Verglos · Detector changelog

11 detector families, ordered newest first.

Every detector Verglos ships lands here on release day. Free-tier detectors are permanent; Pro rule packs (rule_pack_agent_surface, rule_pack_api_hardening, rule_pack_deep_auth) are the continuous-investment story — every month a new rule lands, the paid surface widens.

● 8 free● 3 paid rule packsSource of truth: src/lib/detectors/registry.ts

  1. Agent surface

    Jul 15, 2026 · CLI 1.8.3

    MCP server configs (Cursor, Claude Code, Windsurf, Cline) that execute arbitrary shell commands the moment an agent starts a session.

    Pro rule pack

    rule_pack_agent_surface

  2. API hardening (D7)

    Jul 15, 2026 · CLI 1.8.3

    Deep API surface patterns beyond the Free tier — missing rate limits, unbounded query params, unauthenticated admin routes, missing CSRF on state-changing verbs.

    Pro rule pack

    rule_pack_api_hardening

  3. Deep auth (D2/D3/D4)

    Jul 15, 2026 · CLI 1.8.3

    Auth-adjacent patterns beneath Free — JWT alg=none acceptance, permissive OAuth redirect_uris, missing session invalidation on password change, cookie flag drift.

    Pro rule pack

    rule_pack_deep_auth

  4. Vendored CVEs

    Jun 1, 2026 · CLI 1.8.2

    Vulnerable copies of jQuery, Lodash, Moment, etc. checked in under public/libraries/, vendor/, or as *.min.js — the files every other SAST filters out entirely.

    Free

  5. Slopsquat / hallucinated packages (AI-005)

    May 20, 2026 · CLI 1.8.0

    Package names in package.json that don't exist on npm — an LLM invented them, and the miss-typed name is a squatter's opportunity.

    Free

  6. AI-era code patterns (AI-001, AI-002, AI-003)

    May 1, 2026 · CLI 1.7.0

    Math.random reaching a token/OTP/session sink (AI-002), wildcard CORS on auth-adjacent routes (AI-001), and IDOR — lookup by ID with no ownership check (AI-003).

    Free

  7. Secrets in source

    Apr 15, 2026 · CLI 1.6.0

    Provider-specific patterns for AWS, GCP, Stripe, OpenAI, Anthropic, GitHub, Slack, plus generic high-entropy strings; optional live-key verify against provider APIs.

    Free

  8. Secrets in git history

    Apr 15, 2026 · CLI 1.6.0

    Scans the previous 100 commits for secret patterns even when the current tree is clean — catches the recent `git commit --amend` that thought it removed the token.

    Free

  9. Injection (SQL, command, prototype)

    Apr 1, 2026 · CLI 1.5.0

    String concatenation reaching a database query, shell exec, or object property write — the classic injection surface, AI-generated code hits regularly.

    Free

  10. Misconfiguration

    Apr 1, 2026 · CLI 1.5.0

    Missing security headers, wildcard CORS on non-auth routes, insecure cookie flags, disabled SSL verification — the fence around the application layer.

    Free

  11. Dependency vulnerabilities

    Apr 1, 2026 · CLI 1.5.0

    package.json + lockfile scanned against OSV / GHSA advisories; identifies vulnerable transitive deps and flags the shortest upgrade path.

    Free

Attestations

See every Verglos attestation →

Public ledger of Studio-tier attestations and how many people verified them.

Pro tier

Unlock the 3 paid rule packs →

Every Pro seat gets every rule pack shipped past and future.