. Given the matched text plus where it sat, so a guard can look around it.
@@ -247,12 +237,17 @@ const MATCH_GUARDS = {
     // `eval("require")` is the documented escape hatch for keeping a bundler from
     // statically resolving a require — a constant the author typed, with no input
     // reaching it. Dynamic code execution is about the dynamic part.
-    VG014: (match, source, index) => {
-        if (insideStringLiteral(source, index))
+    VG014: (match, source, index, spans) => {
+        if (isInside(spans, index, 'string'))
             return false;
         const after = source.slice(index, index + 60);
         return !/^(?:eval|new\s+Function)\s*\(\s*(['"])[A-Za-z_$][\w$]*\1\s*\)/.test(after);
     },
+    // `$executeRawUnsafe` is named for who builds the SQL string, not for whether
+    // values can be bound — Prisma takes positional parameters after the query.
+    // `$executeRawUnsafe(\`INSERT … VALUES ${placeholders}\`, ...params)`, where
+    // `placeholders` is `chunk.map(() => "(?, ?)").join(",")`, binds every value.
+    VG433: (_match, source, index) => !isParameterized(statementAround(source, index)),
     // SSRF is a *server* being made to fetch a URL it should not. A module marked
     // `'use client'` runs in the browser, where the request leaves the user's own
     // machine and crosses no trust boundary of yours.
@@ -351,6 +346,7 @@ export const communityScanner = {
                 continue;
             const relPath = rel(ctx.root, file);
             const lockfile = LOCKFILE.test(relPath);
+            const spans = lexSpans(source, commentStyleFor(languages));
             const suppress = new Suppressions(source);
             filesScanned++;
             for (const rule of active) {
@@ -371,7 +367,15 @@ export const communityScanner = {
                     }
                     // Skipping a match must not skip the non-global `break` below, or a
                     // rule without /g would rescan from zero forever.
-                    if (guard && !guard(m[0], source, m.index)) {
+                    // A rule that matched inside a comment matched prose about code, not
+                    // code. Nothing in the vendored ruleset targets comment content, and
+                    // a commented-out call is not a call.
+                    if (isInside(spans, m.index, 'comment')) {
+                        if (!re.global)
+                            break;
+                        continue;
+                    }
+                    if (guard && !guard(m[0], source, m.index, spans)) {
                         if (!re.global)
                             break;
                         continue;

package/dist/utils/files.d.ts

@@ -2,6 +2,8 @@ export interface WalkResult {
     files: string[];
     /** How many paths were left out because the repository ignores them. */
     gitIgnored: number;
+    /** How many symlinks pointed outside the scan root and were not followed. */
+    escapingSymlinks: number;
 }
 export declare function walk(root: string, options?: {
     respectGitignore?: boolean;

package/dist/utils/files.js

@@ -1,4 +1,4 @@
-import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
+import { readdirSync, statSync, readFileSync, existsSync, realpathSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { Gitignore, extendedAt, repositoryExcludes } from './gitignore.js';
 const SKIP_DIRS = new Set([
@@ -63,6 +63,25 @@ export function walk(root, options = {}) {
         ? extendedAt(repositoryExcludes(root, read), root, read)
         : Gitignore.empty();
     const stack = [{ dir: root, rules: rootRules }];
+    // A symlinked directory that points back into the tree — `self -> .`, or the
+    // A→B→A pair a workspace layout can produce — otherwise gets walked again on
+    // every pass, reporting the same file at a dozen different paths. Resolving
+    // each directory once and remembering it costs one syscall per directory.
+    const visited = new Set();
+    let escapingSymlinks = 0;
+    // A symlink that leaves the tree is not part of the project, and following one
+    // would be worse than useless: `vendor-config -> /home/runner/.ssh` makes the
+    // scanner read that directory and quote what it finds — into a pull-request
+    // comment, in the Action. So the scan stays inside what it was pointed at.
+    let rootReal;
+    try {
+        rootReal = realpathSync(root);
+    }
+    catch {
+        rootReal = root;
+    }
+    visited.add(rootReal);
+    const insideRoot = (real) => real === rootReal || real.startsWith(rootReal.endsWith('/') ? rootReal : rootReal + '/');
     while (stack.length) {
         const { dir, rules } = stack.pop();
         let entries;
@@ -81,9 +100,23 @@ export function walk(root, options = {}) {
             catch {
                 continue;
             }
+            let real;
+            try {
+                real = realpathSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (!insideRoot(real)) {
+                escapingSymlinks++;
+                continue;
+            }
             if (st.isDirectory()) {
                 if (SKIP_DIRS.has(entry))
                     continue;
+                if (visited.has(real))
+                    continue;
+                visited.add(real);
                 // git never descends into an ignored directory, and neither do we —
                 // which is also where most of the saving comes from.
                 if (respect && rules.ignores(full, true)) {
@@ -113,7 +146,7 @@ export function walk(root, options = {}) {
             }
         }
     }
-    return { files: found.sort(), gitIgnored };
+    return { files: found.sort(), gitIgnored, escapingSymlinks };
 }
 export function read(file) {
     try {

package/dist/utils/gitignore.d.ts

@@ -17,5 +17,11 @@ export declare function extendedAt(parent: Gitignore, dir: string, read: (path:
  * Repository-local excludes. Same syntax, same precedence as a root
  * `.gitignore`, but kept out of version control — so a machine-specific
  * scratch directory is invisible here without appearing in anyone's diff.
+ *
+ * The user's *global* ignore file (`core.excludesFile`, usually
+ * `~/.config/git/ignore`) is deliberately not read: it lives outside the scan
+ * root, which SECURITY.md promises we do not touch, and it is per-machine — a
+ * CI checkout would not have it, so honouring it would make a local scan
+ * quieter than the one that gates the merge.
  */
 export declare function repositoryExcludes(root: string, read: (path: string) => string | null): Gitignore;

package/dist/utils/gitignore.js

@@ -12,6 +12,10 @@ function translate(pattern) {
             continue;
         }
         if (ch === '*') {
+            // `****` means no more than `**` does, and collapsing it keeps the
+            // translated regex free of the nested quantifiers that backtrack badly.
+            while (pattern[i + 1] === '*' && pattern[i + 2] === '*')
+                i++;
             const doubled = pattern[i + 1] === '*';
             if (doubled) {
                 const atStart = i === 0 || pattern[i - 1] === '/';
@@ -51,11 +55,22 @@ function translate(pattern) {
     }
     return out;
 }
+/**
+ * A pattern longer than this is not a real ignore rule. The cap exists because
+ * this text comes from the repository being scanned, which for a security tool
+ * is untrusted input: it reaches a regex compiler, and a regex compiler is a
+ * place where hostile input has leverage.
+ */
+const MAX_PATTERN = 500;
+/** Likewise, a `.gitignore` with more rules than this is not one. */
+const MAX_RULES = 2000;
 function compile(line) {
     // Trailing whitespace is not part of the pattern unless it was escaped.
     let pattern = line.replace(/(?<!\\)\s+$/, '');
     if (pattern === '' || pattern.startsWith('#'))
         return null;
+    if (pattern.length > MAX_PATTERN)
+        return null;
     let negated = false;
     if (pattern.startsWith('!')) {
         negated = true;
@@ -77,8 +92,23 @@ function compile(line) {
     if (pattern.startsWith('/'))
         pattern = pattern.slice(1);
     const body = translate(pattern);
-    const source = anchored ? `^${body}(?:/.*)?$` : `(?:^|/)${body}(?:/.*)?$`;
-    return { re: new RegExp(source), negated, dirOnly };
+    // No subtree suffix: a pattern matches a path, not everything beneath it.
+    // Git prunes ignored directories during traversal instead, which is what the
+    // walk does — and only that order makes `logos/*` followed by
+    // `!logos/logos-in-app/` mean what git means. Matching the subtree here made
+    // the negation unreachable: every file under the re-included directory stayed
+    // ignored, 28 of them tracked, in one real repository.
+    const source = anchored ? `^${body}$` : `(?:^|/)${body}$`;
+    try {
+        return { re: new RegExp(source), negated, dirOnly };
+    }
+    catch {
+        // `[z-a]` is a reversed range, and one line of it used to end the scan:
+        // the throw escaped `walk()`, which runs before any scanner's error
+        // handling. A pattern git itself would treat as literal is not worth
+        // dying over — skip it and read the rest of the file.
+        return null;
+    }
 }
 export class Gitignore {
     layers;
@@ -92,6 +122,8 @@ export class Gitignore {
     extend(base, content) {
         const rules = [];
         for (const line of content.split(/\r?\n/)) {
+            if (rules.length >= MAX_RULES)
+                break;
             const rule = compile(line);
             if (rule)
                 rules.push(rule);
@@ -133,6 +165,12 @@ export function extendedAt(parent, dir, read) {
  * Repository-local excludes. Same syntax, same precedence as a root
  * `.gitignore`, but kept out of version control — so a machine-specific
  * scratch directory is invisible here without appearing in anyone's diff.
+ *
+ * The user's *global* ignore file (`core.excludesFile`, usually
+ * `~/.config/git/ignore`) is deliberately not read: it lives outside the scan
+ * root, which SECURITY.md promises we do not touch, and it is per-machine — a
+ * CI checkout would not have it, so honouring it would make a local scan
+ * quieter than the one that gates the merge.
  */
 export function repositoryExcludes(root, read) {
     const content = read(join(root, '.git', 'info', 'exclude'));

package/dist/utils/spans.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Where the strings and comments are in a file.
+ *
+ * A regex ruleset has no idea whether it matched code, a sentence about code,
+ * or a URL — and the difference decides whether a finding is real. Our own
+ * source proved it: a comment reading "merely calling `jwt.verify(token,
+ * secret)`" was reported as a JWT vulnerability, and a rule *description*
+ * quoting `eval()` was reported as dynamic code execution.
+ *
+ * The naive fix — treat everything after `//` as a comment — is worse than the
+ * bug, because `"https://api.example.com"` would silence every finding on that
+ * line. So this walks the file once, tracking quotes as it goes, and both
+ * answers come out correct.
+ */
+export interface Span {
+    start: number;
+    end: number;
+    kind: 'string' | 'comment';
+}
+export interface CommentStyle {
+    /** `//` line comments and `/* *\/` blocks. */
+    slashes: boolean;
+    /** `#` line comments: shell, Python, Ruby, YAML, Terraform, Dockerfile. */
+    hash: boolean;
+    /** `--` line comments: SQL. */
+    dashes: boolean;
+}
+export declare function commentStyleFor(languages: readonly string[]): CommentStyle;
+export declare function lexSpans(source: string, style: CommentStyle): Span[];
+/** Binary search: is `index` inside a span of this kind? */
+export declare function spanAt(spans: readonly Span[], index: number): Span | null;
+export declare function isInside(spans: readonly Span[], index: number, kind: Span['kind']): boolean;

package/dist/utils/spans.js

@@ -0,0 +1,98 @@
+/**
+ * Where the strings and comments are in a file.
+ *
+ * A regex ruleset has no idea whether it matched code, a sentence about code,
+ * or a URL — and the difference decides whether a finding is real. Our own
+ * source proved it: a comment reading "merely calling `jwt.verify(token,
+ * secret)`" was reported as a JWT vulnerability, and a rule *description*
+ * quoting `eval()` was reported as dynamic code execution.
+ *
+ * The naive fix — treat everything after `//` as a comment — is worse than the
+ * bug, because `"https://api.example.com"` would silence every finding on that
+ * line. So this walks the file once, tracking quotes as it goes, and both
+ * answers come out correct.
+ */
+export function commentStyleFor(languages) {
+    const has = (l) => languages.includes(l);
+    return {
+        slashes: has('javascript') || has('typescript') || has('go') || has('php') || has('sql'),
+        hash: has('python') ||
+            has('shell') ||
+            has('ruby') ||
+            has('yaml') ||
+            has('terraform') ||
+            has('dockerfile'),
+        dashes: has('sql'),
+    };
+}
+/** Files past this size are skipped by the caller anyway; this is belt and braces. */
+const MAX_SOURCE = 1_000_000;
+export function lexSpans(source, style) {
+    const spans = [];
+    if (source.length > MAX_SOURCE)
+        return spans;
+    for (let i = 0; i < source.length; i++) {
+        const ch = source[i];
+        // Strings. A template literal is taken whole, interpolations included —
+        // nothing here needs to reason about what is inside one.
+        if (ch === '"' || ch === "'" || ch === '`') {
+            const start = i;
+            const quote = ch;
+            i++;
+            while (i < source.length) {
+                const c = source[i];
+                if (c === '\\') {
+                    i += 2;
+                    continue;
+                }
+                if (c === quote)
+                    break;
+                // An unterminated single- or double-quoted string ends at the newline,
+                // which is what an apostrophe in a comment looks like.
+                if (c === '\n' && quote !== '`')
+                    break;
+                i++;
+            }
+            spans.push({ start, end: Math.min(i, source.length - 1), kind: 'string' });
+            continue;
+        }
+        const two = source.slice(i, i + 2);
+        if (style.slashes && two === '/*') {
+            const end = source.indexOf('*/', i + 2);
+            const close = end === -1 ? source.length - 1 : end + 1;
+            spans.push({ start: i, end: close, kind: 'comment' });
+            i = close;
+            continue;
+        }
+        const lineComment = (style.slashes && two === '//') ||
+            (style.dashes && two === '--') ||
+            (style.hash && ch === '#');
+        if (lineComment) {
+            const newline = source.indexOf('\n', i);
+            const close = newline === -1 ? source.length - 1 : newline - 1;
+            spans.push({ start: i, end: close, kind: 'comment' });
+            i = close;
+            continue;
+        }
+    }
+    return spans;
+}
+/** Binary search: is `index` inside a span of this kind? */
+export function spanAt(spans, index) {
+    let low = 0;
+    let high = spans.length - 1;
+    while (low <= high) {
+        const mid = (low + high) >> 1;
+        const span = spans[mid];
+        if (index < span.start)
+            high = mid - 1;
+        else if (index > span.end)
+            low = mid + 1;
+        else
+            return span;
+    }
+    return null;
+}
+export function isInside(spans, index, kind) {
+    return spanAt(spans, index)?.kind === kind;
+}

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.2
+      - uses: murtazaozdemir/cleartoship@v0.10.4
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",