July 2026 change log

Feature Add

Java

• java-kem-missing-signature-verification
  • Created new rule to detect KEM decapsulation operations performed without prior cryptographic signature verification (CWE-347):
    • Flags calls to decapsulate() in javax.crypto.KEM that are not protected by preceding Signature.verify() checks, allowing man-in-the-middle attacks on key encapsulation
    • Covers key agreement scenarios where an attacker could substitute a malicious encapsulated key without detection

Bug Fixes / Enhancement

C#

• csharp-hardcoded-credentials-basic-ide

  • Enhanced to reduce false positives by:
    • Removing false positives on AWS SDK GetSecretValueRequest constructor calls where SecretId parameter was incorrectly flagged as hardcoded credential
    • Adding exclusions for test values containing keywords like parsed, from_secrets, from_vault, from_env, and placeholder
    • Removing false positives from email addresses used as SMTP usernames and certificate file paths

• csharp-path-traversal-hb

  • Enhanced to improve detection coverage by:
    • Adding detection for user input flowing into File.Open(), File.Create(), File.Delete(), and other File class methods
    • Adding detection for path traversal in Directory.Delete() and ControllerBase.PhysicalFile() methods
    • Adding detection for ASP.NET Core controller parameters with [FromQuery], [FromRoute], and [FromForm] attributes

• integer-overflow-csharp-rule

  • Enhanced to improve detection accuracy and reduce false positives by:
    • Removing false positives on simple type casting by replacing over-broad cast detection with specific arithmetic operation patterns that target actual overflow scenarios
    • Adding detection for Random number generation sources including complex expressions that can produce values exceeding integer limits when used in arithmetic operations
    • Adding overflow prevention detection to recognize proper bounds checking patterns including division-based checks and square root validation for multiplication operations

• untrusted-deserialization-csharp-rule

  • Enhanced to reduce false positives by:
    • Removing false positives in System.Text.Json.JsonSerializer.Deserialize() calls by treating strongly-typed deserialization as safe
    • Removing false positives for XmlSerializer, DataContractSerializer, and DataContractJsonSerializer when constructed with explicit typeof() constraints
    • Adding detection for ReadObject() method calls with tailored exclusions for data contract serialization scenarios

Go

• go-path-traversal-hb
  • Enhanced to improve detection coverage by:
    • Adding detection for HTTP request parameters flowing into path operations via http.Request.FormValue(), http.Request.PostForm.Get(), and multipart file names
    • Adding detection for path traversal in template.ParseFiles() and template.ParseGlob() functions
    • Adding detection for os.OpenRoot() usage where user input flows into subsequent file operations

Java

• java-crypto-compliance-secure-random-number-generator

  • Enhanced to improve detection accuracy by:
    • Fixing rule description that incorrectly referenced initialization vectors instead of insecure random number generation with SecureRandom

• java-deprecated-cryptographic-classes

  • Enhanced to improve detection coverage by:
    • Fixing false negatives caused by case-sensitive regex matching when JCE transformation names are case-insensitive — now detects deprecated algorithms like "des", "Des", or "DES" consistently
    • Adding detection for weak PBE (Password-Based Encryption) ciphers like PBEWithMD5AndDES passed to SecretKeyFactory.getInstance()

• java-exception-info-disclosure-ide

  • Enhanced to improve detection coverage by:
    • Detecting information disclosure vulnerabilities when Java exception details are returned in HTTP responses through Spring ResponseEntity or servlet response writers
    • Covering both Spring Boot ResponseEntity patterns and traditional servlet response.getWriter() methods that leak exception data including stack traces, error messages, and database connection strings

• java-no-sql-injection-ide

  • Enhanced to improve performance and reduce false positives by:
    • Resolving timeout failures on large files by consolidating 246 verbose request parameter patterns into 2 efficient regex-based patterns while preserving NoSQL injection detection coverage
    • Fixing false positives caused by overly broad matching of variable names containing "request" — now requires exact HttpServletRequest and RoutingContext type annotations instead of regex matching variable names
    • Streamlining detection logic by replacing repetitive individual method patterns with consolidated regex matching for standard HTTP request getter methods like getParameter(), getHeader(), and getQueryParam()

• java-null-pointer-dereference-rule

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection for null pointer dereferences in Java 21 pattern-matching switch expressions that lack explicit case null handlers
    • Excluding false positives from Optional method chains like map() and ifPresent() where null safety is inherently managed

• java-path-traversal-hb

  • Enhanced to improve maintainability by:
    • Consolidating redundant HttpServletRequest source patterns into regex-based matching to improve maintainability while preserving detection coverage for all user input methods like getParameter(), getHeader(), and getCookies()
    • Refactoring file operation vulnerable output points patterns from individual constructor patterns to regex-based matching, reducing rule complexity while maintaining coverage for FileInputStream, FileOutputStream, FileReader, and other file I/O classes
    • Separating getRequestURI() as an untyped pattern to extend detection beyond Servlet contexts to HttpExchange and other non-Servlet request types

• java-path-traversal-specialized

  • Enhanced to reduce complexity and improve reliability by:
    • Simplifying HttpServletRequest source detection by consolidating 14 individual patterns into a single regex-based pattern, reducing rule complexity while maintaining coverage for all servlet request methods like getParameter(), getHeader(), and getPathInfo()
    • Removing overly complex template processing vulnerable output points that required specific variable tracking across multiple statements, eliminating false negatives when templates are processed through different code paths than the expected Template.merge() and Template.process() flows
    • Streamlining Git repository path traversal detection by removing complex multi-chained patterns, focusing on direct repository access methods that are more reliable indicators of path traversal vulnerabilities

• java-structured-concurrency-exception-info-disclosure

  • Enhanced to improve detection coverage by:
    • Adding detection for exception information disclosure through Spring's ResponseEntity.status().body() API within structured concurrency catch blocks

• java-unbounded-virtual-thread-request-handling

  • Enhanced to improve detection coverage by:
    • Adding detection for unbounded virtual thread creation in Spring controller methods with @RequestParam, @RequestBody, @ModelAttribute, @PathVariable, @RequestHeader, and @CookieValue annotations
    • Extending coverage to Spring controllers using @GetMapping, @PostMapping and other mapping annotations beyond @RequestMapping

• java-untrusted-control-sphere

  • Enhanced to improve detection coverage by:
    • Adding detection for untrusted input flowing through Spring Boot REST endpoints with @PostMapping, @GetMapping, @PutMapping, and @DeleteMapping annotations
    • Enhancing coverage for Spring framework input sources including @RequestParam, @PathVariable, and @RequestHeader annotations across all HTTP method mappings

• java-red-data-logging

  • Enhanced to improve detection coverage by:
    • Adding detection for sensitive data exposure through Java 23/24 ScopedValue patterns (JEP 481/487) — flags API keys, credit card numbers, CVVs, and plaintext passwords retrieved from ScopedValue.get() and written to HTTP responses or logged via System.out.println()
    • Adding OutputStream.write() as a monitored logging sink alongside existing Logger and PrintStream methods
    • Adding regex patterns for credit_card (with optional underscore) and cvv variable names to detect credit card data logging
    • Reducing false positives for sessionId by excluding cases where the session ID is generated via generate, create, or build* methods — these are non-sensitive generated identifiers

JavaScript

• javascript-process-env-undefined

  • Enhanced to reduce false positives by:
    • Fixing false positives caused by overly specific pattern matching for conditional assignments — now properly excludes process.env.PROP = x && x.field ? ... : '...' patterns regardless of variable names
    • Resolving false positives on async configuration loading by generalizing exclusion pattern to cover const value = await anyFunction() followed by process.env.PROP = value.attribute
    • Improving detection accuracy for function parameter defaults by fixing indentation-sensitive pattern matching that was causing inconsistent exclusions

• javascript-server-side-request-forgery-ide

  • Enhanced to improve detection coverage and reduce false negatives by:
    • Removing overly restrictive allowlist exclusions that were causing false negatives when developers used validation patterns different from hardcoded regex checks
    • Consolidating HTTP client detection patterns to reduce rule complexity while maintaining coverage for request, got, fetch, axios, superagent, needle, http, and https libraries
    • Adding detection for Playwright browser automation SSRF vectors including page.goto(), page.setContent(), page.pdf(), and page.route() methods

• javascript-sql-injection-ide

  • Enhanced to reduce false positives and improve detection coverage by:
    • Removing false positives caused by overly broad string formatting patterns (String.format(), util.format(), sprintf(), join()) that flagged legitimate non-SQL string operations
    • Adding validation bypass detection for validator.isInt(), validator.isAlpha(), and other validator library functions that don't prevent SQL injection when user input flows to database queries

• javascript-hardcoded-credentials-ide

  • Enhanced to improve detection coverage by:
    • Improving detection of hardcoded credentials in connection strings, AWS credentials in object literals, authorization headers, and CSRF tokens
    • Fixing missed detections caused by overly complex pattern matching

• js-deprecated-get-configuration

  • Enhanced to improve performance by:
    • Fixing timeout failures on large files by replacing overly broad pattern matching with optimized detection logic

• js-log-injection-ide

  • Enhanced to improve performance and reduce false positives by:
    • Resolving timeout failures on large files by consolidating 116 individual Express.js request patterns into 2 efficient regex-based patterns for req.params, req.query, req.body, req.cookies, and req.headers
    • Fixing false positives in process signal handlers by removing overly complex pattern matching that incorrectly flagged legitimate shutdown logging for valid signals like SIGINT and SIGTERM
    • Improving file system source detection by replacing separate fs.readFileSync() and fs.readFile() patterns with a single regex-based pattern matching both methods

• javascript-server-side-request-forgery-hb

  • Enhanced to improve performance and reduce false positives by:
    • Improving scan reliability on large JavaScript files for CWE-918 SSRF detection by removing 12 redundant sink-embedded pattern-not-inside control-flow guards that caused O(n²) evaluation time
    • Adding a working startsWith('https://') control-flow sanitizer to replace the removed sink guards, maintaining protection against false positives at O(1) cost
    • Removing a dead pattern-regex sanitizer that matched literal $URL text rather than actual JavaScript variables, which never functioned as intended

Python

• python-cdk-document-db-cluster-backup-retention-period

  • Enhanced to reduce false positives by:
    • Fixing false positives where DocumentDB clusters with properly configured BackupProps were incorrectly flagged when using aliased imports

• python-cdk-elb-logging-enabled

  • Enhanced to reduce false positives by:
    • Fixing false positives for ELB and ELBv2 load balancers when access logging was properly configured via AccessLoggingPolicy or LoggingAttributes constructors

• python-cdk-enabled-access-logging-for-cloudfront-distribution

  • Enhanced to reduce false positives by:
    • Fixing false positives on CloudFront distributions that explicitly set enable_logging=True parameter — rule was incorrectly flagging compliant configurations as missing access logging
    • Adding detection for distributions configured with log_bucket parameter, which enables access logging through S3 bucket specification but was previously unrecognized
    • Resolving incorrect flagging of distributions using module-prefixed constructors like aws_cloudfront.Distribution() when proper logging configuration was present

• python-cdk-rds-deletion-protection-enabled

  • Enhanced to improve detection accuracy by:
    • Fixing CWE classification from CWE-311 (Missing Encryption) to CWE-693 (Protection Mechanism Failure) for deletion protection detection

• python-hardcoded-credentials-for-library-ide

  • Enhanced to reduce false positives by:
    • Removing false positives on hashlib.sha256() calls by restricting detection to credential-named variables and excluding environment variable sources
    • Removing false positives for Google Cloud service account methods that were flagging legitimate file path parameters
    • Removing false positives in requests library authentication for tuples used as form data rather than authentication headers

• python-hardcoded-credentials-ide

  • Enhanced to reduce false positives by:
    • Fixing false positives on common placeholder values by excluding literal strings like "password", "token", "secret", and "test" that are frequently used as non-credential identifiers
    • Resolving false positives on Windows batch file references by excluding strings ending with ".bat" extension
    • Adding exclusions for Git SHA values in JSON objects to prevent flagging commit hashes as hardcoded credentials

• python-incorrect-authorization

  • Enhanced to improve detection coverage by:
    • Adding detection for authorization checks using request.headers.get() and request.args.get() — previously only caught cookie-based role determination, missing common attack vectors through URL parameters and HTTP headers
    • Enhancing coverage for indirect authorization patterns where role extraction is wrapped in helper functions — now detects when client-controlled input flows through intermediate functions before being used in access control decisions
    • Improving pattern matching to catch authorization logic with different conditional ordering — fixes missed detections when admin role checks appeared in various positions within if-statements

• python-llm-sensitive-information-disclosure

  • Enhanced to improve detection coverage by:
    • Adding detection for sensitive information flowing into OpenAI chat completions via chat.completions.create() and messages.create() message content parameters — previously missed credential leaks through conversational AI APIs
    • Extending coverage to capture sensitive data passed to embeddings.create() input parameter and completions.create() prompt parameter — closed detection gaps for text processing and completion APIs
    • Enhancing pattern matching to detect sensitive information in both direct variable assignments and f-string interpolations within LLM API calls — previously only caught direct assignments, missing templated sensitive data

• python-llm-vector-embedding-weaknesses

  • Enhanced to improve performance by:
    • Fixing timeout failures on large files by optimizing pattern matching for AutoTokenizer and AutoModel detection

• python-log-injection-hb

  • Enhanced to improve performance by:
    • Optimizing performance by consolidating framework request sources and validation recognized safe usages into unified pattern structures

• python-log-injection-ide

  • Enhanced to improve performance by:
    • Optimizing log injection detection by consolidating duplicate function parameter patterns and grouping framework request sources to improve scan performance on large files

• python-os-command-injection-ide

  • Enhanced to improve performance by:
    • Consolidating redundant function parameter patterns from 4 separate cases into a single generic pattern to improve scan performance on large files

• python-path-traversal-hb

  • Enhanced to reduce false positives and improve detection coverage by:
    • Fixing false positives on allowlist validation patterns using if in constructs
    • Fixing false positives when os.path.normpath() is followed by startswith() validation
    • Adding recognition for common secure path validation patterns that prevent directory traversal
    • Adding coverage for 14 Path Traversal APIs from shutil and os family

• python-prompt-injection-vulnerability

  • Enhanced to reduce false positives by:
    • Removing overly broad dictionary access sources that matched every dictionary operation in Python code
    • Removing redundant LLM vulnerable output points patterns while preserving coverage for prompt injection into OpenAI, Cohere, Gemini, and Bedrock APIs

• python-sql-injection-ide

  • Enhanced to improve performance and reduce false positives by:
    • Fixing false positives caused by overly broad pattern matching that flagged safe database operations — now specifically targets only SQL execution methods like execute(), executemany(), and query() instead of all database cursor methods
    • Enhancing detection coverage for additional database methods including fetchone(), fetchall(), group_by(), and order_by() that were previously missed when processing user input in f-strings and string concatenation
    • Resolving performance issues on large codebases by consolidating 234 redundant patterns into 28 optimized regex-based patterns while preserving SQL injection detection coverage

• python_cdk_kinesis_data_firehose_sse

  • Enhanced to improve detection accuracy by:
    • Fixing detection of unencrypted Kinesis Data Firehose delivery streams regardless of how CfnDeliveryStream is referenced or imported
    • Adding detection for dictionary-style parameter passing using **kwargs syntax when delivery_stream_encryption_configuration_input is omitted or set to None
    • Fixing parameter name typo from delivery_stream_encryption_configuration_inputt to delivery_stream_encryption_configuration_input

• python-cdk-auto-scaling-group-health-check

  • Enhanced to reduce false positives by:
    • Removing detection of HealthCheck.elb() method calls in AWS CDK AutoScalingGroup configurations
    • Eliminating false positives by no longer flagging deprecated API usage that does not represent a security misconfiguration

• python-cross-site-scripting-hb

  • Enhanced to improve performance by:
    • Improving scan reliability on large Python files for CWE-79 cross-site scripting detection with no change to detected vulnerability patterns

• python-do-not-hardcode-security-sensitive-credentials

  • Enhanced to improve detection accuracy by:
    • Ground truth correction only — corrected 7 benchmark test case annotations from defects=0 to defects=1 where actual hardcoded credentials were present but incorrectly marked as safe. No rule logic change

• python-file-extension-validation

  • Enhanced to reduce false positives by:
    • Fixing false positives when file extensions are validated using Python's in or not in operators within if-statements — these membership checks are now recognized as valid extension validation
    • Fixing false positives when open() is called with a hardcoded file path containing a safe extension (e.g., /var/www/html/img/img.jpg) rather than user-supplied input

• python-cdk-auto-scaling-group-scaling-notifications

  • Enhanced to reduce false positives by:
    • Fixing false positives where AutoScalingGroup resources that configure notifications post-creation via notify_on_instance_launch(), notify_on_instance_terminate(), notify_on_instance_launch_errors(), notify_on_instance_terminate_errors(), or add_notification() methods were incorrectly flagged as missing notifications
    • Extending pattern matching to use metavariable-regex for the ASG constructor, supporting both direct AutoScalingGroup(...) and aliased autoscaling.AutoScalingGroup(...) import styles
    • Fixing incorrect manifest mapping, updated ruleManifestId from missing-encryption-of-sensitive-data-cdk to missing-scaling-notifications-cdk

• python-avoid-string-formatting-in-sql-queries

  • Enhanced to reduce false positives by:
    • Fixing false positives where string literal concatenation (e.g., "SELECT..." + "Name" + ";") was incorrectly flagged as SQL injection — now only flags the + operator when at least one operand is non-constant (user-controlled) data
    • Splitting the combined string formatting regex into separate detection paths for str.format()/% operator and + concatenation, adding a negation condition that suppresses findings when both operands of + resolve to constants

TypeScript

• ts-hardcoded-credentials-ide

  • Enhanced to reduce false positives by:
    • Fixing false positives caused by detecting 4-6 digit numeric strings as hardcoded credentials — now excludes TOTP/OTP verification codes which are temporary tokens
    • Resolving false positives on secret manager configuration variables by excluding identifier patterns like secretId, vaultPath, and secretArn
    • Adding detection for credentials assigned from environment variables with empty string fallbacks (process.env.SECRET || "")

• typescript-cdk-asg-without-patching

  • Enhanced to reduce false positives by:
    • Fixing false positives caused by overly broad pattern matching that flagged AutoScalingGroups even when they were properly managed through patching mechanisms like SubFleet integration or ManagerSpecification.ManagerResource configuration
    • Resolving detection failures for AutoScalingGroups created with module prefixes by replacing generic = ... assignment patterns with specific new () constructor patterns
    • Improving accuracy by ensuring the rule only triggers AutoScalingGroups that lack both SubFleet integration and proper ManagerSpecification.ManagerResource configuration for OS patching

• typescript-cdk-sns-topic-ssl-publish-only

  • Enhanced to reduce false positives by:
    • Fixing false positives caused by overly restrictive pattern matching that required exact constructor parameter positioning for SNS Topic and KMS Key detection in AWS CDK constructs

• typescript-code-injection-hb

  • Enhanced to reduce false positives by:
    • Fixing false positives when user input is validated with regex .test() method in if-guards — both positive and negative validation patterns are now properly recognized as recognized safe usages
    • Adding recognized safe usages detection for .match() method when used for input validation
    • Resolving false positives in Nunjucks template rendering when using hardcoded template strings — nunjucks.renderString() calls with string literals are now excluded

• typescript-cross-site-scripting-ide

  • Enhanced to improve detection coverage and reduce false positives by:
    • Removing false positives from overly broad request object detection by adding validation for legitimate variables that don't represent XSS sources
    • Removing false positives from safe DOM methods like getElementById, querySelector, and textContent that don't introduce XSS vulnerabilities
    • Adding detection for user input flowing into template rendering engines including Handlebars, Pug, EJS, and Mustache render methods

• typescript-csrf-missing-protection-ide

  • Enhanced to reduce false positives by:
    • Fixing false positives on endpoints with route-level CSRF protection middleware like csrfProtection and csrfMiddleware
    • Fixing false positives on custom CSRF middleware that validates x-csrf-token headers
    • Improving detection accuracy by restricting to HTTP-specific handler parameter patterns

• typescript-os-command-injection-hb

  • Enhanced to reduce false positives by:
    • Fixing false positives where RegExp.exec() was incorrectly flagged as child_process.exec()
    • Adding recognized safe usages recognition for negative allowlist guards to reduce false positives on validated input flows

• typescript-server-side-request-forgery-ide

  • Enhanced to reduce false positives and improve detection coverage by:
    • Fixing false positives when user input is properly sanitized with encodeURIComponent() before URL construction
    • Resolving false positives caused by missing recognition of domain allowlist validation patterns including !allowlist.includes() guards and domain.some() validation with early returns
    • Adding detection coverage for class-validator's validate() function and custom validation functions that check URL protocol and hostname against allowlists

• typescript-cdk-open-search-dedicated-master-node

  • Enhanced to improve detection accuracy by:
    • Updating CWE classification from "CWE-693: Protection Mechanism Failure" to "CWE-400: Uncontrolled Resource Consumption" for better alignment with the resource consumption nature of the vulnerability
    • Improving categorization accuracy for OpenSearch Service domains missing dedicated master node configuration in AWS CDK TypeScript code

• typescript-cdk-vpc-flow-logs-enabled

  • Enhanced to reduce false positives by:
    • Fixing CWE mapping for the VPC flow logs rule to ensure proper vulnerability classification
    • Reducing false positives by improving detection of VPC configurations that have flow logs enabled through the flowLogs parameter or separate FlowLog constructs
    • Enhancing coverage to properly identify when VPCs are protected by flow logs configured via FlowLogResourceType.fromVpc() method calls

• typescript-csrf-before-method-override

  • Enhanced to reduce false positives by:
    • Fixing false positives in function-scoped Express middleware registration where express.methodOverride() is correctly placed before express.csrf()
    • Adding detection for methodOverride on the same receiver object via callee→receiver→data-dependents traversal, suppressing findings when middleware ordering is correct within standalone functions, arrow functions, and outer-scoped contexts

• typescript-path-traversal-hb

  • Enhanced to reduce false positives and improve detection coverage by:
    • Removing false positives caused by regex .test() validation, allowlist positive checks, path.normalize combined with startsWith containment, and custom isPathSafe function calls being incorrectly flagged as path traversal vulnerabilities
    • Adding pattern-not-inside exclusions on path.join sink for normalize+startsWith and isPathSafe pre-checks
    • Adding API coverage from fs families

• typescript-jwt-secret-hardcoded

  • Enhanced to reduce false positives by:
    • Fixing false positives where JWT secrets loaded from safe sources - fs.readFileSync(), configuration objects like config.jwt.secret, and class instance method calls getSecret() - were incorrectly flagged as hardcoded credentials
    • Adding negation logic to exclude method invocations and class instance creations from the string-type data filter, so only actual string literals are flagged