Changelog for October 15, 2026

v0.15.0@sixthwall packages 0.15.0

sixthwall supabase <project-ref>: check your live project, not just your migrations. The mistake behind CVE-2025-48757 is a Supabase table an anonymous visitor can read because Row Level Security is off or a policy is open. This command asks Supabase's own Management API, with a personal access token you create and own, which tables in the public schema have RLS off and which have a policy that lets everyone through, and returns a Fix Pack for each. It runs one read-only query against the Postgres catalogue; it never reads, writes or names a row of your data, the token only works on projects your account owns, and it is never sent to SixthWall or stored. Disclosed on the privacy and security pages. CLI 0.14.0.

MCP tool arguments are input. Data-flow tracking now treats the parameters of server.tool, server.registerTool, server.addTool and FastMCP's @mcp.tool() as attacker-controlled, the same as req.body or @Body(). The existing command injection, path traversal, SSRF and SQL injection rules fire on MCP tool handlers in TypeScript and Python with no new rules. Prompted by CVE-2026-108953 (mac-shell-mcp), CVE-2026-75130 (Context7) and the PraisonAI advisories. AI-CMD-001 also now matches exec(args.cmd) where args is a tool or request object.
Five rules from the digest, 68 in total. AI-MCP-001 and AI-PY-MCP-001: an MCP server exposed over HTTP or SSE in a file that never checks a token or session. AI-AUTH-006: jwt.verify, jose jwtVerify or fast-jwt createVerifier without an algorithms list, or with an empty secret (four fast-jwt advisories this month). AI-PY-PATH-002: tarfile extraction without filter="data" (pyLoad, CWE-22). AI-NEXT-002: images.remotePatterns with a ** hostname in next.config (Next.js image SSRF advisory GHSA-cjq9-62q9-8jv4). Each has positive and negative tests and new fixtures (mcp-vulnerable, mcp-safe, Next config in both Next fixtures, tar extraction in both Python fixtures) keep the safe set at zero findings.
Files importing @modelcontextprotocol/sdk count as server files for context-gated rules.

Post: "Your MCP server is a server", the command injection and open-transport bugs now getting CVEs, why AI writes them, and the safe shapes.

Next.js 16.3.8 (image optimizer SSRF advisory, found by sixthwall deps on our own dashboard).

Releases from GitHub Actions. .github/workflows/publish.yml publishes every package whose version is not on npm yet, in dependency order, with npm trusted publishing (OIDC, provenance, no token) and then publishes the MCP server's server.json to the official MCP Registry as io.github.sixthwall/sixthwall. docs/LAUNCH.md lists the one-time setup per package and the launch posts.
Two posts: why Row Level Security is the Supabase setting AI apps skip (with the three shapes our rules catch and the tests to run), and a step-by-step account of what the GitHub App does on a pull request, what it stores and how to keep it quiet.
"Install the GitHub App" next to "See how it works" on the home page.
The Claude Code page now answers the searches it already shows up for: headline "Claude Code security check", and FAQs on the security review command and on securing what Claude writes rather than only reviewing it.