April 2026 change log

Feature Add

Python

• python-llm-improper-output-handling

  • Created new rule to detect unsanitized LLM output in dangerous execution contexts:
    • Unsanitized LLM-generated content directly processed or rendered causing code injection, SQL injection, XSS, command injection, and deserialization attacks (CWE-94, CWE-89, CWE-79, CWE-78, CWE-502, OWASP LLM05)
    • Covers 10+ LLM providers (OpenAI, Anthropic, Hugging Face, Google AI, Replicate, AWS Bedrock, AI21, Together AI, Mistral AI, LiteLLM) with 35+ sink patterns detecting exec(), eval(), subprocess, os.system(), database cursors, HTML responses, pickle.loads(), yaml.load(), and marshal.loads()

• python-llm-unbounded-consumption

  • Created new rule to detect unbounded LLM API resource consumption:
    • LLM API calls without resource constraints (token limits, timeouts, input validation, rate limiting) causing DoS, cost exploitation, resource exhaustion, and model theft (CWE-400, CWE-770, OWASP LLM10)
    • Covers 8 LLM providers (OpenAI, Anthropic, AWS Bedrock, Transformers, LangChain, Ollama, Google AI, Cohere) detecting missing max_tokens, max_length, max_new_tokens, timeouts, input validation, rate limiting, batch processing without controls, and excessive limits

• python-llm-system-prompt-leakage

  • Created new rule to detect system prompt exposure in LLM applications:
    • Internal system prompts, instructions, or contextual information inadvertently exposed through API responses, logs, headers, or UI elements revealing sensitive implementation details (CWE-200, OWASP LLM07)
    • Covers OpenAI, Anthropic, Streamlit, Gradio, Flask, FastAPI, and web frameworks detecting system prompt exposure in API responses, HTTP headers, conditional responses, and UI elements with LLM-specific pattern-inside validation

• python-prompt-injection-vulnerability

  • Created new rule to detect unsafe input interpolation in LLM prompts:
    • User-controlled input from HTTP requests, files, and environment variables unsafely interpolated into LLM prompts enabling prompt injection, jailbreaking, and data exfiltration attacks (CWE-94, CWE-20, OWASP LLM01)
    • Covers 14+ LLM providers (OpenAI, Anthropic, AWS Bedrock, Google Vertex AI, Azure OpenAI, Cohere, Hugging Face, Ollama, Replicate, Mistral AI, AI21, Perplexity, Anyscale, Together AI) with detection for f-strings, format(), %, concatenation across web frameworks, file operations, JSON parsing, and command-line arguments

• python-llm-vector-embeddings-weaknesses

  • Created new rule to detect insecure RAG vector embedding operations:
    • RAG implementations with vector embeddings lacking access controls or data validation causing embedding inversion attacks, data poisoning, and cross-context information leaks in multi-tenant environments (CWE-200, CWE-284, CWE-20, OWASP LLM08)
    • Covers 30+ sources, 40+ sinks, 15+ sanitizers covering vector databases (ChromaDB, FAISS, Pinecone, Weaviate), LangChain vector stores, ML frameworks (Transformers, OpenAI embeddings, Sentence Transformers) detecting missing authentication, unvalidated embeddings, metadata injection, and cross-tenant data leaks

• python-llm-sensitive-information-disclosure

  • Created new rule to detect sensitive data leakage in LLM interactions:
    • API keys, PII, financial data, credentials, medical records, and proprietary business information exposed through LLM prompts, training data, or model outputs (CWE-200, CWE-209, OWASP LLM02)
    • Covers 7 provider groups (OpenAI/Azure, Hugging Face, LangChain, LlamaIndex, AWS Bedrock, Google Vertex AI, cross-platform configs) detecting API keys (sk-proj-, AKIA), SSNs, credit cards, phone numbers, database credentials, OAuth tokens, JWT tokens, private keys, medical records, and trade secrets

• python-untrusted-deserialization

  • Added a new security rule to detect unsafe deserialization vulnerabilities in Python code (CWE-502):
    • Identifies when applications deserialize untrusted data from HTTP requests, user input, files, or network sources using unsafe functions like pickle, marshal, yaml.load, and similar libraries that can execute arbitrary code during deserialization
    • Includes comprehensive test cases covering vulnerable patterns across multiple deserialization libraries and safe alternatives like json.loads() and yaml.safe_load()

JavaScript

• javascript-llm-prompt-injection

  • Created new rule to detect unsanitized input concatenation in LLM prompts:
    • User-controlled input from HTTP requests directly concatenated or embedded into LLM prompts without sanitization enabling prompt injection, jailbreaking, and data exfiltration attacks (CWE-94, CWE-20)
    • Covers 11 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI, Cohere, Replicate, Hugging Face, LangChain OpenAI/Anthropic/Core) detecting string concatenation (+), template literals (${...}), unsafe templates across HTTP request bodies, query parameters, headers, cookies, path parameters, and form data

• javascript-llm-improper-output-handling

  • Created new rule to detect unsafe LLM output consumption in application sinks:
    • Unsanitized LLM output used in dangerous contexts causing XSS, SQL/NoSQL/GraphQL injection, command injection, code execution, path traversal, ReDoS, email header injection, and CSV formula injection (CWE-79, CWE-89, CWE-78, CWE-94, OWASP LLM05)
    • Covers 18 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI, Cohere, AI21, Replicate, Groq, Mistral AI, Together AI, Perplexity, AWS Bedrock, Hugging Face, LangChain) detecting 14 vulnerability types across HTML rendering, database queries (SQL/NoSQL/GraphQL), exec()/spawn(), eval()/Function(), template engines (EJS/Handlebars), file operations, redirects, regex compilation, and email/CSV generation

• javascript-llm-system-prompt-leakage

  • Created new rule to detect hardcoded system prompt exposure in LLM code:
    • Hardcoded sensitive system prompts containing confidential instructions, proprietary algorithms, credentials, or internal policies directly exposed in LLM applications (CWE-200, CWE-209, OWASP LLM07)
    • Covers 15 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI, Cohere, Replicate, Hugging Face, LangChain OpenAI/Anthropic/Core, Vercel AI, LlamaIndex) detecting hardcoded prompts with keywords like "SECRET", "CONFIDENTIAL", "INTERNAL", "PROPRIETARY", "PASSWORD", "API_KEY", "CREDENTIAL"

• javascript-llm-sensitive-information-disclosure

  • Created new rule to detect sensitive data exposure in LLM provider calls:
    • Credentials, PII, financial data, cryptographic keys, authentication tokens, biometric data, and infrastructure secrets exposed in LLM prompts sent to external providers (CWE-200, OWASP LLM02)
    • Covers 18 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI/Cloud, Cohere, AI21, Replicate, Groq, Mistral AI, Together AI, Perplexity, AWS Bedrock, Hugging Face, LangChain) detecting database credentials, AWS/Azure keys, SSNs, credit cards (full number/CVV), RSA private keys, OAuth/JWT tokens, password hashes, biometric identifiers (fingerprints/iris/facial encodings), and connection strings

• javascript-llm-vector-embedding-weaknesses

  • Created new rule to detect insecure vector operations in RAG systems:
    • Unsanitized user input in RAG systems directly used in vector operations, embeddings, or semantic search causing data poisoning, unauthorized access, cross-context leaks, embedding inversion attacks, and behavior alteration (OWASP LLM08)
    • Covers vector databases (Pinecone, Weaviate, ChromaDB, Supabase), embedding APIs (OpenAI, Hugging Face, Cohere, Xenova Transformers), search engines (Redis, Elasticsearch, Milvus), LangChain (embeddings/vectorstores/chains), and document processors (pdf-parse, mammoth, xlsx, cheerio, markdown-it) detecting unvalidated vector queries, embedding generation, document processing, and missing access controls

• javascript_llm_unbound_consumption

  • Created new rule to detect unbounded LLM API resource consumption:
    • LLM API calls without resource constraints (token limits, timeouts, rate limiting, input validation) causing DoS, cost exploitation, resource exhaustion, model theft, and service degradation (CWE-400, OWASP LLM10)
    • Covers 14 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI, Cohere, Replicate, AWS Bedrock, Hugging Face, LangChain OpenAI/Anthropic/Core/Chains) detecting missing max_tokens/maxTokens, timeouts/AbortController, input length validation, rate limiting middleware, unbounded loops/recursion, streaming limits, retry limits, and concurrency controls

TypeScript

• typescript-llm-prompt-injection

  • Created new rule to detect unsanitized input concatenation in LLM prompts:
    • User-controlled input from HTTP requests directly concatenated or embedded into LLM prompts without sanitization enabling prompt injection, jailbreaking, and data exfiltration attacks (CWE-94, CWE-20)
    • Covers 11 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI, Cohere, Replicate, Hugging Face, LangChain OpenAI/Anthropic/Core) detecting string concatenation (+), template literals (${...}), unsafe templates across HTTP request bodies, query parameters, headers, cookies, path parameters, and form data

• typescript-llm-improper-output-handling

  • Created new rule to detect unsafe LLM output consumption in application sinks:
    • Unsanitized LLM output used in dangerous contexts causing XSS, SQL/NoSQL/GraphQL injection, command injection, code execution, path traversal, ReDoS, email header injection, and CSV formula injection (CWE-79, CWE-89, CWE-78, CWE-94, OWASP LLM05)
    • Covers 18 LLM providers (OpenAI, Azure OpenAI, Anthropic, Google AI, Cohere, AI21, Replicate, Groq, Mistral AI, Together AI, Perplexity, AWS Bedrock, Hugging Face, LangChain) detecting 14 vulnerability types across HTML rendering, database queries (SQL/NoSQL/GraphQL), exec()/spawn(), eval()/Function(), template engines (EJS/Handlebars), file operations, redirects, regex compilation, and email/CSV generation

• typescript-llm-system-prompt-leakage

  • Created new rule to detect hardcoded system prompt exposure in LLM code:
    • Rule identifies vulnerabilities where hardcoded sensitive prompts containing credentials or proprietary information are exposed (CWE-200, CWE-209)
    • Covers 15 LLM providers detecting prompts with keywords like "SECRET", "CONFIDENTIAL", "INTERNAL", "PROPRIETARY"
    • Prevents system prompt extraction and information disclosure in TypeScript applications while recognizing safe patterns like generic prompts and input validation

• typescript-llm-sensitive-information-disclosure

  • Created new rule to detect sensitive data exposure in LLM provider calls:
    • Rule identifies TypeScript vulnerabilities where credentials, PII, financial data, and cryptographic keys are exposed in LLM prompts (CWE-200)
    • Covers 18 LLM providers detecting database passwords, AWS/Azure credentials, SSNs, credit cards, OAuth tokens, and biometric data
    • Prevents credential and PII exposure in TypeScript applications while recognizing safe patterns like anonymized identifiers and de-identified data

• typescript_llm_unbound_consumption

  • Created new rule to detect unbounded LLM API resource consumption:
    • Rule detects TypeScript vulnerabilities where LLM calls lack resource constraints causing DoS and cost exploitation (LLM10:2025)
    • Covers 14 LLM providers detecting missing max_tokens, timeouts, rate limits, and unbounded loops
    • Prevents service outages and financial losses in TypeScript applications while recognizing safe patterns like token limits and concurrency controls

• typescript-llm-vector-embedding-weaknesses

  • Created new rule to detect insecure vector operations in RAG systems:
    • Unsanitized user input in RAG systems directly used in vector operations, embeddings, or semantic search causing data poisoning, unauthorized access, cross-context leaks, embedding inversion attacks, and behavior alteration (OWASP LLM08)
    • Covers vector databases (Pinecone, Weaviate, ChromaDB, Supabase), embedding APIs (OpenAI, Hugging Face, Cohere, Xenova Transformers), search engines (Redis, Elasticsearch, Milvus), LangChain (embeddings/vectorstores/chains), and document processors (pdf-parse, mammoth, xlsx, cheerio, markdown-it) detecting unvalidated vector queries, embedding generation, document processing, and missing access controls

Scala

• scala-deserialization-of-untrusted-data
  • Created new taint-mode Scala deserialization rule (CWE-502) with:
    • Adding taint-mode detection for 12+ deserialization sinks: Java native serialization (ObjectInputStream, XMLDecoder), third-party libraries (Kryo, XStream, Jackson, Gson, SnakeYAML), Apache Commons SerializationUtils, RMI/JNDI operations, Hessian/Burlap protocols, Akka serialization, Play Framework JSON, and Spring RemoteInvocation
    • Taint sources for Servlet API, Play Framework, Akka HTTP, and type-constrained Socket/SSLSocket streams
    • Sanitizers for SafeConstructor, ObjectInputFilter allowlists, and file-based inputs
    • Path exclusions for test/demo/example/benchmark files to reduce false positives

Kotlin

• kotlin-deserialization-config
  • Created new rule to detect unsafe deserialization configurations:
    • Jackson enableDefaultTyping(), activateDefaultTyping() with LaissezFaireSubTypeValidator, and SnakeYAML Yaml() / Yaml(Constructor()) without SafeConstructor

Bug Fixes / Enhancement

Python

• python-log-injection

  • Enhanced to improve detection coverage and reduce false negatives by:
    • Restructuring rule logic to detect two distinct vulnerability patterns: Lambda event parameters directly passed to logs and tainted data flows from user input sources to log statements
    • Expanding log call detection to cover additional logging frameworks and patterns including Django logging utilities
    • Reducing false positives by recognizing common sanitization and encoding patterns

• python-detect-hardcoded-aws-credentials

  • Enhanced to reduce false negatives by:
    • Adding interprocedural analysis to detect hardcoded AWS credentials defined as module-level constants and passed to boto3 clients through function calls
    • Improving credential flow tracing to flag hardcoded access keys and secret keys regardless of where they are defined in the file

• python-os-command-injection-hb

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection patterns for 7 additional command execution libraries: plumbum, spur, delegator, envoy, pexpect, ptyprocess, and os.posix_spawn/posix_spawnp
    • Adding generic allowlist validation sanitizers for set and list-based validation with terminating statements (return/raise)

• python-no-sql-injection

  • Enhanced to reduce false positives by:
    • Adding sanitizer patterns to recognize compiled regex pattern.search() operations as safe, preventing false positives when regex patterns are used for string matching rather than database queries
    • Adding sanitizer for compiled regex patterns used within loops (for pattern in patterns: pattern.search(line))
    • Adding sanitizer for direct compiled regex pattern usage at module level (re.compile().search())
    • Adding sanitizer for direct re.search() calls at module level
    • Adding FP test cases demonstrating legitimate regex pattern matching on text content

JavaScript

• javascript-insecure-random

  • Enhanced to improve detection coverage and reduce false positives by:
    • Detecting Math.random() in 6 security-sensitive contexts: .toString() in modules, security-named variables, UUID/hex multiplication, security-named functions/arrows/methods, and charAt/fromCharCode patterns
    • Adding noise reduction via path exclusions (test/fixture/mock/game/simulation/tutorial), UI variable name exclusions, and React hook exclusions (useMemo/useCallback)

• javascript-os-command-injection-hb

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection patterns for Bun runtime command execution APIs (Bun.spawn, Bun.spawnSync) and execa.sync() synchronous execution
    • Removing invalid fork() pattern (not applicable to CWE-78 as it executes Node.js modules, not shell commands)
    • Fixing false positives where spawn() with array arguments and no shell option was incorrectly flagged

• javascript-cross-site-scripting

  • Enhanced to improve XSS recall and detection coverage by:
    • Adding jsonp as a new taint source in the JavaScript input-helper-sources configuration, alongside existing HTTP methods (get, post, patch, delete, put, route, all)
    • Adding 9 new true positive test cases covering multiple XSS attack vectors including req.query template literal sinks, $sce.trustAs() with HTML/RESOURCE_URL/JS context types, and DOM-based XSS via window.location.search
    • Expanding sink pattern coverage for Angular's $sce.trustAs() with HTML, RESOURCE_URL, and JS context types

TypeScript

• typescript-os-command-injection-hb

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection patterns for 9 additional command execution methods: ssh2 library, node-powershell v3/v4/v5 APIs, util.promisify(child_process.execFile), Windows cmd.exe/powershell.exe/wscript.exe execution, and Fastify/Koa.js framework sources
    • Fixing false positives from overly broad URL parsing source patterns by constraining to request-specific patterns

• typescript-path-traversal-hb

  • Enhanced to improve performance and prevent timeout issues by:
    • Removing overly broad source pattern file that was matching every local variable named file, causing massive taint propagation across the codebase
    • Removing duplicate patterns and redundant patterns, converting verbose multi-line pattern forms to single-line equivalents to reduce structural matching cost
    • Removing expensive crypto.createHash pattern block with pattern-not-inside conditions that caused exponential backtracking
    • Consolidating express.static from two separate patterns into a single pattern and simplifying archive extraction patterns
    • Achieving ~17% latency reduction on large repositories (n8n: 73.4s → 61.2s)

C

• c-os-command-injection

  • Enhanced to improve detection coverage and reduce false negatives by:
    • Expanding taint sources to detect additional input vectors including scanf family, fgets, getline, read/recv/recvfrom, fread, and string operations like strcpy, strcat, sprintf/snprintf
    • Adding pattern propagators for sprintf/snprintf to track taint flow through string formatting operations into command execution sinks
    • Expanding sink coverage to include additional dangerous functions such as wordexp, posix_spawn, posix_spawnp, and dlopen
    • Reducing false positives by recognizing common sanitization and validation function patterns such as sanitize, escapeshell, shellquote, validate, and clean_input, as well as if-guarded input checks

• c-clear-text-protocols

  • Enhanced to improve detection coverage and reduce false positives by:
    • Detecting clear-text protocol URLs (HTTP, FTP, Telnet, SMTP, IMAP, LDAP, POP3, TFTP) in declarations, function arguments, struct fields, and libcurl calls
    • Adding localhost/loopback and RFC 2606 example.com exclusions to reduce false positives

CPP

• cpp-incorrect-pseudorandom-number-generator

  • Enhanced to improve detection coverage by:
    • Expanding detection to cover 30+ insecure PRNG APIs including rand/srand family, POSIX drand48 family, C++ engines, and Boost.Random engines
    • Reducing false positives by excluding std::random_device-seeded engines and adding path exclusions for test, game, and simulation code

• cpp-insufficient-key-size

  • Enhanced to improve detection coverage by:
    • Expanding key size validation across 11 pattern branches covering OpenSSL, Crypto++, and Botan APIs for RSA, DSA, and DH key generation
    • Detecting weak key sizes below 2048 bits using metavariable-comparison

C#

• weak-random-number-generation-csharp-rule

  • Enhanced to improve detection coverage by:
    • Adding Random.Shared detection for .NET 6+ static Random usage patterns
    • Expanding method coverage to include Next, NextBytes, NextDouble, NextInt64, and NextSingle

• insecure-cryptography-csharp-rule

  • Enhanced to improve detection coverage by:
    • Expanding weak constructor detection to 13 types including HMACMD5, HMACRIPEMD160, MD5Cng, SHA1Cng, and RijndaelManaged
    • Adding DES/TripleDES/RC2 static Create() and base class factory patterns

• weak-cipher-algorithm

  • Enhanced to improve detection coverage by:
    • Adding BouncyCastle engine detection for RC4, Blowfish, IDEA, Cast5, and Seed
    • Adding SymmetricAlgorithm.Create, CipherUtilities.GetCipher, and CryptoConfig.CreateFromName factory patterns

• csharp-untrusted-deserialization

  • Enhanced to improve detection accuracy and reduce false positives by:
    • Adding detection patterns for 12+ serialization libraries: System.Text.Json, Protobuf-net, Bond, XmlSerializer, JSON.NET, ServiceStack.Text, DataContractSerializer, YamlDotNet, MessagePack, BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter, and ObjectStateFormatter
    • Refactoring from pattern-based matching to taint-mode analysis, tracking data flow from HTTP/socket sources (ASP.NET Classic/Core, HttpContext, WebRequest, Socket/TcpClient) to deserialization sinks
    • Removing false positive sinks for FsPickler, JavaScriptSerializer with SimpleTypeResolver, and DataContractResolver/SimpleTypeResolver class inheritance patterns

Java

• java-unsafe-finalize-method

  • Enhanced to improve detection coverage by:
    • Detecting resource release inside deprecated finalize() method
    • Handling different finalize() method forms (with or without throws Throwable, direct or delegated cleanup)

• java-os-command-injection-ide

  • Enhanced to improve detection coverage by:
    • Detecting user-controlled input (HTTP params, env vars) reaching native system calls like system, popen, fopen, and exec-family functions via Java's Foreign Function & Memory API
    • Detecting both older (CLinker) and newer Linker APIs
    • Reducing false positives by ignoring validated inputs (allowlists/mapping) and safe file path checks

• java-os-command-injection-hb

  • Enhanced to improve detection coverage and reduce false negatives by:
    • Adding detection patterns for 10 additional command execution libraries: Apache Commons Exec, Apache Ant ExecTask, AWS SSM SendCommand, Docker Java Client, Kubernetes Java Client, JSch SSH, SSHJ, Apache MINA SSHD, Groovy Shell, and Hudson Launcher
    • Expanding sanitizers to recognize negative validation patterns with early return/throw control flow and compound regex/allowlist conditions

• java-deprecated-cryptographic-classes

  • Enhanced to improve detection coverage by:
    • Adding weak ciphers (DES, DESede, RC2, RC4, Blowfish, IDEA), ECB mode detection, weak hashes (MD2–MD5, SHA-1, RIPEMD160), and deprecated TLS/SSL protocols
    • Adding weak RSA/DSA key size detection below 2048 bits, deprecated key specs, and sun.security.* classes
    • Reclassifying from CodeQuality to SAST category

• java-log-injection-hb

  • Enhanced to improve detection precision and reduce false positives by:
    • Fixing regex pattern for logging level metavariable matching that was causing multi-line detection spans instead of single-line findings
    • Adding strict anchors (^ and $) to the logging level regex to enforce exact word matching (info, debug, error, warn, trace, severe, config, etc.)
    • Preventing partial matches where config in method names like configurationSource() was triggering false detections in Spring Security configuration blocks

• java-no-sql-injection-hb

  • Enhanced to fix false negatives and improve detection coverage by:
    • Refactoring taint tracking approach by moving overly broad pattern-sources and pattern-sinks to pattern-propagators for more precise taint flow analysis
    • Adding specific dangerous MongoDB operator sink patterns: $where, $function, $accumulator injection via new Document()
    • Adding pattern propagators to track taint flow through put(), append(), Map get()/getOrDefault()/values(), and JSONObject/JSON parser operations
    • Adding literal-key put/append sanitizers to prevent false positives for parameterized queries
    • Adding safe Document construction sanitizer pattern with hardcoded non-operator field names

• java-untrusted-load

  • Enhanced to improve detection coverage by:
    • Adding detection patterns for 5 additional deserialization libraries: HessianInput and Hessian2Input (Caucho serialization), BurlapInput (Caucho XML), Castor XML Unmarshaller, FSTObjectInput (fast-serialization v1 and v2/nustaq), and JBoss Marshalling Unmarshaller

• java-insecure-deserialization-serialization-utils

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection patterns for YamlBeans (YamlReader.read()) and XStream factory pattern usage (XStreamFactory.getInstance().fromXML()) with import constraints to prevent false positives
    • Adding import constraints for Cookie source (javax.servlet.http.Cookie / jakarta.servlet.http.Cookie) and JAX-RS endpoint context constraints for InputStream source patterns

Go

• go-os-command-injection-hb

  • Enhanced to improve detection coverage by:
    • Adding 16 new sink patterns for low-level syscall execution (syscall.Exec, syscall.ForkExec), Windows cmd.exe with /c and /k flags, PowerShell and PowerShell Core with -Command and -EncodedCommand flags
    • Adding map-based allowlist sanitizer pattern supporting type-agnostic map[string]$TYPE validation

• go-weak-rand-source

  • Enhanced to improve detection coverage by:
    • Adding standalone math/rand function calls, aliased import detection, and math/rand/v2 functions
    • Reducing false positives on crypto/rand.Read() in benchmark code

• go-weak-crypto

  • Enhanced to improve detection coverage by:
    • Converting from taint mode to search mode to eliminate false negatives
    • Adding 6 new x/crypto families: md4, ripemd160, blowfish, cast5, tea, xtea

• go-bad-tls-settings

  • Enhanced to improve detection coverage by:
    • Expanding insecure cipher suite detection to include ECDHE CBC ciphers and RSA key exchange ciphers per NIST SP 800-52 Rev 2
    • Adding deprecated TLS version detection (SSL 3.0, TLS 1.0, TLS 1.1) and InsecureSkipVerify patterns

• go-unsafe-deserialization

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection patterns for 4 additional deserialization libraries: GOB (encoding/gob), MessagePack (vmihailenco/msgpack v4/v5), Protobuf (google.golang.org/protobuf/proto), and YAML v2/v3 (gopkg.in/yaml.v2, gopkg.in/yaml.v3) with support for both aliased and non-aliased imports
    • Adding sanitizers for filesystem reads (os.ReadFile, os.Open), allowlist validation (Contains method and map lookup with terminating return), and regex format validation (MatchString with terminating return)

Scala

• scala-os-command-injection-hb

  • Enhanced to improve detection coverage by:
    • Adding sink patterns for FS2 ProcessBuilder, JNA Function.invoke, Apache Commons Exec CommandLine.parse, Scala Native LibC.system, and ZIO Process Command (.run, .string, .lines, .exitCode)

• scala-insecure-random

  • Enhanced to improve detection coverage by:
    • Adding detection for java.util.Random, ThreadLocalRandom, scala.util.Random companion object methods, and Scala 3 apply syntax
    • Adding Apache Commons RandomStringUtils and RandomDataGenerator detection

• scala-hazelcast-symmetric-encryption

  • Enhanced to improve detection coverage by:
    • Adding weak algorithm detection (DES, RC4, RC2, Blowfish, AES/ECB), key length validation, and iteration count comparison per NIST SP 800-132
    • Supporting val and var declarations with imported and fully qualified constructors

Kotlin

• kotlin-unsafe-deserialization
  • Enhanced to improve detection coverage and reduce false positives by:
    • Refactoring from pattern-based matching to taint-mode analysis with HTTP/Spring annotation sources
    • Adding detection sinks for XStream, XMLDecoder, Gson (Object/Any type), and Apache Commons SerializationUtils
    • Adding sanitizers for SafeConstructor, BasicPolymorphicTypeValidator, file inputs, classpath resources, and Android local storage

PHP

• php-using-pseudorandom-number

  • Enhanced to improve detection coverage by:
    • Adding 4 missing insecure PRNG functions: array_rand(), lcg_value(), srand(), mt_srand()
    • Replacing flat patterns with metavariable-regex matching for cleaner detection

• php-openssl-cbc-static-iv

  • Enhanced to improve detection coverage by:
    • Expanding from 1 CBC-only pattern to 15 consolidated patterns covering openssl, mcrypt, and sodium APIs
    • Adding detection for hex2bin, str_repeat, base64_decode, md5-derived, and null IVs

• php-weak-crypto

  • Enhanced to improve detection coverage by:
    • Adding weak hash functions (md5, sha1, crc32, str_rot13) and hash()/hash_hmac() with weak algorithms
    • Adding openssl_decrypt detection and legacy mcrypt API detection
    • Fixing false positives where secure ciphers like aes-128-gcm were incorrectly flagged

• php-mcrypt-use

  • Enhanced to improve detection coverage by:
    • Removing pattern-not that caused false negatives on string literal arguments
    • Adding namespace-prefixed mcrypt call detection and reclassified from CWE-676 to CWE-327

• php-untrusted-deserialization

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding detection patterns for 5 additional deserialization sinks: WordPress maybe_unserialize(), YAML parsing (yaml_parse, yaml_parse_file, yaml_parse_url), and session deserialization (session_decode)
    • Adding sanitizer patterns for unserialize() with allowed_classes set to false or empty array [] to prevent object instantiation

Ruby

• ruby-insecure-random

  • Enhanced to improve detection coverage by:
    • Detecting Kernel#rand, Random.new, Random.rand/srand, and Kernel.rand/srand
    • Adding path exclusions for test, game, and demo files; secure alternatives (SecureRandom) not flagged

• ruby-weak-cipher

  • Enhanced to improve detection coverage by:
    • Detecting DES, 3DES, DESX, RC2, RC4, Blowfish, IDEA, SEED, CAST5 via OpenSSL::Cipher.new and class-based instantiation
    • Adding ECB mode detection on AES, ARIA, and Camellia

• ruby-untrusted-deserialization

  • Enhanced to improve detection coverage and reduce false positives by:
    • Adding 9 new deserialization sinks: Plist, Syck, MessagePack, BSON, PStore, YAML::Store, Ox, ActiveSupport::MessageVerifier, and ActiveSupport::MessageEncryptor
    • Adding taint sources for cookies, request.query, request.params, Rack env hashes, and params method calls (.fetch, .dig)
    • Adding sanitizers for Plist with marshal: false and Ox with safe modes (:generic, :hash, :limited)