Repository navigation

Release 0.11.0 (candidate for review): fail-closed secret gate, reverse shells, 26 fixes - #276

Open

Rome-1 wants to merge 77 commits into

mainfrom

release/0.11.0

Open

Release 0.11.0 (candidate for review): fail-closed secret gate, reverse shells, 26 fixes#276
Rome-1 wants to merge 77 commits into
mainfrom
release/0.11.0

Commits on Oct 6, 2026
Commits on Oct 12, 2026
Commits on Oct 13, 2026
- fix(policy): scan with defaults when .rafter.yml cannot be loaded
  Rome-1
  committed
  f088610
- fix(policy): skip an ignore entry whose rules is not a list
  Rome-1
  committed
  a9ea4a6
- fix(cli): stop truncating JSON output written to a pipe
  Rome-1
  committed
  772ad63
- fix(run,get): warn when a completed scan is partial
  Rome-1
  committed
  623c82b
- fix(secrets): exempt the AWS-docs EXAMPLE key from the Access Key ID pattern
  Rome-1
  committed
  d1f842f
- test(secrets): stop using the now-exempt EXAMPLE key as a detection fixture
  Rome-1
  committed
  ff2c2de
- docs(secrets): keep AWS-key walkthroughs accurate after the EXAMPLE exemption
  Rome-1
  committed
  ebfcf6c
- Merge chore/test-purge-rebased into release/0.11.0
  Rome-1
  committed
  02d6757
- Merge fix/reverse-shell-risk into release/0.11.0
  Rome-1
  committed
  68383f0
- Merge fix/issue-274-cfg into release/0.11.0
  Rome-1
  committed
  e4bdd26
- Merge fix/issue-262-betterleaks-gitignore into release/0.11.0
  Rome-1
  committed
  1903e45
- Merge fix/audit-long-line-hash into release/0.11.0
  Rome-1
  committed
  e06f122
- Merge fix/issue-231-init-plan into release/0.11.0
  Rome-1
  committed
  c6bbab5
- Merge fix/issue-231-verify-summary into release/0.11.0
  Rome-1
  committed
  8f4dd02
- Merge fix/issue-231-docs-hints into release/0.11.0
  Rome-1
  committed
  10f5eb6
- Merge fix/test-config-isolation into release/0.11.0
  Rome-1
  committed
  6679149
- Merge fix/verify-hook-epipe into release/0.11.0
  Rome-1
  committed
  1d34e27
- Merge fix/issue-230-example-key into release/0.11.0
  Rome-1
  committed
  5e85f1b
- Merge fix/sable-ehan-config-snake-case into release/0.11.0
  Rome-1
  committed
  591d4d6
- Merge fix/secrets-union-dedup into release/0.11.0
  Rome-1
  committed
  99ec4e5
- Merge fix/secrets-redact-cap into release/0.11.0
  Rome-1
  committed
  c80bd9d
- Merge fix/report-accepts-secrets-json into release/0.11.0
  Rome-1
  committed
  01f03a7
- Merge fix/pattern-engine-compile-once into release/0.11.0
  Rome-1
  committed
  6619cd5
- Merge fix/scan-partial-surface into release/0.11.0
  Rome-1
  committed
  84b4efa
- Merge fix/scan-exclude-parity into release/0.11.0
  Rome-1
  committed
  ba30758
- Merge fix/mcp-scan-honors-suppressions into release/0.11.0
  Rome-1
  committed
  d1a324e
- Merge fix/stdout-truncated-on-exit into release/0.11.0
  Rome-1
  committed
  3ef62db
- test: use the non-exempt AWS fixture key in tests merged after the EXAMPLE exemption
  Rome-1
  committed
  9c84c7c
- chore(changelog): drop the duplicate Fixed heading the union merge left in Unreleased
  Rome-1
  committed
  4f1c933
- release: v0.11.0
  Rome-1
  committed
  72d0a21
- test(cursor): find rafter's hook entries by subcommand, not by path
  Rome-1
  committed
  76dd430
- fix(mcp): scan a single file passed to scan_secrets
  Rome-1
  committed
  d7aabbe
- fix(mcp): fall back to patterns when betterleaks times out (Python)
  Rome-1
  committed
  c07d58b
- fix(hook): audit-log failures can no longer turn a deny into an allow
  Rome-1
  committed
  340375f
- fix(mcp): report what suppressions dropped from scan_secrets
  Rome-1
  committed
  c21d050
- fix(cli): leave stderr non-blocking so mcp serve cannot stall
  Rome-1
  committed
  c739738
- fix(scan): suppress a merged finding only when every engine's rule is
  Rome-1
  committed
  ae47b40
- fix(risk): stop rating read-only /dev/tcp redirects as reverse shells
  Rome-1
  committed
  2cb0748
- fix(sites): honor RAFTER_API_URL in Python Sites calls
  Rome-1
  committed
  6615896
- fix(backend): tolerate non-string missing_scanners in the partial warning
  Rome-1
  committed
  43483be
- fix(hook): fail closed on any unexpected error in the PreToolUse hook
  Rome-1
  committed
  017b612
- docs(changelog): note the 0.11.0 MCP, union and reverse-shell fixes
  Rome-1
  committed
  a6b20b2
- Merge fix/release-review-batch into release/0.11.0
  Rome-1
  committed
  bdf61f1
- test(hook): a malformed .rafter.yml falls back to the default rules, not to none
  Rome-1
  committed
  810e57d
- Merge fix/hook-audit-failopen into release/0.11.0
  Rome-1
  committed
  13bf056
- fix(risk-rules): make Python's socket-shell pattern text match Node's
  Rome-1
  committed
  b5190ca
- test(verify): make the #231 core-count test independent of betterleaks
  Rome-1
  committed
  bc4f624
- test(agent): strip ANSI before checking skill-scanner help text
  Rome-1
  committed
  b37d68f
- test: keep CI's exported API key for the live backend tests (sable-5b01)
  Rome-1
  committed
  e62afa8
- ci: allow backend-api.test.ts to skip until the API key secret exists
  Rome-1
  committed
  8ddad5d
- test(init): resolve the temp dir so macOS paths compare equal
  Rome-1
  committed
  6ba817c

Commits

Commits on Oct 6, 2026

Commits on Oct 12, 2026

Commits on Oct 13, 2026