iam-policy-validator 1.14.7__tar.gz → 1.15.1__tar.gz

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
           python-version: "${{ env.DEFAULT_PYTHON_VERSION }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
 
@@ -56,7 +56,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
 
@@ -80,7 +80,7 @@ jobs:
           python-version: "${{ env.DEFAULT_PYTHON_VERSION }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
 
@@ -104,7 +104,7 @@ jobs:
           python-version: "${{ env.DEFAULT_PYTHON_VERSION }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
 

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.github/workflows/codeql.yml

@@ -29,15 +29,15 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
+        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
         with:
           languages: ${{ matrix.language }}
           queries: security-extended,security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
+        uses: github/codeql-action/autobuild@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
+        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
         with:
           category: "/language:${{matrix.language}}"

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.github/workflows/docs.yml

@@ -63,7 +63,7 @@ jobs:
       # actions/upload-pages-artifact v3.0.1
       - name: Upload artifact
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: ./site
 

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.github/workflows/pre-release.yml

@@ -80,7 +80,7 @@ jobs:
           python-version: ${{ inputs.python_version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
 

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
           enable-cache: true
 

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.github/workflows/scorecard.yml

@@ -57,6 +57,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
         with:
           sarif_file: results.sarif

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/.gitignore

@@ -84,3 +84,6 @@ coverage.xml
 
 # AWS service definitions (download with: iam-validator download-services)
 aws_services/
+
+.mcp.json
+.serena

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/CHANGELOG.md

@@ -8,14 +8,103 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Planned
-- NotAction/NotResource validation support
+
 - Enhanced PR comment management with configurable limits
 
 ---
 
+## [1.15.0] - 2025-01-22
+
+### Added
+
+**MCP Server Integration**
+
+- Full FastMCP server with 25+ tools for AI assistants (`iam-validator mcp` command)
+- Standalone `iam-validator-mcp` entry point for easy integration
+- Policy validation, generation, and AWS service querying tools
+- 15 built-in secure policy templates for common use cases
+- Session-wide organization configuration management
+- MCP Prompts for guided workflows (generate_secure_policy, fix_policy_issues_workflow, review_policy_security)
+- Custom instructions support via YAML config, environment variable, CLI, or MCP tools
+- Comprehensive MCP documentation with usage examples
+
+**New Security Check**
+
+- `not_action_not_resource` check for detecting dangerous NotAction/NotResource patterns (high severity)
+
+**Query Command Enhancements**
+
+- Support multiple actions in single query (`--name s3:GetObject dynamodb:Query`)
+- Wildcard pattern expansion (`--name "iam:Get*"` or `--name "s3:*Object*"`)
+- Field filter options: `--show-condition-keys`, `--show-resource-types`, `--show-access-level`
+- Allow service prefix in `--name`, making `--service` optional (`--name s3:GetObject`)
+- Deduplicate results when querying overlapping patterns
+
+**Validation Improvements**
+
+- `action_validation` now validates wildcard patterns (e.g., `s3:Get*`) to ensure they match real AWS actions
+- `action_validation` now validates NotAction field
+- `resource_validation` now validates NotResource field
+- `wildcard_resource` check has condition-aware severity adjustment:
+  - MEDIUM → LOW when global resource-scoping conditions present (aws:ResourceAccount, aws:ResourceOrgID, aws:ResourceOrgPaths)
+  - MEDIUM → LOW when aws:ResourceTag/\* conditions are used AND all actions support the condition key
+
+**Configuration**
+
+- Add `hide_severities` option for severity-based finding filtering (global and per-check)
+- Add `iam-policy-validator` CLI alias matching PyPI package name
+
+**Cache Improvements**
+
+- Cache refresh now updates all cached services (not just common ones)
+- Expired cache files are kept for refresh instead of deleted
+- Stale cache fallback when AWS API fails for graceful degradation
+
+**SDK**
+
+- Export `extract_condition_keys_from_statement()` in public API
+- Add `is_condition_key_supported()` to AWSServiceFetcher
+
+### Changed
+
+- Development status upgraded to Production/Stable
+- Batch operations use `asyncio.gather()` for parallel execution
+- Template listing includes full variable metadata (name, description, required)
+- Simplified condition key pattern matching for tag-key placeholders (forward-compatible)
+- Test suite consolidated using `@pytest.mark.parametrize` (919 → 850 tests)
+
+### Fixed
+
+- Support parameterized condition key patterns like `s3:RequestObjectTag/<key>`
+- MCP tests skip properly when fastmcp is not installed
+- Improved loop prevention guidance for LLM clients
+
+### Dependencies
+
+- fastmcp as optional dependency (install with `[mcp]` extra)
+- Updated CI dependencies (actions/cache, codeql-action, setup-uv, upload-pages-artifact)
+
+---
+
+## [1.14.7] - 2025-12-17
+
+### Added
+
+- MkDocs documentation site deployed to GitHub Pages
+- Comprehensive SDK API reference documentation
+
+### Fixed
+
+- Correct repository name in all documentation links (iam-policy-auditor → iam-policy-validator)
+- Fix SDK docstring formatting for proper mkdocstrings rendering
+- Update PyPI metadata with correct documentation and changelog URLs
+
+---
+
 ## [1.14.6] - 2025-12-15
 
 ### Fixed
+
 - Separate security findings from validity errors in PR comments
 - Respect ignored findings when managing PR labels and review state
 
@@ -24,6 +113,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.5] - 2025-12-15
 
 ### Fixed
+
 - Respect ignored findings when managing PR labels and review state
 
 ---
@@ -31,6 +121,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.4] - 2025-12-12
 
 ### Fixed
+
 - Show pass status and list ignored findings in summary when all blocking issues are ignored
 
 ---
@@ -38,6 +129,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.3] - 2025-12-12
 
 ### Fixed
+
 - Add pattern matching for service-specific condition keys with tag validation
 
 ---
@@ -45,6 +137,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.2] - 2025-12-12
 
 ### Fixed
+
 - Use APPROVE review event when validation passes to dismiss REQUEST_CHANGES
 
 ---
@@ -52,10 +145,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.1] - 2025-12-11
 
 ### Fixed
+
 - Enhanced SARIF formatter with dynamic rules and rich context
 - Improved finding fingerprints for better PR comment deduplication
 
 ### Changed
+
 - Updated dependencies (setup-uv, actions/checkout, codeql-action)
 
 ---
@@ -63,11 +158,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.0] - 2024-12-10
 
 ### Added
+
 - Enhanced PR comments with fingerprint-based matching
 - Finding ignore system via PR comment replies
 - Improved review comment deduplication
 
 ### Changed
+
 - Better production readiness for GitHub Action integration
 
 ---
@@ -75,6 +172,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.13.1] - 2024-12
 
 ### Fixed
+
 - Bug fixes and stability improvements
 
 ---
@@ -82,6 +180,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.13.0] - 2024-12
 
 ### Added
+
 - Query command for exploring AWS service definitions
 - Shell completion support (bash, zsh, fish)
 
@@ -90,10 +189,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.12.0] - 2024-11
 
 ### Added
+
 - Trust policy validation check
 - Enhanced condition type mismatch detection
 
 ### Changed
+
 - Improved AWS service fetcher performance
 
 ---
@@ -101,10 +202,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.11.0] - 2024-11
 
 ### Added
+
 - Action-resource matching validation
 - Set operator validation for conditions (ForAllValues/ForAnyValue)
 
 ### Changed
+
 - Expanded sensitive actions database (490+ actions)
 
 ---
@@ -112,10 +215,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.10.0] - 2024-10
 
 ### Added
+
 - MFA condition check for sensitive operations
 - Condition key validation improvements
 
 ### Changed
+
 - Better error messages for validation failures
 
 ---
@@ -123,6 +228,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.9.0] - 2024-10
 
 ### Added
+
 - GitHub PR review comments (inline comments on changed lines)
 - Multiple output formats (JSON, SARIF, CSV, HTML, Markdown)
 
@@ -131,6 +237,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.8.0] - 2024-09
 
 ### Added
+
 - AWS Access Analyzer integration
 - Offline validation mode with pre-downloaded service definitions
 
@@ -139,10 +246,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.7.0] - 2024-09
 
 ### Added
+
 - Custom checks support via `--custom-checks-dir`
 - Configuration file support (`iam-validator.yaml`)
 
 ### Changed
+
 - Modular check architecture
 
 ---
@@ -150,6 +259,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.6.0] - 2024-08
 
 ### Added
+
 - Service Control Policy (SCP) validation
 - Principal validation for resource policies
 
@@ -158,17 +268,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.5.0] - 2024-08
 
 ### Added
+
 - Modular Python configuration system (5-10x faster startup)
 - Split security checks into individual modules:
-  - `wildcard_action` - Wildcard actions (Action: "*")
-  - `wildcard_resource` - Wildcard resources (Resource: "*")
-  - `service_wildcard` - Service-level wildcards (e.g., "s3:*")
+  - `wildcard_action` - Wildcard actions (Action: "\*")
+  - `wildcard_resource` - Wildcard resources (Resource: "\*")
+  - `service_wildcard` - Service-level wildcards (e.g., "s3:\*")
   - `sensitive_action` - Sensitive actions without conditions
-  - `full_wildcard` - Action:* + Resource:* (critical)
+  - `full_wildcard` - Action:_ + Resource:_ (critical)
 - GitHub Action RESOURCE_CONTROL_POLICY support
 - GitHub Actions job summary output
 
 ### Changed
+
 - Comprehensive documentation overhaul
 
 ---
@@ -176,9 +288,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.4.0] - 2024-07
 
 ### Added
+
 - Resource Control Policy (RCP) support with 8 validation checks
 - Enhanced principal validation:
-  - Blocked principals (e.g., public access "*")
+  - Blocked principals (e.g., public access "\*")
   - Allowed principals whitelist
   - Required conditions for specific principals
   - Service principal validation
@@ -190,6 +303,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.3.0] - 2024-06
 
 ### Added
+
 - Modular Python configuration system
 - Condition requirement templates
 - Action condition enforcement check
@@ -199,6 +313,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.2.0] - 2024-05
 
 ### Added
+
 - Smart IAM policy detection and filtering
 - YAML policy support
 - Streaming mode for large policy sets
@@ -208,6 +323,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.1.0] - 2024-04
 
 ### Added
+
 - Split security checks into individual modules
 - Configurable check system
 - Per-check severity overrides
@@ -217,6 +333,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.0] - 2024-03
 
 ### Added
+
 - Initial release
 - Core IAM policy validation engine
 - AWS service definition fetching with caching
@@ -236,11 +353,11 @@ This project follows [Semantic Versioning](https://semver.org/):
 
 ### Supported Versions
 
-| Version | Support Status        |
-| ------- | --------------------- |
-| 1.14.x  | ✅ Active development  |
-| 1.13.x  | ⚠️ Critical fixes only |
-| < 1.13  | ❌ End of life         |
+| Version | Support Status         |
+| ------- | ---------------------- |
+| 1.15.x  | ✅ Active development  |
+| 1.14.x  | ⚠️ Critical fixes only |
+| < 1.14  | ❌ End of life         |
 
 ### Deprecation Policy
 
@@ -257,6 +374,7 @@ This project follows [Semantic Versioning](https://semver.org/):
 The modular configuration system introduced in v1.5.0 changed how checks are configured:
 
 **Before (v1.4.x):**
+
 ```yaml
 checks:
   wildcard: high
@@ -264,6 +382,7 @@ checks:
 ```
 
 **After (v1.5.0+):**
+
 ```yaml
 wildcard_action:
   enabled: true
@@ -285,7 +404,9 @@ iam-validator validate --policy-type RESOURCE_CONTROL_POLICY policies/
 
 ---
 
-[Unreleased]: https://github.com/boogy/iam-policy-validator/compare/v1.14.6...HEAD
+[Unreleased]: https://github.com/boogy/iam-policy-validator/compare/v1.15.0...HEAD
+[1.15.0]: https://github.com/boogy/iam-policy-validator/compare/v1.14.7...v1.15.0
+[1.14.7]: https://github.com/boogy/iam-policy-validator/compare/v1.14.6...v1.14.7
 [1.14.6]: https://github.com/boogy/iam-policy-validator/compare/v1.14.5...v1.14.6
 [1.14.5]: https://github.com/boogy/iam-policy-validator/compare/v1.14.4...v1.14.5
 [1.14.4]: https://github.com/boogy/iam-policy-validator/compare/v1.14.3...v1.14.4

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: help install dev clean test lint format ruff type-check build publish publish-test version sync-defaults
+.PHONY: help install dev clean test lint format ruff type-check build publish publish-test version sync-defaults docs docs-serve mcp-inspector
 
 # Default target
 help:
@@ -27,6 +27,13 @@ help:
 	@echo "Examples:"
 	@echo "  make validate-example Run validator on example policies"
 	@echo ""
+	@echo "Documentation:"
+	@echo "  make docs             Build documentation"
+	@echo "  make docs-serve       Serve documentation locally (http://localhost:8000)"
+	@echo ""
+	@echo "MCP Server:"
+	@echo "  make mcp-inspector    Start MCP Inspector for debugging"
+	@echo ""
 	@echo "AWS Services Backup:"
 	@echo "  make download-aws-services Download all AWS service definitions"
 
@@ -121,3 +128,14 @@ download-aws-services:
 # CI/CD simulation
 ci: check build
 	@echo "✓ CI checks complete!"
+
+# Documentation
+docs:
+	@uv run --extra docs mkdocs build
+
+docs-serve:
+	@uv run --extra docs mkdocs serve -w docs/
+
+# MCP Server debugging
+mcp-inspector:
+	@npx @modelcontextprotocol/inspector uv run --directory $(CURDIR) --extra mcp iam-validator-mcp

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.14.7
+Version: 1.15.1
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://boogy.github.io/iam-policy-validator
@@ -11,7 +11,7 @@ Author-email: boogy <0xboogy@gmail.com>
 License: MIT
 License-File: LICENSE
 Keywords: aws,github-action,iam,policy,security,validation
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
 Classifier: License :: OSI Approved :: MIT License
@@ -19,6 +19,8 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Systems Administration
@@ -44,6 +46,8 @@ Requires-Dist: mkdocs-literate-nav>=0.6.0; extra == 'docs'
 Requires-Dist: mkdocs-material>=9.5.0; extra == 'docs'
 Requires-Dist: mkdocs>=1.6.0; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == 'docs'
+Provides-Extra: mcp
+Requires-Dist: fastmcp>=2.14.1; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # IAM Policy Validator
@@ -55,6 +59,8 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/boogy/iam-policy-validator/badge)](https://scorecard.dev/viewer/?uri=github.com/boogy/iam-policy-validator)
 
+**[📖 Full Documentation](https://boogy.github.io/iam-policy-validator/)**
+
 ---
 
 ## Why This Tool Exists
@@ -434,15 +440,14 @@ Validates against official AWS IAM requirements:
 
 Identifies overly permissive configurations:
 
-| Check                                 | What It Catches                                        |
-| ------------------------------------- | ------------------------------------------------------ |
-| **Wildcard Action**                   | `Action: "*"` grants all AWS permissions               |
-| **Wildcard Resource**                 | `Resource: "*"` applies to all resources               |
-| **Full Wildcard**                     | Both `Action: "*"` AND `Resource: "*"` (admin access)  |
-| **Service Wildcards**                 | `s3:*`, `iam:*`, `ec2:*` (overly broad)                |
-| **Sensitive Actions (Policy-Wide)**   | **Cross-statement** privilege escalation patterns      |
-| **Sensitive Actions (Per-Statement)** | Dangerous actions in single statement                  |
-| **Condition Enforcement**             | Organization-specific requirements (your custom rules) |
+| Check                     | What It Catches                                        |
+| ------------------------- | ------------------------------------------------------ |
+| **Wildcard Action**       | `Action: "*"` grants all AWS permissions               |
+| **Wildcard Resource**     | `Resource: "*"` applies to all resources               |
+| **Full Wildcard**         | Both `Action: "*"` AND `Resource: "*"` (admin access)  |
+| **Service Wildcards**     | `s3:*`, `iam:*`, `ec2:*` (overly broad)                |
+| **Sensitive Actions**     | 490+ privilege escalation patterns and dangerous actions |
+| **Condition Enforcement** | Organization-specific condition requirements           |
 
 **Note on Sensitive Actions:** This check has two modes:
 

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/README.md

@@ -7,6 +7,8 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/boogy/iam-policy-validator/badge)](https://scorecard.dev/viewer/?uri=github.com/boogy/iam-policy-validator)
 
+**[📖 Full Documentation](https://boogy.github.io/iam-policy-validator/)**
+
 ---
 
 ## Why This Tool Exists
@@ -386,15 +388,14 @@ Validates against official AWS IAM requirements:
 
 Identifies overly permissive configurations:
 
-| Check                                 | What It Catches                                        |
-| ------------------------------------- | ------------------------------------------------------ |
-| **Wildcard Action**                   | `Action: "*"` grants all AWS permissions               |
-| **Wildcard Resource**                 | `Resource: "*"` applies to all resources               |
-| **Full Wildcard**                     | Both `Action: "*"` AND `Resource: "*"` (admin access)  |
-| **Service Wildcards**                 | `s3:*`, `iam:*`, `ec2:*` (overly broad)                |
-| **Sensitive Actions (Policy-Wide)**   | **Cross-statement** privilege escalation patterns      |
-| **Sensitive Actions (Per-Statement)** | Dangerous actions in single statement                  |
-| **Condition Enforcement**             | Organization-specific requirements (your custom rules) |
+| Check                     | What It Catches                                        |
+| ------------------------- | ------------------------------------------------------ |
+| **Wildcard Action**       | `Action: "*"` grants all AWS permissions               |
+| **Wildcard Resource**     | `Resource: "*"` applies to all resources               |
+| **Full Wildcard**         | Both `Action: "*"` AND `Resource: "*"` (admin access)  |
+| **Service Wildcards**     | `s3:*`, `iam:*`, `ec2:*` (overly broad)                |
+| **Sensitive Actions**     | 490+ privilege escalation patterns and dangerous actions |
+| **Condition Enforcement** | Organization-specific condition requirements           |
 
 **Note on Sensitive Actions:** This check has two modes:
 

{iam_policy_validator-1.14.7 → iam_policy_validator-1.15.1}/SECURITY.md

@@ -182,7 +182,7 @@ When contributing to the project:
 
 The validator includes security features to help users:
 
-1. **18 Built-in Security Checks**: Detect overly permissive policies, privilege escalation paths, and security anti-patterns
+1. **19 Built-in Security Checks**: Detect overly permissive policies, privilege escalation paths, and security anti-patterns
 2. **AWS Access Analyzer Integration**: Leverage AWS's official policy validation service
 3. **Privilege Escalation Detection**: Identify dangerous action combinations
 4. **Public Access Detection**: Check 29+ AWS resource types for public exposure
@@ -190,31 +190,6 @@ The validator includes security features to help users:
 6. **Policy Comparison**: Detect new permissions vs baseline to prevent scope creep
 7. **Wildcard Detection**: Flag overly permissive wildcards in actions and resources
 
-## Vulnerability Disclosure Policy
-
-### Scope
-
-Security vulnerabilities within scope:
-
-- **In Scope**:
-  - Authentication and authorization bypass
-  - Code injection vulnerabilities
-  - Sensitive data exposure
-  - Denial of service (DoS)
-  - AWS credential leakage
-  - GitHub token leakage
-  - Path traversal vulnerabilities
-  - Dependency vulnerabilities with active exploits
-  - Logic errors in security checks that could miss vulnerabilities
-
-- **Out of Scope**:
-  - Social engineering attacks
-  - Physical attacks
-  - Attacks requiring physical access to infrastructure
-  - Issues in third-party dependencies without active exploits
-  - Issues already reported and known
-  - Self-XSS or CSP bypasses without security impact
-
 ### Safe Harbor
 
 We support safe harbor for security researchers who:
@@ -224,26 +199,6 @@ We support safe harbor for security researchers who:
 - Do not exploit vulnerabilities for malicious purposes
 - Follow responsible disclosure practices
 
-## Security Audit History
-
-We welcome third-party security audits and will list notable audits here:
-
-- No formal audits completed yet (as of v1.7.0)
-
-## Security-Related Configuration
-
-### Logging Levels
-
-Be cautious with logging levels in production:
-
-```bash
-# ⚠️ WARNING: Debug logging may expose sensitive policy content
---log-level debug  # Only use for troubleshooting
-
-# ✅ RECOMMENDED: Use warning or error in production
---log-level warning
-```
-
 ### GitHub Integration
 
 Configure minimal permissions for GitHub Actions:
@@ -286,5 +241,5 @@ _Thank you to the following researchers who have helped improve the security of
 
 ---
 
-**Last Updated**: 2025-11-10
-**Policy Version**: 1.0
+**Last Updated**: 2026-01-19
+**Policy Version**: 1.1