nsauditor-ai 0.2.28 → 0.2.29

package/README.md

@@ -17,7 +17,7 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**GRC-push startup preflight + RDS cluster-level SSL enforcement (CE 0.2.28 / Enterprise 0.32.3).** The CE CLI now **fails fast** on a bad GRC configuration — a wrong token, control-map, or provider is caught at scan **startup** (before the full multi-region scan) instead of only at push time, a real per-org fix for MSP/MSSP operators. Paired Enterprise 0.32.3 is a **matrix-neutral** RDS false-negative depth pass: plugin 1140 now audits the Aurora **cluster** parameter group (`DescribeDBClusterParameters`), closing a cleartext false-negative on **instance-less Aurora Serverless v1** clusters the instance-level SSL check never saw, and applies **staged-parameter (`ParameterApplyStatus`) discipline** so a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective. No new plugins, all seven coverage matrices unchanged. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
+**RDS false-negative depth pass, part 2 (CE 0.2.29 / Enterprise 0.32.4).** No CE code change this cycle — a paired bump for Enterprise 0.32.4, a **matrix-neutral** RDS false-negative-and-report-quality depth pass on plugin 1140: **RDS Proxy client↔proxy TLS** (a proxy with `RequireTLS` off accepts cleartext client connections — a transit leg distinct from the DB-engine SSL parameter — now a fail-closed HIGH), a new **retained / cross-region-replicated automated-backup at-rest surface** (an unencrypted automated backup that survives instance/cluster deletion, invisible to the live-resource and snapshot scans, is now caught), the **Aurora cluster-member double-audit closure** (a provisioned Aurora cluster's members no longer double-report the cluster-scoped SSL / Multi-AZ settings as instance-level false positives), and a **cross-framework report-quality leak closure** (a renderer backstop strips foreign framework control-ids out of the violation prose that renders into every framework report). No new plugins, all seven coverage matrices unchanged. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
 
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,