# Changelog
All notable changes to Killer are documented here. The format is based on
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [2.0.0] - 2026-08-03
A check that never ran can no longer report a pass, and the public enums can grow without a major.
### Fixed
- **Unimplemented `.klr` checks no longer report as passing.** An expectation
naming a check the interpreter has no implementation for (`check csrf`, or any
unrecognised named boolean) was recorded as `passed: true, evaluated: false`
and folded into a `PASSED` verdict, so an attack that was never performed
produced a green tick, a clean summary, and exit code 0 under
`--fail-on-issues`. Such attacks now get a third verdict, `INCONCLUSIVE`.
### Changed
- **`Verdict::Inconclusive` is a new variant** on the `Verdict` enum (serialized
as `"inconclusive"`), reported separately from passed in the terminal,
executive, technical, Markdown, JSON, and HTML outputs. The executive risk band
is at least MEDIUM while any attack is inconclusive.
- **`killer test --fail-on-issues` exits non-zero on an inconclusive run**, not
only on a confirmed vulnerability.
- `TestRun` gains `inconclusive_count()`, `passed_count()`, and
`has_inconclusive()`.
### Changed (breaking, library API only)
These land before 1.0 so the stability promise is worth something afterwards.
No CLI behaviour, `.klr` syntax, or output format changes.
- **Open enums are now `#[non_exhaustive]`:** `analyzer::Severity`,
`analyzer::Category`, `scanner::Language`, `results::Verdict`,
`dependencies::Ecosystem`, `compliance::CategoryStatus`, `git::DiffTarget`,
`fuzz::HitOutcome`, `klr::ast::Value`, and `klr::ast::Expectation`. Downstream
`match` expressions need a wildcard arm, which must fold into the conservative
branch — an unrecognized `Verdict` is not `Secure`, an unrecognized
`CategoryStatus` is not `Passed`. `klr::ast::CompareOp` is deliberately left
exhaustive: it is the closed set of comparisons the grammar defines.
- **`analyzer::Finding` and `klr::ast::Attack` are now `#[non_exhaustive]`**,
because both are going to gain fields (a finding fingerprint, and a field per
new `.klr` clause). Struct-literal construction is no longer available out of
crate; use the new `Finding::new(..).with_suggestion(..)` and the existing
`Attack::empty(name, line)`, then assign the public fields you need.
- **`analyzer::Rule` now requires only `id` and `check`.** `name`,
`description`, and `category` have default bodies (id, empty string, and
`Category::Quality` respectively), so adding a method in a later release does
not break existing implementors. The trait is deliberately **not** sealed:
third-party rules are supported, and every method added from here on will
carry a default.
- **`klr::lexer` is private.** `Token`, `TokenKind`, `LexError`, and `tokenize`
are no longer part of the public API. They describe the parser's intermediate
representation, not the language, so publishing them made every new operator
a semver break. `klr::parse` plus the `klr::ast` types are the supported
surface; nothing outside the parser used the lexer.
## [1.4.0] - 2026-08-02
### Added
- **`weak-crypto` scan rule** — flags broken or legacy cryptographic primitives
(MD5, SHA-1, RC4, 3DES) in source, at High severity, with a suggestion to move
to a modern algorithm (SHA-256/BLAKE3, AES-GCM). Enabled by default; toggle via
`weak_crypto` in the `[rules]` table of `.killer.toml`.
## [1.3.0] — 2026-07-16
Local-first security-platform release. No breaking changes; all existing
commands and `.klr` semantics are unchanged.
### Added
- **`killer dependencies [--details] [--json]`** — dependency intelligence
across six ecosystems from local manifests only (`Cargo.toml`, `package.json`,
`requirements.txt`, `go.mod`, and now `pom.xml` and `*.csproj`). Reports
per-ecosystem counts, production/development split, duplicate versions, and
possibly-unused candidates. No CVE/advisory data — inventory, not scanning.
- **`killer compliance [--json]`** — maps the findings Killer detects onto
OWASP Top 10 (2021) with a CWE reference each. Categories are reported as
`Warning`, `Passed`, or `Not assessed` — a category Killer cannot check is
never marked passed. The mapping table lives in `mappings/compliance.toml`
(embedded, TOML to keep the zero-dependency build). Not a certification audit.
- **`killer report` formats** — `--executive` (score, risk band, headline
findings, recommendations), `--technical` (evidence, severity, remediation),
`--json`, and `--markdown`, alongside the existing `--html`.
- **`killer doctor`** now detects and reports the project's ecosystems.
### Changed
- The dependency-usage heuristic (import matching + Rust inline `crate::path`
scan) is shared between `killer graph` and `killer dependencies`.
### Notes on scope
`killer dependencies` is inventory-only: no vulnerability/CVE database,
supply-chain reputation, or typosquatting detection (those need a dataset a
zero-dependency local tool cannot ship). `killer compliance` maps to OWASP/CWE
and is explicitly not a certified SOC 2 / ISO 27001 / NIST audit. Both remain on
the roadmap as future, un-stubbed work.
## [1.2.0] — 2026-07-16
Developer-workflow release. No breaking changes; all existing commands and
`.klr` semantics are unchanged.
### Added
- **`killer graph [--json]`** — a structural project-graph engine. Parses
per-file imports (Rust, JavaScript/TypeScript, Python, Go, Java, Ruby) and
declared dependencies from manifests (`Cargo.toml`, `package.json`,
`requirements.txt`, `go.mod`), then reports the most-imported modules, import
hotspots, and **possibly-unused declared dependencies** — a supply-chain
signal. Dependency usage is matched best-effort (hyphen/underscore
normalization, plus an inline `crate::path` scan for Rust). `--json` emits the
full node/edge graph.
- **`killer benchmark [--runs N]`** — times repeated scans and reports min/avg
latency and files-per-second / lines-per-second throughput.
- **`killer fuzz`** — surfaces the `.klr` `mutate`/`fuzz` generators as a
first-class command. Without `--url` it previews the adversarial inputs it
would send; with `--url` it fires each one at a target (using the same
zero-dependency HTTP client and request encoding as `.klr` `mutate`) and
flags any input that triggers a 5xx server fault or an unreachable target.
`--list` prints the generator catalog; `--generators` selects a subset;
`--field` sets the mutated key; `--fail-on-issues` gates CI.
- **`killer watch`** — re-runs a scan whenever a source file changes, using a
dependency-free polling watcher (periodic mtime snapshots, diffed between
ticks) that honors the same ignore rules as `killer scan`. `--interval`
tunes the poll period.
- **`killer init --scaffold`** — in addition to writing `.killer.toml`, creates
a `security-tests/` directory with a runnable starter `.klr` file so a new
project can run its first test immediately.
### Changed
- The fuzz-generator table now lives in a single `fuzz` module and is shared by
both the `.klr` runner and `killer fuzz`, so the two can never drift.
### Notes on scope
`killer fuzz` is a CLI surface over the existing input generators — not a
coverage-guided fuzzing engine — and `killer watch` polls rather than
subscribing to OS file events. `killer graph` is a *structural* graph
(imports + declared dependencies with heuristic usage matching), not a semantic
or data-flow graph. A standalone fuzzing/chaos subsystem, a true multi-language
IR / data-flow engine, a `ratatui` TUI, and a plugin marketplace remain on the
roadmap, not shipped.
## [1.1.0] — 2026-07-16
Ecosystem and release-infrastructure release. No breaking changes.
### Added
- **`killer doctor [--fix]`** — diagnoses a project's setup (git, `.killer.toml`,
the configured `.klr` directory, a writable `.killer/`) and repairs what it
can with `--fix`.
- **Built-in suites** expanded to six: added `database`, `crypto`, and
`filesystem` alongside `web`, `api`, and `authentication`.
- A **severity bar chart** in the scan report summary.
- **Release automation** — a GitHub Actions workflow that, on a `vX.Y.Z` tag,
builds Linux/macOS/Windows binaries, attaches checksummed archives, and
publishes a GitHub Release with notes from this changelog.
- **Community & governance** — `CODE_OF_CONDUCT.md`, `SUPPORT.md`,
`GOVERNANCE.md`, issue templates, and a pull-request template.
## [1.0.0] — 2026-07-16
First public release. Killer is a Rust security platform with a static analysis
engine, a `.klr` test framework, project intelligence, code review, and a CI
gate. It builds from source and passes its full test suite (unit + integration
+ real-socket end-to-end + doc tests).
### Added
- **`killer scan`** — static analysis across Rust, JavaScript, TypeScript,
Python, Go, Ruby, Java, C/C++, and Shell. Detects hardcoded secrets (including
AWS/GitHub/Slack/OpenAI token formats), dangerous command execution,
oversized files, `TODO`/`FIXME`/`HACK`/`XXX` markers, and duplicate code.
Prints a color-coded report with a 0–100 health score.
- **The `.klr` language** — a lexer, recursive-descent parser (with coded
`KLR###` diagnostics), and an interpreter. Supports `project`, `suite`,
`attack`/`test`, `target`/`endpoint`/`request`, `send`, `header`, `payload`,
`repeat` (per-request and as a block loop), `check`, `mutate`, `fuzz`
(shorthand), `expect`, `severity`, `message`, and static `rule` definitions.
- **`killer test`** — runs `.klr` attacks against a live target with a parallel
worker pool (`--parallel`), built-in suites (`--suite web|api|authentication`),
a Jest-like grouped report, and JSON/HTML output.
- **Attack executors** — a zero-dependency HTTP client behind an `HttpClient`
trait, plus SQL-injection, path-traversal, rate-limit, and session helpers.
- **`killer history`** — persistent project intelligence: every scan is recorded
under `.killer/`, and the security score's trend is shown over time.
- **`killer review`** — reviews only the lines a `git diff` changed, including a
concurrency/transaction heuristic (e.g. an unguarded `balance -= amount`).
- **`killer ci`** and **`killer github enable`** — a single CI gate with a
non-zero exit, and a generated GitHub Actions workflow.
- **`killer report`** — renders the last run to the terminal or a self-contained
HTML report.
- **`killer explain <ISSUE_ID>`** — a knowledge base for issue ids (`KLR-SQLI`,
`KLR-PATH-TRAVERSAL`, `KLR-RATE-LIMIT`, `KLR-SESSION`, `KLR-GENERIC`).
- **`killer init`** — writes a documented `.killer.toml`.
- Documentation under [`docs/`](docs/), example `.klr` files under
[`examples/`](examples/), and built-in suites under `suites/`.
### Notes on scope
Killer ships a real, tested subset of a much larger vision. The following are
**not** in 1.0 and are tracked on the roadmap rather than stubbed:
- TLS transport for attacking `https://` targets (the built-in client is
`http://` only, behind a trait so a TLS backend can drop in).
- AST parsing (Tree-sitter) and a dependency / data-flow graph — the static
`.klr` rule engine uses line-level heuristics today.
- Fuzzing/chaos as their own subsystems, an interactive `ratatui` TUI, `watch`
mode, a plugin system, and a package marketplace.
[1.4.0]: https://github.com/martin-k-m/killer/releases/tag/v1.4.0
[1.3.0]: https://github.com/martin-k-m/killer/releases/tag/v1.3.0
[1.2.0]: https://github.com/martin-k-m/killer/releases/tag/v1.2.0
[1.1.0]: https://github.com/martin-k-m/killer/releases/tag/v1.1.0
[1.0.0]: https://github.com/martin-k-m/killer/releases/tag/v1.0.0