isitsecure

v0.1.0 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 16d Vulnerability Scanning

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 5 known CVEs

Topics

security code-scanning dynamic-analysis llm python static-analysis

+4 more

supabase vibe-coding vulnerability-scanning web-security

Summary

AI summary

Updates Added Scanning, blind, and Injection across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	High	Hardens `git clone` against argument‑injection RCE using scheme allow‑list, `--` separator, and scrubs GitHub token from git stderr. Hardens `git clone` against argument‑injection RCE using scheme allow‑list, `--` separator, and scrubs GitHub token from git stderr. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	High	Contains AI‑fix apply path to the repository, preventing arbitrary file writes. Contains AI‑fix apply path to the repository, preventing arbitrary file writes. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	High	Writes API‑key config file with `0600` permissions; prevents credential replay on cross‑origin redirects. Writes API‑key config file with `0600` permissions; prevents credential replay on cross‑origin redirects. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	Medium	Restricts web server CORS to loopback only, disallowing wildcard origins. Restricts web server CORS to loopback only, disallowing wildcard origins. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Security	Medium	Scrubbs leaked private‑product identifiers from generic scanner logic. Scrubbs leaked private‑product identifiers from generic scanner logic. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature
Feature	Low	Adds 40 default rule-based scanners; 44 with `--depth deep` covering SAST, DAST, LLM review, triage, and fixes. Adds 40 default rule-based scanners; 44 with `--depth deep` covering SAST, DAST, LLM review, triage, and fixes. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Introduces scan depth options `quick` (fast) and `deep` (adds time‑based SQLi, active XSS, auth‑bypass timing, etc.). Introduces scan depth options `quick` (fast) and `deep` (adds time‑based SQLi, active XSS, auth‑bypass timing, etc.). Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds live Supabase RLS testing with anon key in url‑only mode, flagging readable/writable tables and escalating sensitive column exposure to CRITICAL. Adds live Supabase RLS testing with anon key in url‑only mode, flagging readable/writable tables and escalating sensitive column exposure to CRITICAL. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds backend/infrastructure fingerprinting for Cloudflare, Vercel, Netlify, Supabase and others. Adds backend/infrastructure fingerprinting for Cloudflare, Vercel, Netlify, Supabase and others. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds snapshot scanners for source‑map leak verification, mixed content, Subresource Integrity, and client‑side exposure of keys/URLs. Adds snapshot scanners for source‑map leak verification, mixed content, Subresource Integrity, and client‑side exposure of keys/URLs. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds endpoint discovery via OpenAPI/Swagger probing, HTML form/link extraction, `{id}` variant generation, and external API‑base probing. Adds endpoint discovery via OpenAPI/Swagger probing, HTML form/link extraction, `{id}` variant generation, and external API‑base probing. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds authenticated cross‑user IDOR / BOLA with owned‑resource‑id harvesting via `--auth-email-b`, `--auth-password-b`, and `--login-url`. Adds authenticated cross‑user IDOR / BOLA with owned‑resource‑id harvesting via `--auth-email-b`, `--auth-password-b`, and `--login-url`. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds injection scanners for path‑parameter injection, broad SQL‑error recognition, time‑based SQLi confirmation, and SSTI. Adds injection scanners for path‑parameter injection, broad SQL‑error recognition, time‑based SQLi confirmation, and SSTI. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds stored XSS detection via inject‑then‑retrieve and allowlist‑bypass open‑redirect detection; includes OSV.dev dependency scanning. Adds stored XSS detection via inject‑then‑retrieve and allowlist‑bypass open‑redirect detection; includes OSV.dev dependency scanning. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Implements SAST → DAST feedback loop: static findings generate targeted live tests. Implements SAST → DAST feedback loop: static findings generate targeted live tests. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Provides live scan narration with scrolling log routed to stderr, keeping piped JSON/SARIF clean. Provides live scan narration with scrolling log routed to stderr, keeping piped JSON/SARIF clean. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Generates auto‑generated HTML report led by a plain‑English risk summary and action plan. Generates auto‑generated HTML report led by a plain‑English risk summary and action plan. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Adds security badge (SVG), SARIF export for GitHub code scanning, and a local web UI (`isitsecure launch`). Adds security badge (SVG), SARIF export for GitHub code scanning, and a local web UI (`isitsecure launch`). Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Feature	Low	Includes framed, animated welcome banner. Includes framed, animated welcome banner. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fixes per‑resource findings (e.g., per‑table RLS) that were previously collapsed by fuzzy deduplication; now kept distinct. Fixes per‑resource findings (e.g., per‑table RLS) that were previously collapsed by fuzzy deduplication; now kept distinct. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Ensures confirmed SSTI findings are no longer silently discarded (previously swallowed `NameError`). Ensures confirmed SSTI findings are no longer silently discarded (previously swallowed `NameError`). Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Bugfix	Low	Fixes invalid JSON output from `scan --output json` when piped/redirected; now written raw and always parsable. Fixes invalid JSON output from `scan --output json` when piped/redirected; now written raw and always parsable. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Bugfix	Low	Ensures cross‑user REST IDOR runs regardless of crawler‑harvested resource IDs. Ensures cross‑user REST IDOR runs regardless of crawler‑harvested resource IDs. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—

Full changelog

First public release — an AI-powered SAST + DAST + LLM security scanner for
modern web apps, run from a single command.

Added

Scanning

40 rule-based scanners by default (44 with --depth deep): SAST, DAST, and
special DAST scanners, plus optional LLM code review, triage, and AI fixes.
SAST → DAST feedback loop: static findings generate targeted live tests.
Scan depth (--depth quick|deep, default quick): quick runs the fast
structural + error-based scanners in seconds; deep adds time-based (blind)
SQL injection, active XSS, auth-bypass timing, rate-limit bursts, and
password-reset probes.
Live Supabase RLS testing with the anon key in url-only mode: flags tables
readable/writable without authentication, escalates to CRITICAL when a
sensitive column (email, etc.) is exposed, and infers anon-INSERT exposure
from the PostgREST error code.
Backend / infrastructure fingerprinting (Cloudflare, Vercel, Netlify, … plus
Supabase).
Snapshot scanners: source-map leak (verified, not just present), mixed
content, Subresource Integrity, and client-side exposure (Supabase
service_role keys, internal URLs, unreplaced env placeholders).
Endpoint discovery: OpenAPI/Swagger probing, HTML form/link extraction,
/{id} variant generation, and external API-base probing.
Authenticated cross-user IDOR / BOLA with owned-resource-id harvesting
(--auth-email-b, --auth-password-b, --login-url).
Injection: path-parameter injection, broad SQL-error recognition
(SQLAlchemy / sqlite3 / psycopg), time-based SQLi confirmation, and SSTI.
Stored XSS via inject-then-retrieve; allowlist-bypass open-redirect
detection; OSV.dev dependency scanning.

Experience

Live scan narration: every phase and every scanner reports progress (with
per-item sub-events) as a scrolling log, so long scans never look stuck —
routed to stderr so piped --output json/sarif stays clean.
Auto-generated HTML report led by a plain-English "what this means for you"
risk summary and action plan.
Security badge (SVG), SARIF export for GitHub code scanning, and a local web
UI (isitsecure launch).
Framed, animated welcome banner.

Setup & onboarding

One-command installers — install.sh (macOS/Linux) and install.ps1
(Windows): verify Python 3.11+/git, clone, create a virtual environment,
install, and run first-time setup.
isitsecure setup installs the DAST browser and language servers, with
--lsp / --check sub-flows; isitsecure launch also offers language-server
setup. LSP install is cross-platform (pip / npm / Homebrew) with per-OS
guidance for anything it can't install directly.

Project

Repeatable benchmark harness (benchmarks/) with recall + false-positive
scorecards and a per-instance scorer.
CI (GitHub Actions): test gate on Python 3.11 and 3.12.

Security

Hardened git clone against argument-injection RCE (scheme allow-list, --
separator, GIT_ALLOW_PROTOCOL); scrub the GitHub token from git stderr.
Contained the AI-fix apply path to the repository (no arbitrary file write).
Loopback-only CORS on the web server (no wildcard origins).
API-key config file written 0600; credentials no longer replayed on
cross-origin redirects.
Scrubbed leaked private-product identifiers from generic scanner logic.

Fixed

Per-resource findings (e.g. per-table RLS) were collapsed by fuzzy
deduplication — now kept distinct.
Confirmed SSTI findings were silently discarded (swallowed NameError).
scan --output json produced invalid JSON when piped/redirected (Rich
word-wrapping mid-string); now written raw so it always parses.
Cross-user REST IDOR now runs regardless of crawler-harvested resource ids.

Security Fixes

Hardened `git clone` against argument‑injection RCE (scheme allow‑list, `--` separator, scrubbed GitHub token).
Contained AI‑fix apply path to the repository only (no arbitrary file write).
Loopback‑only CORS on web server (no wildcard origins).
API‑key config file written with 0600 permissions; credentials no longer replayed on cross‑origin redirects.
Scrubbed leaked private‑product identifiers from generic scanner logic.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track isitsecure

Get notified when new releases ship.

About isitsecure

All releases →