guardvibe 1.3.2 → 1.3.3

package/README.md

@@ -311,6 +311,19 @@ Tested on a real 644-file Next.js + Supabase project:
 - False positive rate: **near zero** (comment/string filtering, human-readable text detection)
 - Detection rate: **100%** on known vulnerability patterns
 
+## Security
+
+GuardVibe takes supply chain security seriously:
+
+- **npm provenance** — every published version is cryptographically signed via Sigstore, linking the package to this exact GitHub repo and commit. Verify with `npm audit signatures`
+- **2FA enabled** — npm account protected with two-factor authentication
+- **Branch protection** — force push disabled on main, admin enforcement enabled
+- **Tag protection** — version tags (`v*`) cannot be deleted or force-pushed
+- **Minimal CI permissions** — GitHub Actions workflows use `permissions: contents: read` only
+- **Zero runtime dependencies** — only MCP SDK and Zod (both widely audited)
+
+To report a vulnerability, please email security@goklab.com or open a GitHub issue.
+
 ## License
 
 Apache 2.0 — open source, patent-safe, enterprise-ready. Built by [GokLab](https://github.com/goklab).

package/build/index.js

@@ -19,7 +19,7 @@ import { builtinRules } from "./data/rules/index.js";
 import { loadConfig } from "./utils/config.js";
 const server = new McpServer({
     name: "guardvibe",
-    version: "1.3.2",
+    version: "1.3.3",
 });
 // Tool 1: Analyze code for security vulnerabilities
 server.tool("check_code", "Analyze code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Use this when reviewing or writing code to catch security issues early.", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "Security MCP for vibe coding. 239 rules for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {
@@ -98,5 +98,8 @@
   },
   "engines": {
     "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "provenance": true
   }
 }