This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+14 more
Summary
AI summaryFalse‑positive precision improvements across several detection rules.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Cron and webhook rules recognize Vercel/QStash signature verification Cron and webhook rules recognize Vercel/QStash signature verification Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Feature | Medium |
BOLA rule recognizes tenant compound‑where ownership (projectId/workspaceId/teamId) BOLA rule recognizes tenant compound‑where ownership (projectId/workspaceId/teamId) Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Bugfix | Medium |
No longer flags parameterized IN-clauses as SQL injection No longer flags parameterized IN-clauses as SQL injection Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Bugfix | Medium |
Debug-endpoint rule stops firing on build/test config files Debug-endpoint rule stops firing on build/test config files Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Bugfix | Medium |
Supabase `.or()` rule no longer collides with Zod's `.or()` Supabase `.or()` rule no longer collides with Zod's `.or()` Source: llm_adapter@2026-06-07 Confidence: high |
— |
Full changelog
False-positive precision on real production apps (no rule-count change):
- Parameterized IN-clauses built from placeholder generation (
id IN (${ids.map(() => '?')})) are no longer flagged as SQL injection - The debug-endpoint rule no longer fires on build/test config files; the Supabase
.or()rule no longer collides with Zod's.or() - Cron and webhook rules now recognize Vercel/QStash signature verification, and the BOLA rule recognizes tenant compound-where ownership (projectId/workspaceId/teamId) — each verified to remove only false positives with zero true-positive loss
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Related tools
Beta — feedback welcome: [email protected]