xploitscan 1.3.0 → 1.3.2

package/README.md

@@ -155,6 +155,14 @@ legacy/**              scanner
 For a single reviewed-and-accepted finding, prefer an inline
 `// VC<id>-OK: <reason>` comment instead of a file- or path-wide rule.
 
+**Where it is looked up.** Every `.xploitscanignore` between your project root
+and the directory being scanned applies, so `xploitscan scan packages/web/src`
+still honours the file at the top of the repo. Patterns are interpreted
+relative to the file that declares them — a root file naming
+`packages/web/src/lib/demo.ts` matches that file whether you scan the repo root
+or `packages/web/src` — and a nested file takes precedence over a broader rule
+above it, the same way `.gitignore` does.
+
 ### Vendored and generated code
 
 Some of what a scanner finds isn't code you wrote. AI app builders copy

package/dist/{api-AX6R4QAD.js → api-6FD27EJY.js}

@@ -14,7 +14,7 @@ import {
   storeToken,
   syncUser,
   uploadScanResults
-} from "./chunk-LWX7UPO5.js";
+} from "./chunk-2VDAYFPC.js";
 export {
   checkUsage,
   clearProRulesCache,
@@ -29,4 +29,4 @@ export {
   syncUser,
   uploadScanResults
 };
-//# sourceMappingURL=api-AX6R4QAD.js.map
+//# sourceMappingURL=api-6FD27EJY.js.map

package/dist/{chunk-LWX7UPO5.js → chunk-2VDAYFPC.js}

@@ -45942,6 +45942,17 @@ async function filterFalsePositives(findings, fileContents) {
         {
           model: "claude-haiku-4-5-20251001",
           max_tokens: 1024,
+          // Pinned, NOT left to the API default of 1.0. This is a binary
+          // classification (real vs. false positive), not generation — there
+          // is no upside to sampling variety and a real downside to it: a
+          // filtered finding is a finding the user never sees, so drift here
+          // means scanning the same unchanged code twice can yield different
+          // results. Temperature 0 does not make the model bit-deterministic
+          // (Anthropic makes no such guarantee), but it removes the one
+          // variance source that was ours to control. See
+          // scripts/fp-filter-repeatability.cjs for the measured flip rate,
+          // and the assertion in ai-fp-filter.test.ts that keeps it pinned.
+          temperature: 0,
           system: REVIEW_SYSTEM_PROMPT,
           messages: [{ role: "user", content: prompt }]
         },
@@ -46420,4 +46431,4 @@ export {
   loadCachedProRules,
   clearProRulesCache
 };
-//# sourceMappingURL=chunk-LWX7UPO5.js.map
+//# sourceMappingURL=chunk-2VDAYFPC.js.map