nsauditor-ai 0.1.81 → 0.1.82

package/README.md

@@ -17,8 +17,9 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.1.81 + Enterprise 0.15.0** (May 2026)
+**Latest: CE 0.1.82 + Enterprise 0.15.1** (May 2026)
 
+- 🔧 **Azure Key Vault Deep auditor hotfix** (EE 0.15.1 — plugin 1222) — two defects surfaced by the 0.15.0 published-build smoke. **H-1**: the diagnostic-logging dim treated `@azure/arm-monitor`'s `diagnosticSettings.list()` as a paged async-iterator when it actually returns a `{value:[]}` collection object → the dim always degraded to a non-functional evidence-gap; now correctly `await`-ed and read via `.value` (confirmed against live Azure; the unit-test mock was the mock-vs-real-SDK mismatch that masked it). **H-2**: the privileged-access dim flagged inherited subscription/management-group-scope Owner/Contributor as HIGH on every RBAC vault — re-tuned so inherited Owner/User-Access-Admin → MEDIUM, inherited Contributor → LOW, with HIGH reserved for vault-scoped control-plane god roles + Key Vault Administrator. Additive bug-fix only; enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - ☁️ **NEW Azure Key Vault Deep auditor** (EE 0.15.0 — plugin 1222; enterprise plugin count 27 → 28) — the third dedicated Azure auditor (after 1220 storage + 1221 NSG), the Key Vault analog of how 1221 deepens the multi-purpose Azure scanner's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key auto-rotation policy, (2) key expiry, (3) diagnostic logging → Log Analytics, (4) privileged-access depth (RBAC role assignments + legacy access-policy breadth incl. export/wide-crypto). Orthogonal to the Azure scanner's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission; secret/cert expiry is a deliberate data-plane scope boundary. Findings route across all six frameworks (SOC 2 CC6.3/C1.1/CC6.1/CC7.2 / HIPAA / NIST CSF / PCI DSS / ISO 27001 / CIS v8) — all coverage matrices unchanged.
 - ☁️ **Azure NSG Perimeter auditor — UDP lane** (EE 0.14.1 — plugin 1221) — the perimeter auditor now tiers **UDP** management/amplification services (SNMP 161, CLDAP 389, NTP 123, rpcbind 111, IPMI 623, IKE 500, Memcached 11211, etc.), not just TCP — closing a false negative where a public-internet UDP service was silently treated as a benign "web tier" port. NEW Dim 2u/3u (UDP public-source + `::/0`), attachment-aware (CRITICAL effective / MEDIUM latent), per-transport priority/deny-override resolution; Dim-4 made protocol-aware. Plugin count unchanged (27); all six coverage matrices unchanged.
 - ☁️ **NEW Azure NSG Perimeter auditor** (EE 0.14.0 — plugin 1221; enterprise plugin count 26 → 27) — the Azure analog of AWS plugin 1170, a CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups. Evaluates each NSG's inbound rules in Azure priority order (first match wins; DenyAllInbound default): all-protocol public Allow, public-source (`*`/`0.0.0.0/0`/`Internet`) to restricted management/data-tier ports (SSH/RDP/databases/etc.), `::/0` IPv6-wildcard (the dimension the multi-purpose Azure scanner misses), with **attachment-aware severity** (attached to a subnet/NIC → CRITICAL effective exposure; orphaned → MEDIUM latent), effective priority/deny-override resolution, and `0.0.0.0/1` split-range coverage. Findings route across all six frameworks (SOC 2 CC6.6 / HIPAA / NIST CSF / PCI DSS / ISO 27001 / CIS v8) — all coverage matrices unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.81",
+  "version": "0.1.82",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,