Changelog

Java taint engine: persistent cross-file call graph and native Spring Framework detection, with lexical and dataflow engines now fused into a single pass. Validated on real-world code — WebGoat recall jumps to 94.4%, beating Semgrep OSS at 50% on the same ground truth, with zero new false positives across 3 independent open-source codebases.

🎯 Java engine — cross-file call graph & Spring detection

• →WebGoat real-world validation: 94.4% recall (17 of 18 known vulnerabilities found) vs. 50% (9/18) for Semgrep OSS — same ground truth, official Java security rulesets
• ✓Persistent call graph — multi-hop cross-file resolution (A→B→C), SQLite-cached with file-hash invalidation, replacing the previous single-hop lexical-only analysis
• ✓Native Spring Framework detection — @RequestParam/@RequestBody/@PathVariable/@RequestHeader sources, implicit parameter binding, argument-to-parameter propagation through internal method calls
• ✓Lexical and dataflow engines now run together on every Java file and merge results: on a 47,000-star open-source codebase (JeecgBoot), +7 cross-file flows gained, 0 lost, 0 new false positive
• ⓘPrecision re-validated on 3 independent real-world codebases (spring-petclinic, spring-boot-realworld-example-app, JeecgBoot) — including an XSS sink fix that eliminated 20 false positives (JeecgBoot precision: 49.3% → 69.4%)

Java lexical taint engine: F1 = 98.8% on OWASP BenchmarkJava v1.2 (2,740 test cases), recall = 100% — zero missed vulnerabilities. 6 out of 8 categories reach F1 = 100% (sqli, cmdi, pathtraver, ldapi, trustbound, crypto). Total: 710 rules.

🎯 Java taint engine — OWASP BenchmarkJava v1.2

• →OWASP BenchmarkJava v1.2: F1 = 98.8%, recall = 100.0% (2,740 test cases) — verified against a public, independent benchmark
• ✓SQL injection, command injection, path traversal, LDAP injection, trust boundary, crypto: all at F1 = 100%
• ✓Method summary pre-pass: −406 false positives eliminated. Inter-procedural HashMap/List/switch-const/constant-ternary analysis
• ⓘ33 residual false positives on hash category only (MessageDigest.getInstance with external config — structural SAST limit)

Dataflow taint engine Phase 7/8 (F1 = 1.000 on Python AND multilang JS/Java/C#/PHP) plus 3 supply-chain rules inspired by the TanStack/Mistral npm attack (May 2026, 170 packages compromised). Legacy taint engine removed (-3 519 LOC net). Total: 700+ rules across 8 categories.

🎯 Dataflow taint engine (Phase 7/8)

• ✓Clean-room implementation — CFG, IR 3-address, lattice and worklist with hybrid dotted + regex matching (~6 200 LOC code, 3 800 LOC tests)
• ✓F1 = 1.000 on the internal SCA fixture corpus — zero false negatives, zero false positives, on Python AND multilang (JS/Java/C#/PHP)
• ✓Profile loader (Flask, Django, Express, Spring, Laravel, .NET) auto-injected into taint rules by category — same precision as Snyk Code, without cloud or external dependency

🔒 Supply-chain coverage (TanStack/Mistral May 2026)

• ✓npm_git_dependency rule — detects dependencies pinned to a Git commit on GitHub/GitLab/Bitbucket, which bypass npm registry advisories
• ✓ide_config_exfil rules (JS + Python) — detect silent writes to .claude/settings.json, .vscode/tasks.json, .cursor/, .aider/, .codeium/ used as persistence vectors
• →Native preventive coverage — no telemetry, no cloud sandbox, every detection runs offline on the developer's machine

D.2 Performance — rule cache and incremental analysis make warm-cache runs up to 3× faster, ideal for CI/CD pipelines and pre-commit hooks.

⚡ Performance

• ✓Rule cache: parsed DSL rules cached across runs (no re-parsing)
• ✓Incremental analysis: only files changed since the last scan are re-analyzed (content hash)
• →Up to 3× faster on warm runs (subsequent scans of unchanged code)

+53 detection rules for non-security categories: Architecture, Maintenance, Accessibility/UX, Interface/UI. Based on axe-core (WCAG 2.2), Ruff, Pylint, PMD, PHPMD, SonarJS, eslint-plugin-jsx-a11y, HTMLHint, and SonarQube Cloud API.

📚 New Rules — 8 Waves

• ✓+16 UX/accessibility rules (HTML + JSX): axe-core WCAG 2.0/2.1/2.2, aria-hidden, viewport zoom, video captions, jsx-a11y
• ✓+6 UI rules (HTML): deprecated tags, inline styles, missing viewport, button type, target blank, image dimensions
• ✓+24 Maintenance rules: Python (Ruff/Pylint), Java (PMD), PHP (PHPMD), JavaScript (SonarJS), C# (SonarQube)
• ✓+7 Architecture rules: Java, PHP, JavaScript, C# — coupling, utility classes, public fields
• →698 total detection rules (up from 645)

🔎 Detection & Coverage

• ✓698 detection rules across 8 categories
• ✓8 programming languages: Python, JavaScript/TypeScript, HTML, Java, C#, PHP, YAML
• ✓changelog.v2.detection.custom--create-rule) with DSL and taint propagation
• ✓changelog.v2.detection.fixtures
• ✓changelog.v2.detection.selftest--self-test) validates all fixtures on demand

🔒 Security

• ✓changelog.v2.security.owasp
• ✓changelog.v2.security.iso27001
• ✓changelog.v2.security.asvs
• ✓changelog.v2.security.cicd
• ✓changelog.v2.security.suppress# sca-ignore), config, or global disable

📤 Exports & Integration

• ✓SARIF 2.1.0 export for GitHub Code Scanning and GitLab SAST--sarif) — compatible with GitHub Code Scanning and GitLab SAST
• ✓SBOM generation in CycloneDX 1.5 format--sbom) — Software Bill of Materials
• ✓changelog.v2.exports.gitblame--git-blame) — committer per finding
• ✓changelog.v2.exports.hook--install-hook) — automatic audit before every commit
• ✓changelog.v2.exports.failon--fail-on-high) — exit code 1 on HIGH findings

🎯 Core

• ✓51 detection rules across 7 categories
• ✓4 languages: Python, JavaScript/TypeScript, HTML
• ✓changelog.v1.core.reports
• ✓Baseline comparison across audit snapshots
• ✓changelog.v1.core.zero
• ✓changelog.v1.core.offline
• ✓changelog.v1.core.uuid--init)