nsauditor-ai 0.1.83 → 0.1.85

package/README.md

@@ -17,8 +17,10 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.1.83 + Enterprise 0.15.2** (May 2026)
+**Latest: CE 0.1.85 + Enterprise 0.15.4** (May 2026)
 
+- 🪣 **Non-current-version ACL sampling + public WRITE-vs-READ differentiation** (EE 0.15.4 — paired) — closes the two residuals the 0.15.3 spec carried as deferred. Plugin 1020 gains NEW step 2c-v: on versioning-Enabled/Suspended buckets it samples **non-current** object versions (`ListObjectVersions` first-page, cap-bounded → per-version `GetObjectAcl({VersionId})`, delete-markers skipped) — catching a public ACL that survives on an **overwritten** version still downloadable via `?versionId=` after the current version is made private (CRITICAL via the existing `"publicly accessible"` anchor; PAB `IgnorePublicAcls` → LOW; skipped on `BucketOwnerEnforced`). NEW sibling helper `extractPublicWriteGroups` flags public WRITE/WRITE_ACP/FULL_CONTROL grants (anyone-can-overwrite) distinctly from READ-only, as an enrichment line on the already-CRITICAL finding at bucket/object/version ACL sites. `ListObjectVersions AccessDenied` (distinct `s3:ListBucketVersions` action) + a `GetBucketVersioning AccessDenied` review-fold both degrade to routed LOW evidence-gaps via the existing `"S3 object-ACL evidence-gap"` anchor — never a silent PASS. **Enterprise plugin count UNCHANGED (28); all six coverage matrices UNCHANGED; ZERO framework-JSON edits.** TDD-first, +27 tests; EE regression 6628/6628 GREEN. _(Staged on `main`; awaiting live smoke + trio publish.)_
+- 🪣 **Object-level ACL enumeration + BucketOwnerEnforced short-circuit** (EE 0.15.3 — paired) — closes the 4th and final S3 public-exposure vector (object-level ACLs) documented as a residual in the 0.15.2 closure. Plugin 1020 gains NEW step 2c sampled `GetObjectAcl` enumeration over first-page objects (default cap 10; per-object throttle default 50ms) + NEW step 2a `GetBucketOwnershipControls` upstream short-circuit that skips both 2b (bucket-ACL) and 2c (object-ACL) on `BucketOwnerEnforced` buckets (the default since April 2023; saves 11+ API calls per BOE bucket on modern estates AND closes a false-positive class where BOE buckets with legacy stored public ACL grants previously emitted CRITICAL — they now emit informational because S3 structurally ignores ACL grants under BOE). **INTENTIONAL MATRIX DELTA from 0.15.2** on BOE buckets with pre-BOE legacy grants: CRITICAL → informational. NEW shared `extractPublicGroups` helper used by BOTH step 2b (refactored byte-identical) AND step 2c. 4 LOW evidence-gap emissions via NEW `"S3 object-ACL evidence-gap"` substring anchor on SOC 2 CC7.1 + HIPAA §164.312(b) (substrate-depth on already-covered controls; matrices unchanged). Live AWS smoke all 4 spot-checks PASS (BOE detection; E1 CRITICAL en-dash bytes preserved; cap clamping; objectRateMs throttling). Enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - 🎯 **Audit-accuracy calibration & CloudTrail hardening** (EE 0.15.2 — paired) — four real-production-account-driven folds: **(1)** plugin 1020 (S3) effective-public-exposure calibration — missing/partial Public Access Block downgraded CRITICAL→MEDIUM (guardrail gap, not current exposure) + NEW `GetBucketAcl` check completing the ACL×policy×PAB join (public AllUsers/AuthenticatedUsers grant → CRITICAL unless neutralized by PAB `IgnorePublicAcls`); **(2)** plugin 1040 (CloudTrail) KMS-CMK calibration — trail-level "KmsKeyId not set" downgraded MEDIUM→LOW when the destination bucket has default SSE-KMS; **(3)** plugin 1040 (CloudTrail) multi-region timeout hardening — an `AbortController` tied to the soft-budget deadline lets a hung disabled-region abort so the plugin finalizes PARTIAL evidence; **(4)** plugin 1221 (Azure NSG) +10 restricted UDP ports + plugin 1222 (Azure Key Vault) F-2 custom-role resolution + F-7.2 HSM dim. Enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - 🔧 **Azure Key Vault Deep auditor hotfix** (EE 0.15.1 — plugin 1222) — two defects surfaced by the 0.15.0 published-build smoke. **H-1**: the diagnostic-logging dim treated `@azure/arm-monitor`'s `diagnosticSettings.list()` as a paged async-iterator when it actually returns a `{value:[]}` collection object → the dim always degraded to a non-functional evidence-gap; now correctly `await`-ed and read via `.value` (confirmed against live Azure; the unit-test mock was the mock-vs-real-SDK mismatch that masked it). **H-2**: the privileged-access dim flagged inherited subscription/management-group-scope Owner/Contributor as HIGH on every RBAC vault — re-tuned so inherited Owner/User-Access-Admin → MEDIUM, inherited Contributor → LOW, with HIGH reserved for vault-scoped control-plane god roles + Key Vault Administrator. Additive bug-fix only; enterprise plugin count unchanged (28); all six coverage matrices unchanged.
 - ☁️ **NEW Azure Key Vault Deep auditor** (EE 0.15.0 — plugin 1222; enterprise plugin count 27 → 28) — the third dedicated Azure auditor (after 1220 storage + 1221 NSG), the Key Vault analog of how 1221 deepens the multi-purpose Azure scanner's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key auto-rotation policy, (2) key expiry, (3) diagnostic logging → Log Analytics, (4) privileged-access depth (RBAC role assignments + legacy access-policy breadth incl. export/wide-crypto). Orthogonal to the Azure scanner's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission; secret/cert expiry is a deliberate data-plane scope boundary. Findings route across all six frameworks (SOC 2 CC6.3/C1.1/CC6.1/CC7.2 / HIPAA / NIST CSF / PCI DSS / ISO 27001 / CIS v8) — all coverage matrices unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.83",
+  "version": "0.1.85",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,