All pull requests

Pull requests

• docs: link the unlisted guides from the README documentation section

  #1128·adwaitm1301 opened Nov 14, 2026·

  ·
  1

• fix(python): index AST source lines at Python line breaks only

  #1127·0z5a opened Nov 14, 2026·

  ·
  1

  1

• fix(lp4): recognize Go capability calls in least-privilege check

  #1124·Varshith-Kali opened Nov 14, 2026Contributor·

  ·
  1

  1

• fix(analyzer): narrow AR1 queueing and RA1 consent-row and heading matches (#1120)

  #1122·Varshith-Kali opened Nov 13, 2026Contributor·

  ·
  1

  1

• fix(skill-inspector): resolve the installed artefact, not the default-branch clone (#1112)

  #1119·Varshith-Kali opened Nov 13, 2026Contributor·

  ·
  1

  1

• feat(report): retain sanitized input acquisition origin

  #1118·chrisknvidia opened Nov 13, 2026Collaborator·

  ·
  1

  1

• feat(cli): support custom YARA rules in baseline generation

  #1117·chrisknvidia opened Nov 13, 2026Collaborator·

  ·
  1

  1

• feat(prompt-injection): detect French P1/P3/P4 wording

  #1114·brissonjo-sudo opened Nov 13, 2026·

  ·
  1

• feat(sc4): support offline OSV snapshots

  #1111·qipchip31 opened Nov 13, 2026·

  ·
  1

• Fix defensive-instruction false positives and invalid supply-chain locations

  #1110·yashrajp22 opened Nov 13, 2026Collaborator·

  ·

• fix(analyzer): treat quoted $(printf ... | ...) as runtime data, not a parse limit

  #1109·Varshith-Kali opened Nov 13, 2026Contributor·

  ·
  1

  1

• fix(sc1): skip requirement ranges recorded in npm lockfiles

  #1105·DrVelvetFog opened Nov 12, 2026·

  ·
  1

• Release v2.13.5: parser coverage and dependency accounting

  #1098·yashrajp22 opened Nov 12, 2026Collaborator·

  ·

• fix(sc2): report PowerShell download cradles

  #1097·chiragmangaldev3112 opened Nov 12, 2026Contributor·

  ·
  1

  1

• fix(e1): report Ruby and Go HTTP client uploads

  #1094·chiragmangaldev3112 opened Nov 12, 2026Contributor·

  ·
  1

  7

• feat(analyzer): add DS5 Java insecure-deserialization detection

  #1091·devilking7x opened Nov 11, 2026·

  ·
  1

• fix(opencode_cli): support OpenCode 2.2.6 and 2.2.7 with a project policy preflight

  #1086·Varshith-Kali opened Nov 10, 2026Contributor·

  ·
  1

  14

• fix(analyzer): keep wrapped inline code spans across inline HTML

  #1085·Koloyaaa opened Nov 10, 2026·

  ·
  1

  3

• fix(analyzer): ignore regex .exec() when detecting shell execution

  #1072·Varshith-Kali opened Nov 9, 2026Contributor·

  ·
  1

  11

• fix(tp4): anchor findings to the assessed file, align severity, and drop absence-only mismatches

  #1069·Varshith-Kali opened Nov 7, 2026Contributor·

  ·
  1

  21

• Feat/multi report cli output

  #1065·andreasconrad-ruv opened Nov 6, 2026·

  ·
  1

  8

• Add configurable per-request LLM token and prompt-byte limits

  #1026·SajjadPSavoji opened Nov 5, 2026·

  ·
  1

  1

• fix(sc2): flag downloads executed through command or process substitution

  #1019·Alvi-Rahman opened Nov 4, 2026·

  ·
  1

  17

• docs(skill-inspector): document the Windows stdout form for scan reports

  #1017·bharathvemula opened Nov 4, 2026Contributor·

  ·
  1

  12

• fix(2.13.x): parse-limit regression, gateway LLM output and OSV advisory cap

  #1010·mohgupta-ship-it opened Nov 4, 2026Member·

  ·