nsauditor-ai 0.2.0 → 0.2.1

package/README.md

@@ -17,8 +17,14 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.0 + Enterprise 0.17.0** (June 2026)
-
+**Latest: CE 0.2.1 + Enterprise 0.18.0** (June 2026)
+
+- 🛡️ **GCP false-negative hardening** (Enterprise 0.18.0 — paired CE 0.2.1, docs-only) — five substrate-depth false-negative closures in the GCP auditors, all on already-covered controls (no new controls); the impersonation findings are now live-validated against a real GCP project (see below):
+  - **GCP evidence-gaps now fail their controls** — a denied GCP firewall / IAM / bucket enumeration (`AccessDenied`) now routes into the scan findings (single-owner anchors) and **FAILS** its controls instead of reading clean (was a compliance-layer false-CLEAN).
+  - **GCP project-IAM public-exposure detection now actually fires** — the project-IAM-public check was calling `getIamPolicy` on the wrong GCP client (the Compute `ProjectsClient`, which has no IAM methods), so it failed on every live scan and never detected a publicly-bound project IAM policy; it now reads the project IAM policy via the correct Resource Manager `ProjectsClient`, so `allUsers` / `allAuthenticatedUsers` project-level bindings are detected instead of perpetually evidence-gapping.
+  - **GCP IAM auditor now authenticates under pure ADC** — the GCP IAM auditor's `googleapis` IAM-admin client (which powers the custom-role audit, service-account-key custody, and the service-account impersonation graph) only set credentials for the impersonation / key-file paths; under plain Application Default Credentials it had **no** auth, and — unlike the `@google-cloud` clients, which auto-detect ADC — the `googleapis` REST library does not, so those deeper IAM dimensions returned `AccessDenied` and never ran even for a project owner. They now run under pure ADC via an explicit scoped credential. (Caught by the live test-infra smoke; same class as the project-IAM client fix above.)
+  - **Legacy-ACL public-exposure detection in GCP Cloud Storage** — a bucket made public via a **legacy ACL** (`allUsers` / `allAuthenticatedUsers`) while Uniform Bucket-Level Access is disabled was reading CLEAN; the auditor now scans the bucket ACL + a sampled object-ACL surface → CRITICAL / HIGH (routed to SOC 2 CC6.6 / HIPAA 164.312(a)(1) / CIS v8 3.3).
+  - **GCP IAM impersonation-BFS completeness** — project-scope `roles/iam.serviceAccountKeyAdmin` (mint a long-lived key for any service account = offline impersonation) now fires the project-scope impersonation CRITICAL, and a service account privileged via an **admin-equivalent custom role** (`iam.serviceAccounts.actAs`…) is now marked admin in the impersonation graph so paths terminating there are detected instead of reading clean. Both now fire **live** against a real owner-ADC GCP project (project-scope `serviceAccountKeyAdmin` CRITICAL + a custom-role-`actAs` SA reached over a `tokenCreator` edge).
 - 🌐 **`--aws-region` scoping + genuine multi-region fan-out** (CE 0.2.0 — paired EE 0.17.0) — a new `--aws-region <one|csv|all>` CLI flag (and a `regions` argument on the MCP `scan_cloud` tool) scopes an AWS audit to a single region, a CSV of regions, or every account-enabled region (`all`). The EE regional plugins now audit every in-scope region instead of only the configured one, and the S3 auditors resolve each bucket's own region — closing latent cross-region false-cleans. Precedence is `--aws-region` › `AWS_REGION` › single-region default; the no-flag default stays single-region (behaviour-preserving) and discloses any unscanned regions. Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED.
 
 → Full release history: **[CHANGELOG.md](./CHANGELOG.md)**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,