What shipped, and which version shipped it.

Nine new rules covering public storage buckets across Supabase, Firebase and S3, including the case where a bucket is private but every object in it is signed with a URL that never expires.

A bucket policy that lives in a dashboard rather than the repo now reports as not checked, with instructions for reading it yourself. It used to be left out of the report entirely, which read as a pass.

OSV database snapshot refreshed to 2026-07-28. The date is stamped on every scan that uses it.

A finding's identity is now the rule, the normalised path and a hash of the matched code — not the line number. Moving a function no longer resurrects a finding you already dismissed.

Dismissals persist across scans and are excluded from the score. A dismissed critical stays visible and labelled rather than disappearing.

Fixed a case where a scan whose AI stage timed out returned no findings at all, instead of returning the findings the four deterministic passes had already produced.

Twelve rules for Postgres row-level security, read from committed migrations: tables with RLS off, policies that resolve to true for everyone, and service-role keys used from browser code.

A repo with no committed migrations reports these as not checked. There is no version of this check that can pass without evidence.

Clone depth raised to 500 commits. A shallow clone could not see a secret that was committed and later deleted, which is the most common way a live key survives in a repo.

Network egress is now verified cut with a canary request before any scanner runs. If the cut cannot be proved the scan aborts and the credit is returned.

A scan that dies mid-run is swept by a reaper and refunded, instead of sitting at “running” until someone notices.