This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summarySSRF taint detection now accurately identifies user input in request URLs without false positives.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Cross-file taint tracking now detects command injection via imported helper functions. Cross-file taint tracking now detects command injection via imported helper functions. Source: llm_adapter@2026-06-07 Confidence: low |
— |
| Bugfix | Medium |
Minified and generated bundles are skipped during taint analysis, removing a class of mangled-variable false positives. Minified and generated bundles are skipped during taint analysis, removing a class of mangled-variable false positives. Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Bugfix | Medium |
SSRF taint detection now correctly identifies user input in request URLs while avoiding false positives for fixed-host, relative, and POST-body cases. SSRF taint detection now correctly identifies user input in request URLs while avoiding false positives for fixed-host, relative, and POST-body cases. Source: llm_adapter@2026-06-07 Confidence: low |
— |
| Bugfix | Low |
Audit secret scan is updated to skip test fixture files. Audit secret scan is updated to skip test fixture files. Source: llm_adapter@2026-06-07 Confidence: high |
— |
Full changelog
- SSRF taint detection: user input flowing into a request URL is now caught on the check path and audit, host-position-aware so fixed-host/relative/POST-body cases don't false-positive (1 corpus hit, real, zero FPs)
- Minified/generated bundles are skipped for taint analysis (removes a mangled-variable FP class)
- Cross-file taint now catches command injection via imported helpers; audit secret scan skips test fixtures
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Related tools
Beta — feedback welcome: [email protected]