nsauditor-ai 0.1.82 → 0.1.84

package/README.md

@@ -17,8 +17,10 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.1.82 + Enterprise 0.15.1** (May 2026)
+**Latest: CE 0.1.84 + Enterprise 0.15.3** (May 2026)
 
+- 🪣 **Object-level ACL enumeration + BucketOwnerEnforced short-circuit** (EE 0.15.3 — paired) — closes the 4th and final S3 public-exposure vector (object-level ACLs) documented as a residual in the 0.15.2 closure. Plugin 1020 gains NEW step 2c sampled `GetObjectAcl` enumeration over first-page objects (default cap 10; per-object throttle default 50ms) + NEW step 2a `GetBucketOwnershipControls` upstream short-circuit that skips both 2b (bucket-ACL) and 2c (object-ACL) on `BucketOwnerEnforced` buckets (the default since April 2023; saves 11+ API calls per BOE bucket on modern estates AND closes a false-positive class where BOE buckets with legacy stored public ACL grants previously emitted CRITICAL — they now emit informational because S3 structurally ignores ACL grants under BOE). **INTENTIONAL MATRIX DELTA from 0.15.2** on BOE buckets with pre-BOE legacy grants: CRITICAL → informational. NEW shared `extractPublicGroups` helper used by BOTH step 2b (refactored byte-identical) AND step 2c. 4 LOW evidence-gap emissions via NEW `"S3 object-ACL evidence-gap"` substring anchor on SOC 2 CC7.1 + HIPAA §164.312(b) (substrate-depth on already-covered controls; matrices unchanged). Live AWS smoke all 4 spot-checks PASS (BOE detection; E1 CRITICAL en-dash bytes preserved; cap clamping; objectRateMs throttling). Enterprise plugin count unchanged (28); all six coverage matrices unchanged.
+- 🎯 **Audit-accuracy calibration & CloudTrail hardening** (EE 0.15.2 — paired) — four real-production-account-driven folds: **(1)** plugin 1020 (S3) effective-public-exposure calibration — missing/partial Public Access Block downgraded CRITICAL→MEDIUM (guardrail gap, not current exposure) + NEW `GetBucketAcl` check completing the ACL×policy×PAB join (public AllUsers/AuthenticatedUsers grant → CRITICAL unless neutralized by PAB `IgnorePublicAcls`); **(2)** plugin 1040 (CloudTrail) KMS-CMK calibration — trail-level "KmsKeyId not set" downgraded MEDIUM→LOW when the destination bucket has default SSE-KMS; **(3)** plugin 1040 (CloudTrail) multi-region timeout hardening — an `AbortController` tied to the soft-budget deadline lets a hung disabled-region abort so the plugin finalizes PARTIAL evidence; **(4)** plugin 1221 (Azure NSG) +10 restricted UDP ports + plugin 1222 (Azure Key Vault) F-2 custom-role resolution + F-7.2 HSM dim. Enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - 🔧 **Azure Key Vault Deep auditor hotfix** (EE 0.15.1 — plugin 1222) — two defects surfaced by the 0.15.0 published-build smoke. **H-1**: the diagnostic-logging dim treated `@azure/arm-monitor`'s `diagnosticSettings.list()` as a paged async-iterator when it actually returns a `{value:[]}` collection object → the dim always degraded to a non-functional evidence-gap; now correctly `await`-ed and read via `.value` (confirmed against live Azure; the unit-test mock was the mock-vs-real-SDK mismatch that masked it). **H-2**: the privileged-access dim flagged inherited subscription/management-group-scope Owner/Contributor as HIGH on every RBAC vault — re-tuned so inherited Owner/User-Access-Admin → MEDIUM, inherited Contributor → LOW, with HIGH reserved for vault-scoped control-plane god roles + Key Vault Administrator. Additive bug-fix only; enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - ☁️ **NEW Azure Key Vault Deep auditor** (EE 0.15.0 — plugin 1222; enterprise plugin count 27 → 28) — the third dedicated Azure auditor (after 1220 storage + 1221 NSG), the Key Vault analog of how 1221 deepens the multi-purpose Azure scanner's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key auto-rotation policy, (2) key expiry, (3) diagnostic logging → Log Analytics, (4) privileged-access depth (RBAC role assignments + legacy access-policy breadth incl. export/wide-crypto). Orthogonal to the Azure scanner's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission; secret/cert expiry is a deliberate data-plane scope boundary. Findings route across all six frameworks (SOC 2 CC6.3/C1.1/CC6.1/CC7.2 / HIPAA / NIST CSF / PCI DSS / ISO 27001 / CIS v8) — all coverage matrices unchanged.
 - ☁️ **Azure NSG Perimeter auditor — UDP lane** (EE 0.14.1 — plugin 1221) — the perimeter auditor now tiers **UDP** management/amplification services (SNMP 161, CLDAP 389, NTP 123, rpcbind 111, IPMI 623, IKE 500, Memcached 11211, etc.), not just TCP — closing a false negative where a public-internet UDP service was silently treated as a benign "web tier" port. NEW Dim 2u/3u (UDP public-source + `::/0`), attachment-aware (CRITICAL effective / MEDIUM latent), per-transport priority/deny-override resolution; Dim-4 made protocol-aware. Plugin count unchanged (27); all six coverage matrices unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,