v0.0.147

security/tls-certificate now judges every key type and reads the signature and protocol, and a start URL with a broken TLS certificate reports that check failing instead of ending without a finding. A deep start URL is named in the audit, recorded as meta.requestedUrl and guaranteed a slot, --include-pages says how each page answered, and the local technology scan reads whole bundles and says when it was cut short. security/cookie-flags no longer warns about CSRF token cookies, and squirrel report --input keeps a saved report's skipped checks. The JSON report schema is now 1.3. Thanks to William for the deep start URL work (#1369, #1385).

Added

• security/tls-certificate judges every key type and reads the signature and protocol. New options under [rule_options."security/tls-certificate"]: key_types (default rsa, ecdsa, ed25519: a DSA key now warns), rsa_min_bits (2048), ecdsa_min_bits (256), dsa_min_bits (2048), reject_weak_signature (true: a SHA-1 or MD5 signed leaf warns), min_tls_version (TLSv1.2) and check_counterpart (true; false skips the www or apex handshake). The key check names the type and size (RSA 1024 bits, ECDSA P-256, Ed25519). The probe reads the key and signature from the leaf and the negotiated protocol. The runtime refuses below TLS 1.2 (such a server stays not checked) and cannot handshake with Ed25519, Ed448, DSA, RSA-PSS, P-521 or secp256k1 leaves, so live the protocol check can only warn for min_tls_version = "TLSv1.3" against a TLS 1.2 server, and the Ed25519 and DSA key checks apply only where a runtime can read such a certificate. See the rule page. (#1259)
• The --include-pages list says how each page answered. Each pages entry in the JSON report now has finalUrl (where the page was served from after redirects) and outcome (ok, http-error, rate-limited or error) beside url, status and ruleCount, so a pipeline that tracks coverage can tell a rate-limited page from a missing one without re-deriving it. meta.schemaVersion is now 1.2; without --include-pages that is the only change to a JSON report. (#1260)

Changed

• Technology detection reads whole bundles locally, and says when it was cut short. The free local scan matched only the first 256 KB of a bundle at best (64 KB by default), so a framework or SDK deeper in a 1 to 2 MB Vite or Next.js build was missed (a batch re-run with the caps lifted found React on 15% more sites). It now reads each first-party bundle the crawl fetched whole up to 8 MB ([tech_detect] bundle_bytes, up to 16 MiB), 32 MB a page and 64 MB an audit, with a 30 second budget per page. The crawl fetches a script only up to 5 MB and only the first 10 to 50 of a page's scripts, so those limits, not this one, bound what is seen. When a byte cap or the time budget cuts it short, the report has technologies.truncated (JSON, meta.schemaVersion 1.3) or a note beside the list (other formats) with the reason; a signed-in audit's cloud section, built from the unchanged 64 KB, 512 KB and 1 MB payload caps, carries the byte reasons too. The cloud services that run the same package keep the 256 KB per script and 5 s per page they had. The comment scanner under it no longer goes quadratic on a body of many comments, including NUL-split ones. The sentry fingerprint no longer fires on supabase-js, whose bundle quotes Sentry.init() in prose. (#1387)

Fixed

• A start URL with a broken TLS certificate now reports security/tls-certificate failing. An expired, wrong-host, self-signed or untrusted-chain certificate on the audited URL still ends the run as unreachable (exit 5, no score), but the report in the format you asked for now carries a security/tls-certificate failure with the cause (expired on a date, a name the certificate does not cover, self-signed, a chain that does not verify, a short RSA key), where it used to carry only Cannot reach. It follows --rule-exclude and [rules] disable, and a TLS failure that is not a certificate problem (a plain-HTTP port) has no finding. ERR_TLS_CERT_ALTNAME_INVALID and unable to get local issuer certificate are now classified as TLS failures (reason code tls) instead of unknown. (#1259)
• squirrel report --input keeps a saved report's skipped checks. A JSON report lists the checks a rule could not finish in skippedChecks, with summary.skipped, but loading the file dropped them, so re-rendering or re-exporting it read as a clean audit on those pages. They are now read back, validated (the file is untrusted), and kept out of issues. (#518)
• security/cookie-flags no longer warns about CSRF token cookies. XSRF-TOKEN (Angular, Laravel, Spring Security) and csrftoken (Django) are cookies a frontend such as Angular or Axios reads from script to send back in a header. HttpOnly is needed only when your frontend does not read the cookie, so a missing one is not a finding. They are now an info check, cookie-httponly-csrf, with the reason and docs links. The match is by exact name, a session cookie beside them still warns, and Secure and SameSite are still checked. (#1378)
• A deep start URL is now explicit and guaranteed to be audited. squirrel audit https://example.com/blog/post says that it will audit the whole origin, records the page as meta.requestedUrl beside meta.baseUrl, and seeds its resolved destination before sitemap URLs so a small page limit cannot omit it. Origin-only audits are unchanged. (#1369)