// changelog

What changed, day by day

Newest first. Each day has its own page. Package versions match what is on npm; the source of this list lives in the repository.

  1. October 15, 2026

    v0.15.0v0.14.0Website
    • v0.15.0: sixthwall supabase <project-ref>: check your live project, not just your migrations. The mistake behind CVE-2025-48757 is a Supabase table an anonymous visitor can read because Row Level Security is off or a policy is open. This command asks Supabase's own Management API, with a personal access token you create and own, which tables in the public schema have RLS off and which have a policy that lets everyone through, and returns a Fix Pack for each. It runs one read-only query against the Postgres catalogue; it never reads, writes or names a row of your data, the token only works on projects your account owns, and it is never sent to SixthWall or stored. Disclosed on the privacy and security pages. CLI 0.14.0.
    • v0.14.0: MCP tool arguments are input. Data-flow tracking now treats the parameters of server.tool, server.registerTool, server.addTool and FastMCP's @mcp.tool() as attacker-controlled, the same as req.body or @Body(). The existing command injection, path traversal, SSRF and SQL injection rules fire on MCP tool handlers in TypeScript and Python with no new rules. Prompted by CVE-2026-108953 (mac-shell-mcp), CVE-2026-75130 (Context7) and the PraisonAI advisories. AI-CMD-001 also now matches exec(args.cmd) where args is a tool or request object.
    • Website: Releases from GitHub Actions. .github/workflows/publish.yml publishes every package whose version is not on npm yet, in dependency order, with npm trusted publishing (OIDC, provenance, no token) and then publishes the MCP server's server.json to the official MCP Registry as io.github.sixthwall/sixthwall. docs/LAUNCH.md lists the one-time setup per package and the launch posts.

  2. September 23, 2026

    v0.12.0v0.13.0v0.12.0Websitev0.11.0v0.10.0v0.9.0v0.8.0v0.7.0v0.6.0
    • v0.12.0: sixthwall probe --recon: what of yours is on the internet that you forgot about. For a verified domain, subfinder lists the subdomains public sources know, httpx checks which answer over HTTP (status, title, technology), and naabu connect-scans twenty database and admin ports on up to a hundred hosts. Findings: an open PostgreSQL, MySQL, MongoDB, Redis, Elasticsearch, Docker or RDP port (severity by what listens there, Docker without TLS is critical), and live hosts whose names say staging, admin, backup, phpmyadmin and the like. Each comes with the compose or firewall change that closes it. All three tools are MIT and installed with sixthwall tools install subfinder httpx naabu; a connect-scan sends nothing to the service.
    • v0.13.0: Syntax-tree rules. Rules can now use strategy: ast-grep and describe code by structure instead of by text: $FN($CMD, $$$) with constraints on what $FN and $CMD may be. Whitespace, line breaks and formatting stop mattering, and a member call such as re.exec(input) can never be mistaken for exec(input). Powered by ast-grep (MIT) with the same JavaScript, TypeScript, TSX and Python parsers; {{tainted}} works inside constraint regexes exactly as in text rules, and a rule can keep a few text_patterns for shapes a tree pattern expresses badly.
    • v0.12.0: Four rules chosen by the weekly digest, 63 in total. The first pnpm digest run listed the weaknesses reported this week that no rule covered; these close the top three. Regular expressions that can run forever, through nested repeats such as (\w+)+ or a RegExp built from request data, for JavaScript (AI-REDOS-001) and Python (AI-PY-REDOS-001). XML from the request parsed with the standard library or lxml without defusedxml (AI-PY-XXE-001). Express logins that write the user into the session without regenerating the session id (AI-SESSION-001). Each has positive and negative tests and was checked against seven local projects before shipping.
    • Website: /badge: the README security badge, with the embed code and an honest note that the number is the project's own statement until pull-request scanning verifies it. /api/badge?score=N serves the SVG.
    • v0.11.0: sixthwall tools: optional open-source binaries, installed on request. sixthwall tools install gitleaks nuclei downloads pinned releases (gitleaks 8.30.1, nuclei 3.11.1, both MIT) from the projects' GitHub release pages, verifies each archive against the release checksum file, and keeps the binaries in ~/.sixthwall/bin. Nothing runs unless installed; the scanner never depends on them.
    • v0.10.0: sixthwall probe <url>: the first Layer 3 slice, read-only checks against a deployed site you own. Security headers (HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, server version disclosure), cookie flags on session cookies, certificate validation and the http→https redirect, downloadable .env, .git, .npmrc, key and dump files, credentialed CORS for any origin, secrets and source maps with original code in the front-end bundle, GraphQL introspection, public API docs, Spring/Django/Laravel/Symfony/Go debug endpoints and Prometheus metrics, and directory listings. Every finding carries a Fix Pack with the exact header value or config change, and the run ends with a live app score.
    • v0.9.0: NestJS rules, 59 rules in total. A controller handler that changes data with no guard in the file and no global guard in the project (AI-NEST-001); an app that starts without a ValidationPipe, or with one that lacks whitelist: true (AI-NEST-002); a JWT strategy with ignoreExpiration: true or a secret written in the code, including the process.env.X || 'dev-secret' fallback (AI-NEST-003); @Body() typed as any or not at all (AI-NEST-004); login, register, reset and OTP handlers with no throttling anywhere in the project (AI-NEST-005).
    • v0.8.0: Dockerfiles and docker-compose files are scanned, with 8 infrastructure rules, 54 rules in total. Dockerfile: the final stage runs as root (AI-IAC-001), base image on :latest or untagged (AI-IAC-002), secrets baked in through ENV, ARG or a copied .env or key file (AI-IAC-003), a downloaded script piped into a shell or curl with certificate checks off (AI-IAC-004), world-writable permissions (AI-IAC-005). Compose: secrets written as literal values (AI-IAC-006), database and admin ports published on every interface (AI-IAC-007), privileged mode, the Docker socket, host networking or broad capabilities (AI-IAC-008). Each rule ships with positive and negative test cases and a fix that keeps the deployment working.
    • v0.7.0: Python support: 13 rules for Flask, FastAPI and Django, 46 rules in total. SQL built with f-strings, format() or concatenation (AI-PY-INJECT-001); shell commands from variables through os.system or shell=True (AI-PY-CMD-001); hardcoded API keys and passwords, including Django's generated secret key (AI-PY-SECRET-001); debug mode on (AI-PY-CONFIG-001); CSRF protection off (AI-PY-CONFIG-002); CORS open to every origin (AI-PY-CORS-001); pickle, unsafe yaml.load, eval and exec on request data (AI-PY-DESER-001); file paths built from the request (AI-PY-PATH-001); server-side fetches of caller-supplied URLs (AI-PY-SSRF-001); MD5 or SHA-1 for passwords, tokens from the random module and JWTs decoded without verification (AI-PY-CRYPTO-001); certificate checking switched off (AI-PY-TLS-001); HTML built from request data (AI-PY-XSS-001); routes that change data in a file with no sign of authentication (AI-PY-AUTH-001). Every rule ships with positive and negative test cases.
    • v0.6.0: Intra-file data-flow tracking for the injection rules. The scanner now follows request data through local variables inside a file. Until now db.query(...${req.params.id}) was caught but the way AI tools actually write it, const status = req.query.status; a few lines above const stmt = SELECT ... ${status}; and pool.query(stmt), was not. Sources are Express, Koa and Hono request objects, Next.js await req.json(), searchParams.get() and route params, including destructuring and renames; taint propagates through templates, concatenation, += and helper calls, and stops at casts (Number, parseInt, String), schema validation (zod, yup, Joi), path.basename, escaping and sanitising, and at database lookups keyed by the value. Six rules use it: SQL injection (AI-INJECT-002), command injection (AI-CMD-001), path traversal (AI-PATH-001), SSRF (AI-SSRF-001), NoSQL injection (AI-NOSQL-001) and reflected XSS (AI-XSS-001).

  3. September 21, 2026

    v0.5.0Websitev0.4.1v0.4.0v0.3.0v0.2.2
    • v0.5.0: sixthwall deps: dependency vulnerability check. Reads your lockfile (pnpm, npm or yarn), asks the OSV database which installed versions have published advisories, and reports each as a normal finding with the fixed version, a one-line update command and a prompt for your AI tool. This is the only command that uses the network; it sends package names and versions to api.osv.dev and nothing else. --fail-on works the same as for scan.
    • Website: Vulnerability wall at /advisories with an RSS feed: the latest reviewed npm advisories, refreshed hourly, each linked to the SixthWall rule that catches the same mistake in your own code.
    • v0.4.1: The published rules package was missing the Supabase and Firebase folders. A clean npx @sixthwall/[email protected] reported 28 rules, not 33, and never scanned SQL migrations or Firebase rules files. The package manifest now includes every rule folder, and a test fails if a rule on disk would not be published.
    • v0.4.0: 18 new rules, 33 in total. The scanner now covers the mistakes that actually leak data in apps built with Lovable, Bolt, v0, Cursor and Claude Code:
    • v0.3.0: Far fewer false alarms. Rules now match across lines, so code formatted by Prettier or an AI tool no longer trips the option-object checks (expiresIn, httpOnly, cookie flags on the next line). Matches inside comments are ignored. A rule can declare unless_present, requires_context and exclude_paths, and a pattern can restrict itself to client files.
    • v0.2.2: TypeScript files were never scanned. Every rule is declared for JavaScript and the matcher required an exact language match, so .ts and .tsx files got zero rules. TypeScript now runs the JavaScript rule set.

  4. September 20, 2026

    Website
    • Website: sixthwall.dev launched on the company server behind the existing HAProxy ingress, with CI on every pull request.

  5. March 3, 2026

    v0.2.0
    • v0.2.0: Zero-friction init: sixthwall init now auto-configures MCP server, CLAUDE.md, Cursor/Windsurf rules, and pre-commit hooks in one command

  6. March 2, 2026

    v0.1.0
    • v0.1.0: Initial release