Skip to content

Chameleon

v2.33.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions
+12 more
code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Affected surfaces

auth

Summary

AI summary

Fixed inconsistent arming of the Stop backstop for non-code files after reaching correction limits.

Full changelog

Fixed

  • The corrections-exhausted breaker no longer arms the Stop backstop on a
    non-code file's credential.     Once a file is corrected
    MAX_CORRECTIONS_PER_FILE times, advisory feedback is suppressed but a
    deterministic-hard secret still arms the Stop backstop so a credential cannot
    slip in unblocked. Every other arming site and both Stop re-lint branches run
    that secret through block_eligible_on_file(..., language=detect_language()),
    so a credential-shaped token in markdown / config prose (no recognized
    language) stays advisory and never arms the backstop — such a file has no
    inline chameleon-ignore escape and the re-lint drops it anyway. This breaker
    site skipped that gate, so a non-code file that resolved to an archetype (via a
    legacy extension-blind paths_pattern) at the corrections cap could be armed
    inconsistently with the re-lint that then clears it. It now arms only on a
    recognized code language, matching the sibling sites. No behavior change for
    code files.

Security Fixes

  • Prevents the Stop backstop from arming on credentials in non-code files after `MAX_CORRECTIONS_PER_FILE` is reached, aligning behavior with code-file handling.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Chameleon

Get notified when new releases ship.

Sign up free

About Chameleon

All releases →

Related context

Earlier breaking changes

  • v3.0.0 MCP surface folded from 48 tools to 19; remaining 32 operator tools become actions on three dispatchers.

Beta — feedback welcome: [email protected]