Skip to main content

Changelog

Track tagged releases on GitHub Releases.

v0.3.0: deep C/C++ rule coverage

  • Expand OpenSSL/libcrypto C rules (RSA, EC/ECDSA/ECDH, DSA/DH, AES, ChaCha20, digests, EVP generics)
  • Add libsodium and mbedTLS C rule packs
  • Add Crypto++ and Botan C++ identifier packs; remove duplicate cpp OpenSSL rules (c packs already apply to C++)
  • C/C++ match.package is an ecosystem tag so non-OpenSSL C APIs match unqualified calls
  • Positive and negative fixtures for every C/C++ rule

v0.2.1 — embedded default rule packs

  • Embed default rules/ (source packs + library catalog) in the binary via go:embed
  • Scans work from any working directory with release binaries and go install — no adjacent source checkout required
  • On-disk rules/ found by walking up from cwd still takes precedence (local edits without rebuild)
  • --rules loads additional rule-pack directories after the defaults
  • Fixes scan: rules/libraries/catalog.yaml not found for standalone binaries

v0.2.0 — public HTTPS remote scan

  • Scan public HTTPS git URLs via shallow git clone (requires git on PATH)
  • SSH and private/authenticated remotes remain roadmap
  • Docs and install pins updated for v0.2.0

v0.1.x — inventory complete

  • Four detectors (source, dependencies, certificates, configuration)
  • Correlation, classification, and four-axis risk scoring
  • Outputs: CycloneDX CBOM, SARIF, Markdown, JSON
  • GitHub Action with optional SARIF upload and --fail-on
Interfaces may still evolve before 1.0.