Changelog
Every release, every rule, every improvement. ShipSafe version history from v0.2.5 to v1.3.0.
vWebsite update
- •Web scans now report failures explicitly instead of producing a clean verdict from an incomplete scan
- •Bounded repository downloads and safer archive extraction; submitted code and install scripts are never executed
- •Clear local-versus-web privacy guidance, accessible scanner inputs, and more useful report context
- •Updated comparisons, server-rendered FAQs and product facts, navigation, and page metadata
v1.4.0
- •Framework-aware route detection for knowledge graph analysis
- •Auto-fix support for additional SQL injection, XSS, and missing security middleware patterns
v1.3.0
- •Pre-commit only by default — no more pre-push friction blocking rapid development
- •Receiver-aware knowledge graph — db.query() is a sink, Array.find() is not
- •40+ receiver-gated sink patterns across database, filesystem, shell, network
- •Update notifications — nudges users when a newer version is available
v1.2.0
- •Replaced KuzuDB with zero-dependency in-memory graph engine
- •Real end-to-end graph tests on fixture files (not mocked)
- •Graph engine tested on Creative Dashboard: 125 files, 257 functions, 491ms
- •Removed deprecated kuzu dependency (66 packages removed)
v1.1.4
- •React component awareness — backend-only rules skip .tsx/.jsx files
- •Fastify schema validation downgraded to low (best practice, not vulnerability)
- •SSRF rules skip known API bases (Meta, Google, Stripe)
- •Insecure random token rules skip Date.now() used for expiry timestamps
v1.1.0
- •Import-level context analysis — checks file imports before flagging (auth, sanitization, validation)
- •In-memory call map — cross-file function call tracing for FP reduction
- •Call chain auth detection — suppresses missing-auth when called from authenticated context
- •SQL/XSS findings downgraded when validation found in call chain
v1.0.11
- •Demo/default passwords stay critical severity with improved messaging
- •Better warning: "These get forked and deployed to production"
v1.0.10
- •Auto-detect Supabase/Clerk/Stripe/PostHog projects and suppress known-public NEXT_PUBLIC_ keys
- •Optional pre-push hook: `shipsafe setup --commit-only` for faster iteration
- •Improved demo password detection messaging
v1.0.9
- •README updated with correct 1,266 detection rule count
- •Added `shipsafe audit` and `shipsafe scan-environment` to CLI documentation
- •Removed broken CI badge
v1.0.8
- •New `shipsafe audit <url>` command — scan any GitHub repo before installing
- •Checks vulnerabilities, secrets, malicious patterns, postinstall scripts
- •Trust score (A-F) with SAFE / CAUTION / DANGEROUS verdict
- •Web scanner at shipsafe.org/scan with paste skill/config support
v1.0.7
- •Public GitHub repo with GitHub Discussions enabled for feature requests and bug reports
- •Feature request section on homepage — community-driven product development
- •Comprehensive SEO overhaul — 36 pages including docs, blog, security guides, and comparison pages
- •AI search optimization — llms.txt, structured data, AI bot crawler rules
v1.0.6
- •MetaStrip integration — automatically strips EXIF, GPS, and camera metadata from images before commit
- •New image metadata scanning rules detect sensitive location and device data in committed images
- •Improved git hook performance for repositories with large binary assets
v1.0.5
- •Tree-sitter AST context analysis for dramatically reduced false positives
- •Context-aware detection understands whether variables come from user input and whether sanitization exists
- •AST analysis covers JavaScript, TypeScript, and Python source files
- •Benchmark: 40% fewer false positives on real-world codebases vs v1.0.4
v1.0.4
- •Prisma framework-specific exceptions — parameterized Prisma queries no longer flagged as SQL injection
- •Next.js framework-specific exceptions for server actions, API routes, and middleware patterns
- •Added 12 new framework-aware rules for common Next.js + Prisma patterns
v1.0.3
- •Real-world false positive fixes from production usage across 200+ projects
- •20 rule fixes addressing common library patterns (Zod, tRPC, Drizzle, Hono)
- •Improved library detection — known-safe function calls from popular packages are excluded
- •Better handling of TypeScript type assertions and generics in detection rules
v1.0.2
- •Performance improvements — 2x faster scanning on large monorepos
- •Parallel file processing with configurable worker count
- •Memory usage optimization for repositories with 10,000+ files
v1.0.1
- •Bug fixes for Windows path handling in git hooks
- •Improved error messages when scanning fails due to file permissions
- •Added --json output format for CI/CD integration
v1.0.0
- •Stable release after 100 self-training cycles on real-world codebases
- •1,200+ detection rules: 1,062 vulnerability rules + 174 secret patterns + 30 environment threats
- •MCP server with 8 tools for AI coding assistants (Claude, Cursor, Windsurf)
- •Knowledge graph attack path analysis using Tree-sitter and KuzuDB (Pro)
- •Auto-fix for common vulnerabilities (Pro)
- •Production monitoring snippet with PII scrubbing (Pro)
v0.9.0
- •Delta mode — scan only changed files since last baseline
- •Baseline suppression — set a baseline and only see new findings going forward
- •shipsafe scan --baseline and shipsafe scan --delta commands
- •Massive speed improvement for incremental scanning in CI/CD pipelines
v0.8.0
- •Malicious MCP/skill scanner with 30 environment threat patterns
- •scan-environment command checks CLAUDE.md, git hooks, npm scripts, and MCP configs
- •Detects credential theft, data exfiltration, prompt injection, and excessive access patterns
- •Environment threat severity levels: critical, high, medium, low
v0.7.0
- •584 detection rules — comprehensive false positive hardening across all categories
- •Reduced false positive rate by 60% vs v0.6.0 through improved pattern specificity
- •Added framework-specific exceptions for Express, Fastify, Koa, and Hono
- •Improved secret detection accuracy with entropy-based filtering
v0.6.0
- •Git pre-commit hook integration — shipsafe hooks install
- •Hooks auto-scan staged files before every commit
- •Configurable hook behavior: block on critical, warn on high
- •Hook bypass with --no-verify (documented for emergency use only)
v0.5.0
- •501 detection rules including 7 prompt injection rules
- •Prompt injection detection for OpenAI, Anthropic, and Google AI SDKs
- •RAG poisoning detection for retrieval-augmented generation patterns
- •System prompt leakage detection
v0.4.0
- •Secret detection with 174 patterns covering 50+ services
- •AWS, Stripe, GitHub, Google Cloud, Azure, Slack, Twilio, and more
- •High-entropy string detection for generic credentials
- •Private key detection (RSA, DSA, EC, PGP)
v0.3.0
- •One-command install via npm install -g @shipsafe/cli
- •Git-aware scanning — respects .gitignore and only scans tracked files
- •.shipsafeignore support for custom exclusion patterns
- •Improved CLI output with severity colors and fix suggestions
v0.2.5
- •Initial public release
- •Core scanning engine with 200+ detection rules
- •SQL injection, XSS, command injection, and SSRF detection
- •Basic CLI with scan command and JSON output
Try the Latest Version
Install ShipSafe v1.3.0 and get all 1,266 detection rules.
npm install -g @shipsafe/cliGet Started Free