سجل التغييرات

May 18, 2026

• جديدelecterm dependency advisory check. GitHub repo scans can now flag npm manifests and lockfiles that pin or allow electerm versions affected by CVE-2026-41500 / GHSA-wxw2-rwmh-vr8f, with version-based advisory evidence rather than exploit confirmation.
• جديدOpenCms dependency advisory check. GitHub repo scans can now flag Maven pom.xml files that pin or resolve org.opencms:opencms-core versions affected by CVE-2023-42344 / GHSA-rcc6-6q2f-m2cw, with version-based advisory evidence rather than XXE exploit confirmation.

May 17, 2026

• جديدFUXA hardcoded JWT secret check. Verified active scans can now confirm CVE-2025-69971 exposure on FUXA instances that still trust the vulnerable fallback JWT signing configuration.
• جديدCKAN DataStore SQL exposure check. Verified active scans can now confirm unauthenticated CKAN DataStore SQL access associated with CVE-2026-42031 and guide teams to patched CKAN release lines or safer DataStore configuration.

16 May 2026

• جديدPDF.js dependency advisory check. GitHub repo scans can now flag npm manifests and lockfiles that pin or allow pdfjs-dist versions affected by CVE-2024-4367 / GHSA-wgrm-67xf-hhpq.
• جديدActive scans via REST API and MCP. Active scans can now be triggered from REST and MCP against verified domains that have been explicitly authorized from the dashboard. Authorization is revocable at any time.
• جديدSafer authorization levels for active scans. Domain authorization now distinguishes safer automated active checks from deeper active testing, so teams can automate the right level of verification for each domain.
• جديدFirst-use webhook for API/MCP active scans. A webhook can notify teams the first time an API/MCP-triggered active scan runs against a newly authorized domain.
• محسّنImproved Referrer-Policy findings. Missing or weak Referrer-Policy results now separate URL-referrer leakage from broad information exposure, show document-response evidence, and include generic plus static-host remediation guidance.
• محسّنImproved Permissions-Policy findings. Missing or weak Permissions-Policy results now show feature-level evidence, separate broad feature allowlists from missing hardening, and include generic plus static-host remediation guidance for common hosts, proxies, and app servers.
• محسّنImproved clickjacking header prompts. Missing X-Frame-Options findings now point agents to CSP frame-ancestors as the modern protection, add Vercel/static SPA header guidance, and verify x-frame-options with CSP.
• محسّنCSP header evidence and fix prompts improved. Missing-CSP reports now include clearer hosting and response context plus safer framework-aware remediation guidance.
• مُصلحVercel path-probe false positives reduced. FixVibe now requires stronger application-specific evidence before reporting exposed framework artifacts on deployments that rewrite unknown routes to the app shell.
• مُصلحلم تعد نتائج الامتثال تحمل علامات CWE مضللة. كان فحص legal-compliance يضع CWE-359 (كشف معلومات شخصية) على نتائج "سياسة خصوصية مفقودة" و"شروط خدمة مفقودة"، وهو ما لا يصف الثغرة الفعلية. تُنشر هذه النتائج الآن بدون CWE — فهي بنود امتثال وليست نقاط ضعف أمنية قابلة للتصنيف.

May 15, 2026

• جديدAdditional research-informed checks. FixVibe shipped more coverage based on recent vulnerability research and mapped duplicate topics to existing scanner modules where coverage already existed.
• جديدفحص تسرّب الأسرار في المستودع. يمكن لعمليات فحص مستودعات GitHub الآن وضع علامة على مفاتيح المزوّدين المثبّتة في الكود والقيم عالية الإنتروبيا الشبيهة بالأسرار المرسلة إلى المصدر، مع إخفاء الدليل وتضمين موجّه التدوير المعياري لـ FixVibe.
• جديدVercel deployment protection check. Passive scans can now flag public *.vercel.app generated deployment URLs that respond without Vercel Deployment Protection, while existing header checks continue to audit CSP, HSTS, and browser hardening.

May 14, 2026

• جديدLiteLLM dependency advisory check. GitHub repo scans can now flag Python dependency files that pin or allow LiteLLM versions affected by CVE-2026-42208 / GHSA-r75f-5x8p-qvmc.
• جديدLibreNMS dependency advisory check. GitHub repo scans can now flag Composer manifests that pin or allow LibreNMS versions affected by CVE-2024-51092 / GHSA-x645-6pf9-xwxw.
• محسّنFirebase rules detection improved. BaaS scans now detect more Firebase app shapes and use read-only evidence to identify risky public data exposure.

May 13, 2026

• جديدRepo Supabase RLS migration check. GitHub repo scans can now flag Supabase SQL migrations that create public tables without a matching ALTER TABLE ... ENABLE ROW LEVEL SECURITY statement.
• جديدSupabase Storage posture check. Passive scans can now review public Supabase Storage buckets and anonymous object-listing exposure alongside existing RLS and key checks.
• جديدAI-generated code guardrail check. GitHub repo scans can now flag missing security automation around code scanning, secret scanning, dependency updates, and AI-agent instructions.

May 12, 2026

• جديدRepo web-app risk checklist. GitHub repo scans can now flag high-confidence OWASP-style code risks such as raw SQL interpolation, unsafe HTML sinks, credentialed wildcard CORS, disabled TLS verification, and weak JWT secret fallbacks.
• جديدNext.js middleware-bypass check. Active scans for verified domains can now confirm CVE-2025-29927 exposure on middleware-protected routes before reporting it, and reports include the standard FixVibe AI fix prompt for remediation.

9 مايو 2026

• أمانCross-origin scope hardening. Active scans and client-asset checks now stay within the authorized target scope and avoid carrying customer-provided credentials across cross-origin redirects.
• مُصلحSupabase RLS check is now strictly read-only. Supabase posture checks now avoid write attempts and focus on safe exposure signals. Verified-domain active testing remains the boundary for deeper confirmation.
• محسّننتائج ترويسات الأمان تنطبق فقط على استجابات HTML الجذرية. لم يعد غياب CSP أو Permissions-Policy أو X-Frame-Options أو Referrer-Policy على 204 أو JSON API أو تنزيل ملف أو 404 ينتج نتيجة. ما زال HSTS وX-Content-Type-Options يقيّمان عبر كل الاستجابات.
• محسّنAuth-flow and rate-limit checks now require stronger evidence. FixVibe now reports these issues only when the application behavior clearly supports the finding, reducing noise from generic error pages and unsupported methods.
• محسّنFile-upload findings tier by exploitability evidence. File-upload reports now separate low-confidence acceptance signals from stronger evidence of risky serving behavior, reducing over-severity on benign upload handlers.

7 مايو 2026

• مُصلحThreat-intel listing accuracy improved. FixVibe now distinguishes real blocklist evidence from resolver diagnostics so threat-intel findings do not over-report on infrastructure-side lookup responses.
• جديدفحوص مستودعات GitHub. وصّل مستودعًا وسيفحص FixVibe المصدر بحثًا عن مفاتيح خدمة Supabase المسربة، ورموز Firebase admin، وملفات workflow الخطرة، والاعتماديات القديمة — من دون تحميل موقعك المنشور أبدًا. راجع أنواع الفحص.
• جديدفحوص SAST لـ JavaScript الخطرة. تضع فحوص المستودعات الآن علامة على new Function() وsetTimeout("string") — وكلاهما مكافئ لـ eval() عند تغذيته بإدخال غير موثوق.
• مُصلحنتائج “ملف مكشوف” الكاذبة على مواقع Vercel / Cloudflare. لم تعد استجابات 403 Forbidden المجردة تُبلّغ على أنها “الملف موجود” — فمعظم مزودي الحافة يعيدون 403 للمسارات التي تبدو مريبة سواء كان الملف موجودًا أم لا. نطلب الآن إشارة HTTP إيجابية قبل الإشارة.
• مُصلحRepo-code false positives reduced. Repo scans now avoid flagging security terms in comments, documentation, test helpers, and clearly server-only contexts for several high-signal code checks.
• مُصلحمفتاح Supabase anon في localStorage لم يعد يُبلغ كوثيقة JWT-in-storage — فمفتاح anon هو رمز العميل العام المقصود. رموز service-role الحقيقية في تخزين المتصفح أصبحت الآن حرجة بعنوان أوضح.
• مُصلحCSP weakness detection improved. Content-Security-Policy checks now catch more permissive source policies while keeping evidence and remediation focused on the effective browser policy.
• مُصلحReflected-XSS check tightened. Active scans now require stronger reflection evidence before reporting executable-context risk, reducing false positives from unrelated markup on the page.
• مُصلحيتعامل تحقق النطاق مع عمليات إعادة التوجيه بين apex ↔ www بشكل صحيح، ويوضح أكثر أي قيمة تُوضع في حقل Host لسجل TXT.

الصيغة

كل إدخال موسوم حتى تتمكن من المسح سريعًا:

• جديد فحص أو سطح أو ميزة جديدة.
• محسّن سلوك موجود أصبح أفضل — أدق أو أسرع أو أوضح.
• مُصلح خطأ شحنّاه ثم أصلحناه.
• أمان تقوية أو إصلاحات ثغرات أو تغييرات امتثال.

رأيت شيئًا انكسر وليس مسجلًا هنا؟ راسل support@fixvibe.app.