nsauditor-ai 0.2.1 → 0.2.2

package/README.md

@@ -17,15 +17,7 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.1 + Enterprise 0.18.0** (June 2026)
-
-- 🛡️ **GCP false-negative hardening** (Enterprise 0.18.0 — paired CE 0.2.1, docs-only) — five substrate-depth false-negative closures in the GCP auditors, all on already-covered controls (no new controls); the impersonation findings are now live-validated against a real GCP project (see below):
-  - **GCP evidence-gaps now fail their controls** — a denied GCP firewall / IAM / bucket enumeration (`AccessDenied`) now routes into the scan findings (single-owner anchors) and **FAILS** its controls instead of reading clean (was a compliance-layer false-CLEAN).
-  - **GCP project-IAM public-exposure detection now actually fires** — the project-IAM-public check was calling `getIamPolicy` on the wrong GCP client (the Compute `ProjectsClient`, which has no IAM methods), so it failed on every live scan and never detected a publicly-bound project IAM policy; it now reads the project IAM policy via the correct Resource Manager `ProjectsClient`, so `allUsers` / `allAuthenticatedUsers` project-level bindings are detected instead of perpetually evidence-gapping.
-  - **GCP IAM auditor now authenticates under pure ADC** — the GCP IAM auditor's `googleapis` IAM-admin client (which powers the custom-role audit, service-account-key custody, and the service-account impersonation graph) only set credentials for the impersonation / key-file paths; under plain Application Default Credentials it had **no** auth, and — unlike the `@google-cloud` clients, which auto-detect ADC — the `googleapis` REST library does not, so those deeper IAM dimensions returned `AccessDenied` and never ran even for a project owner. They now run under pure ADC via an explicit scoped credential. (Caught by the live test-infra smoke; same class as the project-IAM client fix above.)
-  - **Legacy-ACL public-exposure detection in GCP Cloud Storage** — a bucket made public via a **legacy ACL** (`allUsers` / `allAuthenticatedUsers`) while Uniform Bucket-Level Access is disabled was reading CLEAN; the auditor now scans the bucket ACL + a sampled object-ACL surface → CRITICAL / HIGH (routed to SOC 2 CC6.6 / HIPAA 164.312(a)(1) / CIS v8 3.3).
-  - **GCP IAM impersonation-BFS completeness** — project-scope `roles/iam.serviceAccountKeyAdmin` (mint a long-lived key for any service account = offline impersonation) now fires the project-scope impersonation CRITICAL, and a service account privileged via an **admin-equivalent custom role** (`iam.serviceAccounts.actAs`…) is now marked admin in the impersonation graph so paths terminating there are detected instead of reading clean. Both now fire **live** against a real owner-ADC GCP project (project-scope `serviceAccountKeyAdmin` CRITICAL + a custom-role-`actAs` SA reached over a `tokenCreator` edge).
-- 🌐 **`--aws-region` scoping + genuine multi-region fan-out** (CE 0.2.0 — paired EE 0.17.0) — a new `--aws-region <one|csv|all>` CLI flag (and a `regions` argument on the MCP `scan_cloud` tool) scopes an AWS audit to a single region, a CSV of regions, or every account-enabled region (`all`). The EE regional plugins now audit every in-scope region instead of only the configured one, and the S3 auditors resolve each bucket's own region — closing latent cross-region false-cleans. Precedence is `--aws-region` › `AWS_REGION` › single-region default; the no-flag default stays single-region (behaviour-preserving) and discloses any unscanned regions. Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED.
+**Latest: CE 0.2.2 + Enterprise 0.18.1** (June 2026) — paired docs release for EE 0.18.1: **GCP false-negative hardening II** (split-range firewall full-IPv4 coverage · IAM impersonation-graph completeness · default-object-ACL public exposure) + a **fleet-wide read-only enforcement guarantee** (a CI meta-test that makes it impossible to ship a mutating cloud API call across all 28 plugins) + the matching **read-only-credential requirement** (EULA §5.5). Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED — substrate-depth fixes on already-covered controls.
 
 → Full release history: **[CHANGELOG.md](./CHANGELOG.md)**
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,