Matt Van Horn f183381739 feat(audit): report what a shipped app exposes to static analysis ...

Adds `audit_release_exposure` and `rea audit-release-exposure` to report
source maps, Electron fuse implications, extractable payloads, debug
information, build metadata, and credential markers. Checks carry stable
IDs, observations, statuses, and fixed remediation, while incomplete and
unassessed checks remain visible without implying a security verdict.
Credential findings include only rule IDs and locations. The CLI
supports `--fail_on` severity thresholds and exits 3 when an exposed
check meets the threshold.

2026-11-01 02:41:37 -08:00

..

analysis-efficiency

fix(docs): preserve verification reports after experiment archival (#7462)

2026-10-27 15:10:48 +08:00

android-jni-bindings-2026-10-27.md

feat(android): link native declarations to static JNI candidates (#7472)

2026-10-27 18:53:22 +08:00

android-manifest-components-2026-10-24.md

feat(android): project a structured manifest component inventory (#5025)

2026-10-24 17:14:23 +08:00

android-r8-mapping-2026-10-27.md

feat(android): apply caller-selected R8 mapping evidence (#7456)

2026-10-27 15:47:08 +08:00

apk-signature-2026-10-22.json

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

apk-signature-2026-10-22.md

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

apple-ips-2026-10-24.md

feat(apple): inspect IPS crash reports (#6511)

2026-10-24 16:02:59 +08:00

browser-saved-values-2026-10-26.md

feat(browser): reuse saved response values across scenario steps (#7267)

2026-10-27 08:15:52 +08:00

browser-scenario-validation-2026-10-27.md

feat(cli): validate browser scenarios offline (#7343)

2026-10-27 08:47:36 +08:00

capability-composition-2026-11-01.md

refactor(composition): unify capability bindings and cleanup ownership (#8441)

2026-11-01 13:30:21 +08:00

cli-json-lines-2026-10-23.md

feat(cli)!: export row-oriented results as JSON Lines (#5629)

2026-10-24 02:13:28 +08:00

cli-version-report-2026-10-23.md

feat(cli): report version and runtime with an explicit output format (#6530)

2026-10-24 00:06:03 +08:00

electron-cancellation-2026-10-16.json

fix(electron): preserve cancellation across waits, state reads and cleanup

2026-10-16 21:12:26 +08:00

electron-cancellation-2026-10-16.md

docs(limits): describe how to design admission recovery (#6368)

2026-10-23 05:10:36 +08:00

electron-ipc-listeners-2026-10-16.json

fix(electron): preserve native IPC listener behavior (#4389)

2026-10-17 04:17:11 +08:00

electron-ipc-listeners-2026-10-16.md

fix(electron): preserve native IPC listener behavior (#4389)

2026-10-17 04:17:11 +08:00

electron-native-once-2026-10-16.json

fix(electron): delegate once dispatch to the active runtime (#4605)

2026-10-17 06:38:13 +08:00

electron-native-once-2026-10-16.md

fix(electron): delegate once dispatch to the active runtime (#4605)

2026-10-17 06:38:13 +08:00

electron-native-once-2026-10-16.review.rows.jsonl

fix(electron): delegate once dispatch to the active runtime (#4605)

2026-10-17 06:38:13 +08:00

electron-native-once-2026-10-16.rows.jsonl

fix(electron): delegate once dispatch to the active runtime (#4605)

2026-10-17 06:38:13 +08:00

electron-shell-sync-2026-10-16.json

fix(electron): block synchronous shell effects during capture

2026-10-16 21:03:12 +00:00

electron-shell-sync-2026-10-16.md

fix(electron): block synchronous shell effects during capture

2026-10-16 21:03:12 +00:00

evidence-input-composition-2026-10-31.json

refactor(evidence): unify retained inputs across domains (#8299)

2026-10-31 14:45:21 +00:00

evidence-input-composition-2026-10-31.md

refactor(evidence): unify retained inputs across domains (#8299)

2026-10-31 14:45:21 +00:00

ghidra-dol-2026-10-24.md

feat(ghidra): analyze GameCube/Wii DOL executables through Ghidra (#6240)

2026-10-24 17:56:31 +08:00

ghidra-procedure-timeout-2026-10-23.md

feat(ghidra): bound one procedure's decompile without closing the session (#5662)

2026-10-24 07:42:50 +08:00

gpu-code-objects-2026-10-21.json

feat(gpu): inspect static CUDA and HIP code objects (#5813)

2026-10-21 19:06:44 +08:00

gpu-code-objects-2026-10-21.md

feat(gpu): inspect static CUDA and HIP code objects (#5813)

2026-10-21 19:06:44 +08:00

il2cpp-generic-instances-2026-10-24.md

feat(il2cpp): link generic method instances behind --generic-instances (#5785)

2026-10-24 16:19:05 +08:00

investigation-lifecycle.md

feat(investigation)!: retain records across engine cleanup (#8361)

2026-10-31 21:34:45 +00:00

javascript-analysis-effects-2026-10-15.json

fix(javascript): declare owned analysis worker effects

2026-10-15 21:36:12 +08:00

javascript-analysis-effects-2026-10-15.md

fix(verifiers): centralize failure and cleanup ownership

2026-10-24 15:38:35 +08:00

javascript-assignment-influence-2026-10-24.md

feat(javascript): link assignment right-hand sides to their writes (#6206)

2026-10-24 10:04:38 +08:00

javascript-interruption-applicability-2026-10-15.json

fix(javascript): preserve analysis applicability after interruption (#4207)

2026-10-16 03:46:00 +08:00

javascript-interruption-applicability-2026-10-15.md

fix(javascript): preserve analysis applicability after interruption (#4207)

2026-10-16 03:46:00 +08:00

javascript-literal-byte-budget-2026-10-15.json

fix(javascript): enforce semantic byte bounds for literals

2026-10-15 23:43:05 +08:00

javascript-literal-byte-budget-2026-10-15.md

fix(javascript): enforce semantic byte bounds for literals

2026-10-15 23:43:05 +08:00

javascript-module-references-2026-10-15.json

feat(javascript): add filtered retained module reference views

2026-10-15 21:05:00 +08:00

javascript-module-references-2026-10-15.md

feat(javascript): add filtered retained module reference views

2026-10-15 21:05:00 +08:00

javascript-native-handoff-identity-2026-10-15.json

fix(javascript): bind native handoffs to canonical byte identity

2026-10-15 17:08:49 +00:00

javascript-native-handoff-identity-2026-10-15.md

fix(javascript): bind native handoffs to canonical byte identity

2026-10-15 17:08:49 +00:00

javascript-retained-facts-2026-10-15.json

feat(javascript): query retained application facts by exact path (#4265)

2026-10-16 12:46:53 +08:00

javascript-retained-facts-2026-10-15.md

refactor(javascript)!: consolidate renderer and route ownership

2026-10-27 09:05:24 +08:00

javascript-route-inventory-2026-10-21.md

docs: archive historical verification and release inventories (#7519)

2026-10-28 00:54:54 +08:00

javascript-source-paths-json-2026-10-24.md

feat(cli): accept JavaScript source selections from a JSON array or file (#5029)

2026-10-24 12:32:41 +08:00

javascript-window-options-2026-10-16.json

feat(electron): resolve stable local constant window options

2026-10-16 14:52:33 +08:00

javascript-window-options-2026-10-16.md

docs(limits): describe how to design admission recovery (#6368)

2026-10-23 05:10:36 +08:00

native-decompile-directory-2026-10-23.md

fix(analysis): retain source evidence through directory exports (#7250)

2026-10-26 23:56:03 +08:00

native-function-summary-2026-10-23.md

feat(analysis)!: default function MCP output to retained summaries (#5660)

2026-10-24 08:18:53 +08:00

pe-imports-2026-10-24.md

feat(pe): inspect import and delay-load tables (#6509)

2026-10-24 11:44:12 +08:00

pe-load-config-2026-10-24.md

feat(pe): inspect TLS callbacks and load configuration (#7008)

2026-10-24 22:06:41 +08:00

release-exposure-2026-10-31.md

feat(audit): report what a shipped app exposes to static analysis

2026-11-01 02:41:37 -08:00

runtime-analysis-settings.md

feat(mcp): support runtime analysis limit recovery (#7049)

2026-10-25 09:45:26 +08:00

web-bundle-paging-2026-10-26.md

feat(web): page retained bundle endpoint observations and inferences (#7259)

2026-10-27 01:37:39 +08:00