Changelog

CloudFormation reaches parity with Terraform on the GitHub App and MCP surfaces — same engine, same context reasoning, same one comment.

Added

• CloudFormation scanning in pull requests. Raw templates — JSON and YAML including short tags, plus .template files — are scanned in the PR, with unchanged templates pulled in as context for cross-resource reasoning. Findings land in the same PR comment and in GitHub Code Scanning.
  v1.18.0
• CloudFormation over MCP. scan_cloudformation, autofix_cloudformation, and dry_run_autofix_cloudformation join the tool set. Same Client ID, same quota — no new metering.
  v1.18.0
• SAM and CDK understood natively. AWS::Serverless::* resources are expanded into what SAM would generate before analysis; CDK cloud-assembly output is ingested directly.
  v1.18.0
• Dynamic references get their own context axis. ssm-secure and secretsmanager references suppress hardcoded-credential findings with a stated rationale; a plain ssm reference never does — SSM String parameters aren't secrets storage.
  v1.18.0
• CloudFormation-native rules. A NoEcho parameter leaking through Outputs, ssm-secure on a property CloudFormation won't resolve, unversioned plain-ssm references, and unpinned nested-stack TemplateURLs.
  v1.18.0
• A public CloudFormation benchmark. audytx vs Checkov, Trivy, and KICS on three pinned public corpora, with a reproducible harness — including a false positive audytx's own catalog produced, adjudicated in the open. See the write-up.
  v1.18.0

Clearer plans: real numbers instead of multipliers, and a support response time on every tier — including Free.

Changed

• Every plan gets a support SLA. Free: a 24-hour email response. Starter and Pro: 12 hours. Support isn't something you buy your way into — it's a floor. Pro's case is governance: custom checks, org-wide policy, centralized suppression, audit log export.
  v1.17.0
• Paid quotas are real numbers now. Pro reads 10,000 pull requests and 100,000 MCP calls a month instead of "200× Free" — a multiplier makes you do arithmetic to find out what you're buying.
  v1.17.0
• The plan cards only show what differs. All three used to repeat the same engine feature list, which pushed the plans below the fold. What every plan shares is now stated once, in a compare-all-plans table underneath.
  v1.17.0

A smaller first step onto the paid plans.

Added

• Starter — $25/month per organization. Everything in Free, twice the quotas (100 pull requests, 1,000 MCP tool-calls a month), and email support. One flat price for your whole organization, unlimited users. Opens September 2026 alongside Pro.
  v1.16.0

The Cost Sampler opens to everyone, the GitHub quota starts counting what it always claimed to count, and the 90-day deletion promise gets the code that makes it true.

Added

• Cost Sampler without an account. Enter an email, upload a zip, get your savings — no signup. It used to require a login, which meant the people it exists for couldn't try it.
  v1.15.0
• Nightly retention sweep. Scan metadata is deleted after 90 days, as the trust page has always said — now enforced by a daily job rather than by intention. Your quota counters are never touched.
  v1.15.0

Changed

• The GitHub quota counts pull requests, not scans. Opening a PR uses one of your 50; every push after that re-scans for free. The number is unchanged — the meaning is, and it now matches what the page always said. You are no longer charged for acting on review feedback.
  v1.15.0
• More room everywhere. Free MCP calls 250 → 500. Pro is now 200× Free at the same $200/month per organization. MCP input caps doubled: 1000 files, 10 MB per call, 4000 resources.
  v1.15.0
• Cost Sampler links expire after 5 days (was 90) — refused on read and deleted by the sweep.
  v1.15.0
• One navigation everywhere, signed in or out. Trust moved to the footer as "Data Security and Privacy".
  v1.15.0

The Usage tab becomes a record of what audytx actually did, not just how much quota you spent. Every row expands into the scans behind it — and the MCP surface now keeps the same per-scan record the GitHub App always has.

Added

• Expandable rows on the Usage tab. Click a month to see the scans it counted: repo, pull request, and commit for GitHub scans; the tool that ran for MCP calls. Each scan lists what was found — severity, rule, file.tf:12, and the remediation audytx recommended — alongside the findings it reasoned away and why.
  v1.14.0
• Per-scan detail on the MCP surface. At parity with the GitHub App: both surfaces now write the same finding records, so the dashboard renders them identically.
  v1.14.0

Changed

• What we store on the MCP path. Successful scanning tool calls now keep finding metadata — the rule, severity, message, the file:line it anchors to, and our own remediation text. Your Terraform source is still never stored: file contents, fix snippets, and the values read out of your code are excluded by design, in one enforced place. Records are deleted with your account, and POST /mcp stays stateless — no session state, nothing carried between calls.
  v1.14.0

A full visual rebrand from the dark-only "audit terminal" look to an editorial "paper" design — warm light-default palette with a proper light/dark theme toggle, a serif type system, and a homepage rebuilt around the one-line install and the three delivery stages.

Added

• Light/dark theme system. Light is now the default; a nav toggle flips the whole site and persists to localStorage, with a pre-paint setter so there's no flash on load.
  v1.13.0

Changed

• New design language across every page. Editorial paper palette with a terracotta accent, Newsreader / Archivo / JetBrains Mono type system, and a redesigned nav and footer. The shared token contract carried the change to all templates at once.
  v1.13.0
• Homepage rebuilt. Hero with a one-line MCP install (copy-to-clipboard), a "works with" strip, the measured proof band, and a tabbed code-time / review-time / plan-time walkthrough.
  v1.13.0

The pre-public-beta hardening run: every finding from a full-depth engine audit fixed in one pass — dead rules revived, all 21 context-reasoning axes reported, and scan-integrity signals surfaced on every path.

Added

• Three dead rules revived, three id collisions split — 257 → 260 rules. Six rules whose ids silently collided (so only one of each pair ever ran) were renumbered apart, and a duplicate-id guard now makes a colliding id a test failure, permanently.
  v1.12.0
• All 21 context-reasoning axes reported. Three org-policy axes (RCP data perimeter, EC2 declarative account policies, SCP deny guardrails) were implemented but missing from the engine's published metadata. They're now first-class entries, each grounded in AWS Organizations documentation.
  v1.12.0
• Scan-integrity signals on every path. Truncated evaluations and parser warnings now surface in the PR comment, MCP responses, and plan uploads — malformed Terraform can no longer produce a scan that silently looks clean. Plan uploads also re-upload SARIF, so Code Scanning reflects the plan-enriched findings.
  v1.12.0
• A frozen benign corpus with a zero-false-positive gate in the test suite. Nine hardened Terraform fixtures spanning the core suppression stories; a rule change that introduces a false positive on benign infrastructure now fails the build.
  v1.12.0

Changed

• Live pages render rule and axis counts from the engine. No more hardcoded numbers drifting stale as the engine grows — the recurring count-drift bug class is dead.
  v1.12.0

Four CIS AWS Foundations v5.0 controls that were honestly marked "not covered yet" are now covered, and the status endpoint sheds a per-request cost.

Added

• Four CIS v5.0 controls. S3 bucket policy SSL requirement (§2.1.1), MFA delete on versioned buckets (§2.1.2, AWS_S3_012), CloudTrail KMS encryption (§3.5, AWS_CT_005), and Network ACLs not allowing 0.0.0.0/0 to SSH/RDP (§5.2, AWS_EC2_010). Each is precision-gated — the NACL check ignores correct deny rules, and the MFA-delete check fires only on intentionally-versioned buckets.
  v1.11.0

Fixed

• Status endpoint latency. GET /status no longer deep-clones the entire rule set just to count it, and MCP scan responses cap the detailed findings list (keeping the highest-priority ones) so a pathological repo can't bloat a response.
  v1.11.0

Changed

• Renamed sections. "Docs" is now "Getting Started" (/getting-started) and "Blog" is now "Notes" (/notes).
  v1.11.0
• Pre-Beta announcement bar. A site-wide banner now notes that audytx is in active development, with Pre-Beta signups opening July 20.
  v1.11.0

The IAM moat reaches the wildcard grants single-resource scanners miss, and the honest column on the comparison page becomes an itemized ledger: every Checkov AWS check, accounted for.

Added

• Account-wide wildcard ARN detection. AWS_IAM_115 flags the Unit42 "AgentCore God Mode" pattern — a resource-type wildcard like ecr:...:repository/* or bedrock-agentcore:...:memory/* that grants an action across every resource of that type in the account. It isn't a bare *, so the usual privesc gate (and single-resource scanners) miss it. A grounded per-service table keeps scoped forms silent: bucket-name/*, secret:MyName-*, and named ARNs never fire.
  v1.10.0
• Published Checkov coverage map. All 432 Checkov AWS Terraform checks are now classified on the comparison page: 138 covered, 6 covered-with-context-suppression (audytx fires the same check but drops Checkov's false positive), 294 deliberately not covered — regenerable against a pinned Checkov snapshot, replacing the old hand-wave concession with an exact accounting.
  v1.10.0

The module supply chain gets the precision treatment: unpinned and mutable module sources are flagged with the exact pin to use, missing provider lockfiles get a nudge, and repositories using Terraform Stacks are told honestly what isn't analyzed instead of hearing silence.

Added

• Module-source pinning checks. A tag or branch in ?ref= is repointable — whoever can push upstream silently changes your infrastructure. AWS_OPS_087 flags mutable refs (only a full commit SHA is immutable), AWS_OPS_088 flags git:: sources with no ref at all, and AWS_OPS_089 flags OpenTofu oci:// sources that silently track the mutable latest tag. Registry version constraints and local paths are never flagged.
  v1.9.0
• Provider lockfile awareness. PR scans of repositories with no .terraform.lock.hcl get a one-line note that provider versions are unlocked — checked from the repository tree the scan already lists, and never claimed when the tree couldn't be observed.
  v1.9.0
• Terraform Stacks honesty. Repositories using Stacks (.tfcomponent.hcl/.tfdeploy.hcl) now see "the Stacks orchestration layer isn't analyzed yet; the modules it references are scanned normally" instead of silence — the silent-zero failure class, closed.
  v1.9.0

The agent surface fills out: the MCP server now speaks all three core server primitives — tools, prompts, and resources — so coding agents can load audytx's rule set and suppression axes as authoring-time context instead of only checking after the fact. And the parser learns Terraform 1.10's ephemeral resources, the modern way to keep secrets out of state.

Added

• MCP prompts & resources. Two prompts choreograph the tools — secure-review (scan → triage with suppression rationales → explain → autofix → re-scan) and pre-commit-gate (block staged changes at or above a severity threshold). Three resources serve the catalog as authoring-time context: audytx://rules-catalog, audytx://context-axes, and audytx://baseline-format — generated from the live engine, so they can never drift from what the scanner enforces. All on the open discovery tier: no Client ID needed.
  v1.8.0
• Ephemeral resources (Terraform 1.10) are first-class. ephemeral blocks — Terraform's third resource mode, whose values never persist in plan or state — are parsed, resolved, and shown in the relationship graph as their own node kind (graph schema 0.2, additive). Security rules never fire on them, and the flagship modern-secrets flow (ephemeral Secrets Manager read feeding a write-only *_wo argument) scans clean.
  v1.8.0

Fixed

• Phantom graph references from ephemeral traversals. An ephemeral.TYPE.NAME.attr reference used to be misread as a managed-resource reference with a garbage two-segment address, and the ephemeral block itself was silently dropped — the context graph now tells the truth about TF ≥1.10 secret flows.
  v1.8.0

The compliance layer gets the same treatment as the benchmark page: every CIS framework tag is now a verified CIS AWS Foundations Benchmark v5.0 requirement or it's gone — no version-that-never-was, no retired-control citations. And the mapping work surfaced two real detection gaps, both now closed with cross-resource checks most scanners can't express.

Added

• Aurora clusters without a failover target. AWS_RDS_011 (CIS v5.0 §2.2.4) fires when a cluster declares fewer than two instances — Aurora storage survives an AZ loss, but compute doesn't fail over without a second instance. It understands the idiomatic count = 2 form, exempts Multi-AZ DB clusters (inherently HA) and Aurora Serverless v1 (no instances by design).
  v1.7.0
• S3 data events nobody is logging. AWS_CT_004 (CIS v5.0 §3.8/§3.9) fires once per plan when CloudTrail trails and S3 buckets are declared but no trail's event selectors cover AWS::S3::Object — object-level reads, writes, and deletes leave no audit trail by default. A cross-resource check that per-resource scanners don't ship.
  v1.7.0
• Defined CIS v5.0 coverage. The compliance report now measures against an IaC-scoped canonical list of 29 CIS v5.0 requirements — grounded in the Security Hub control-mapping table — and honestly lists what's not covered yet.
  v1.7.0

Fixed

• The CIS tags told the truth pass. 54 rule tags cited "CIS AWS Foundations 2.0" — a version Security Hub never supported. 22 rules now carry verified v5.0 requirement numbers; 35 whose checks aren't CIS v5.0 controls dropped the tag (they keep firing under their FSBP / SOC 2 / NIST refs). Every remaining CIS claim on a finding is a real, citable control.
  v1.7.0

The agent surface grows up: standard Bearer authentication and spec-correct error signaling on the MCP server, baseline parity so an agent's local scan suppresses exactly what the repo's PR check suppresses, a new IAM Roles Anywhere confused-deputy rule, and a truth pass over the benchmark page reflecting what changed in the scanner market.

Added

• Standard Bearer auth on the MCP server. Authorization: Bearer <client-id> is accepted alongside X-Client-ID (which keeps precedence — existing setups are untouched). Auth failures now return a real 401 with a WWW-Authenticate header per the MCP authorization spec, and RFC 9728 metadata is served at /.well-known/oauth-protected-resource. Honest scope: full OAuth 2.1 sign-in is staged — today this helps every client and gateway that can send a standard header, and makes auth failures diagnosable instead of silent.
  v1.6.0
• Baseline parity for coding agents. The scan_terraform, autofix_terraform, and dry_run_autofix tools accept your repo's .audytx-baseline.yaml as an optional baseline argument, applied with the same engine the PR check uses — so a finding you've suppressed on the PR is also suppressed (and never auto-fixed) in the agent loop. Responses report baseline_suppressed / baseline_expired; a malformed baseline is an explicit error, never silently ignored.
  v1.5.2
• IAM Roles Anywhere confused-deputy rule. AWS_ROLESANYWHERE_001 fires when a role trusts rolesanywhere.amazonaws.com without any of the three AWS-recommended trust-anchor conditions (aws:SourceArn / aws:SourceAccount / sts:SourceIdentity) — without one, certificates from any trust anchor in the account can assume the role.
  v1.6.0
• An 18th reasoning axis: provider-version defaults. When your required_providers provably pins the AWS provider to v6, findings about defaults that v6 flipped to secure (Redshift encryption first) are suppressed with the constraint named in the rationale — the rule stays naive, the context decides. Plus: write-only (_wo) credential literals now detected, admin-equivalent AWS-managed policy ARNs feed the escalation graph, and the RCP data-perimeter axis covers KMS, Secrets Manager, SQS, and STS trust.
  v1.5.2

Fixed

• Benchmark-page truthfulness. Terrascan is marked archived (Tenable, November 2025) everywhere it appears — the pinned results stay, reproducible, explicitly not a recommendation — and a new market-status section carries cited capability notes on Checkov's graph, AI-triage tools, and Trivy's MCP plugin, with a "status last verified" date so staleness is visible, never silent.
  v1.6.0
• Two live precision bugs. An AWS_S3_008 false positive on org-perimeter bucket policies and an AWS_SECRETSMANAGER_004 false negative on mechanical-only conditions — both fixed by one shared condition-key classifier.
  v1.5.2

The site is repositioned around the market it's built for: AI-generated infrastructure. The landing page now leads with "Your AI agents are writing your infrastructure. Who's checking it?" and frames audytx as one security layer across the delivery path — code-time (the agent, over MCP), review-time (the PR), and plan-time (before apply) — with the precision numbers reframed as proof the gate is trustworthy.

Added

• A "hand-crafted, not another AI" section. audytx is a deterministic engine — explicit rules plus cross-resource graph reasoning, written and audited by hand in Rust, with no language model in the loop. In an age of AI-generated everything, the layer checking your cloud is deliberately, provably, not AI: every finding and every suppression cites the exact rule and relationship behind it.
  v1.5.0
• The three-stage delivery-path story. A single engine, shown across code-time (Claude Code / Cursor call the MCP server and auto-fix before a PR exists), review-time (the GitHub App gates the PR with a comment, inline review, and SARIF), and plan-time (an OIDC-signed terraform plan upload; HCP run tasks supported) — on a shared base of policy, posture, and the relationship graph.
  v1.5.0

Fixed

• Deterministic finding text. The example role rendered in AWS_IAM_114 prose was picked via hash-map iteration order, so PR comment / SARIF / MCP text could shift between deploys with no code change. Findings are now byte-stable across processes; identity, severity, and order were always stable.
  v1.5.0

The PR comment is now rendered from the same FindingsDigest that drives the MCP scan_terraform response: a headline posture line, a never-hide-a-Critical priorities section, a grouped-findings table, and a one-line tail — replacing the old flat top-15 finding list.

Added

• Digest-driven PR comment. A posture line (⚡ Attack paths · Risk · Security · Cost · Fix effort · Quick wins · total) replaces the old severity/cost breakdown line. A Top priorities section always surfaces every Critical and every attack-path finding — as an expanded, fully-detailed entry up to a cap of 15, or a one-line item beyond it — each with a one-line "Why first" marker. Non-priority High/Medium findings roll up into a visible Grouped findings table (theme, count, severity mix, member list); Low/Informational findings collapse into a single tail line. The context-suppressed section, compliance-impact section, and footer are unchanged, except the footer's old "showing top 15" note is now an unconditional Code Scanning full-list link.
  v1.4.0
• Renderer moved into the engine. The comment body is now assembled by pure, WASM-clean functions in audytx-engine/src/digest/render.rs, natively tested (the backend crate has no native test run, so this logic is now actually covered by the real test suite). The PR-comment and MCP-digest attack-path classifiers were unified so both surfaces agree on what counts as an attack path.
  v1.4.0

FindingsDigest: a deterministic, bounded summary added to the MCP scan_terraform response, so an agent's context window gets a headline risk posture and a capped priority list instead of having to read every finding.

Added

• digest field on scan_terraform. A posture summary (risk score/label, severity counts, remediation effort, quick wins, estimated USD exposure), a capped priorities list (every Critical and every attack-path finding is always included, never capped; High/Medium findings fill the remaining slots up to 5, each with a one-line reason), non-priority High/Medium findings rolled into groups by category, and a single rolled-up tail line for Low/Informational findings. Strictly additive — every existing response field is unchanged.
  v1.3.0

Terraform relationship graph (Tier 1): full typed node/edge graph available via get_context_graph and the new CLI. AST-based reference extraction eliminates the false-edge class; cross-file locals resolution reduces incomplete verdicts.

Added

• Full Terraform relationship graph in get_context_graph. All block kinds are now graph nodes — resource, data source, module call, variable, local, output, provider. Edges carry four typed kinds: reference (attribute-level, with dotted path), depends_on, module_input, and semantic (subkind invokes|runs_as|dlq). Response is a strict superset of the old shape; adds schema_version: "0.1".
  v1.2.0
• Graph CLI. cargo run -p audytx-aws-parsers --example graph -- <dir> walks a folder and emits a JSON graph with per-file completeness reporting (files_parsed, files_failed with error strings, parsed_empty class). Partial graph on error; exit 1 if any file fails.
  v1.2.0
• AST-based reference extractor. HCL expression AST walk replaces the regex extractor — string literals inside jsonencode policies, HEREDOC bodies, and comments no longer produce false edges.
  v1.2.0
• Cross-file locals resolution. Locals defined in any .tf file within a module directory resolve across files, matching Terraform's module-scoping semantics. Fewer Completeness::Incomplete verdicts.
  v1.2.0
• data blocks parsed as first-class nodes. All data "TYPE" "NAME" blocks are now structured objects available to the graph and typed-reference pipeline.
  v1.2.0

Usage history lands in the Profile. Every account can now see exactly how much monthly quota it has consumed over the last six months, sortable and exportable as CSV.

Added

• Usage tab on the dashboard. A new /dashboard/usage view shows quota consumed over the last 6 calendar months, read from the same counters the rate limiter writes — so the numbers are the exact quota burned, not an estimate. MCP/API usage is broken out per Client ID per month; GitHub App scan usage appears in the admin view. The table is sortable on any column and exportable as CSV (/dashboard/usage.csv).
  v1.1.0
• Dashboard tabs for everyone. The Client IDs · Usage · Metrics tab bar is now visible to all signed-in accounts; Metrics stays admin-only.
  v1.1.0

First stable release. audytx posts one comment per pull request with context-aware AWS Terraform security findings and dollar-led cost opportunities — ~247 rules across 17 cross-resource reasoning axes that suppress the false positives single-resource scanners emit. The same engine is an MCP server for coding agents, on a production-ready auth + security-hardening layer.

Highlights

• PR analysis surface. One comment per PR, inline one-click fix suggestions, and SARIF upload to GitHub Code Scanning. Whole-repo parse so cross-resource reasoning sees unchanged files; findings diff-scoped back to the PR.
  v1.0.0
• MCP server for coding agents. Six tools — scan_terraform, autofix_terraform, dry_run_autofix, explain_finding, get_context_graph, cost_sampler — over stateless Streamable-HTTP, gated by a free Client ID.
  v1.0.0
• Cost Sampler. Upload Terraform on the web or call the MCP tool for a dollar-led, savings-only estimate with shareable report links.
  v1.0.0
• Accounts + Client IDs. Email/password accounts, a dashboard to mint and revoke Client IDs, and monthly free-tier quotas.
  v1.0.0
• Security hardening. MCP request-hygiene + DoS caps, API security & abuse hardening across auth / sessions / CSRF / rate-limiting / uploads, and a nonce-based Content-Security-Policy.
  v1.0.0

Free-tier monthly rate limiter: GitHub App scans and MCP tool-calls are now quota-tracked per installation / source IP. D1-backed with an async queue for eventual-consistency writes — the check adds no synchronous latency to under-quota callers.

Added

• Monthly quota — GitHub App. 60 PR scans per installation per calendar month. Over-quota events are silently skipped (no error comment posted); the counter self-resets on the first of each UTC month.
  v0.19.0
• Monthly quota — MCP server. 250 tool-calls per source IP per calendar month. Over-quota calls return JSON-RPC error -32001 with a 429 HTTP status.
  v0.19.0
• Async queue — counter writes. Each scan / tool-call enqueues a single increment message; the queue consumer upserts into D1 after the work completes. Eventual consistency means a caller can exceed quota by a handful of calls before throttling engages — deliberately acceptable.
  v0.19.0

Bedrock + AI infrastructure coverage: four new security rules for the AWS service category where AI coding agents deploy compute and where zero existing scanners have coverage.

Added

• AWS_BEDROCK_001 — Bedrock confused-deputy. Fires when an IAM role's trust policy allows bedrock.amazonaws.com without an aws:SourceArn condition. Any Bedrock resource in the account can assume the role — the specific attack pattern documented by CSA Labs (2026-02) for the MMDS credential-exfiltration path.
  v0.18.0
• AWS_BEDROCK_002 — Agent conversation data unencrypted. Fires when a Bedrock agent lacks customer_encryption_key_arn. Conversation session data uses an AWS-managed key, which cannot be independently audited, rotated, or immediately revoked.
  v0.18.0
• AWS_BEDROCK_003 — Agent session TTL too long. Fires when idle_session_ttl_in_seconds > 3600 (the AWS-documented maximum). Long TTLs extend the session replay window.
  v0.18.0
• AWS_XREF_023 — Bedrock agents without invocation logging. Cross-resource check: fires once when the workspace declares aws_bedrockagent_agent resources but no aws_bedrock_model_invocation_logging_configuration. Without invocation logs there is no forensic audit trail of what was sent to foundation models or retrieved from knowledge bases.
  v0.18.0

Parser improvements: conditional resource detection (count/for_each on variables), module model defaults enabling deeper rule coverage, and improved cross-resource rule evaluation for synthesized module resources.

Added

• Conditional resource detection. Resources whose count or for_each depends on a variable (e.g. count = var.enable_feature) are now tagged Completeness::Conditional. Their findings are severity-downgraded one step and annotated "conditionally created" — reducing noise on infrastructure that may not exist.
  v0.17.0
• Module model defaults — deeper rule coverage. Three module models gained new defaults that unblock rules gated on required_attributes: function_name on the lambda module (unlocks four rules including DLQ and code-signing), identifier on the RDS module (unlocks performance-insights + KMS rules), and viewer_certificate.minimum_protocol_version on the CloudFront module (unlocks the TLS version check). Defaults are injected as default-derived — bare module calls remain clean; only explicit insecure values fire.
  v0.17.0

MCP V2: four new tools, server-side hardening, and a new cross-resource reference validator that catches the primary LLM hallucination pattern.

Added

• AWS_XREF_DANGLING — undeclared module reference detector. Catches resources that reference module.X where no module "X" block is declared — the most common hallucination pattern when AI agents write Terraform code.
  v0.14.35
• MCP V2: four new tools. dry_run_autofix previews what autofix would change (unified diff, no writes). explain_finding returns structured rule metadata for any catalog rule ID. get_context_graph exposes the cross-resource relationship graph — invocation edges, IAM role assignments, DLQ links, and the full list of suppressed findings with their rationale, giving coding agents a glass-box view of why a finding was suppressed.
  v0.16.0

Changed

• MCP hardening. Input validation on all tools: filename allowlist, path-traversal rejection, null-byte stripping. Per-isolate rate limiting (60 req/IP/min, HTTP 429 on exceed). Autofix output validation: new paths and 2× size bloat are rejected server-side.
  v0.16.0

Fewer false positives on secret rotation. The rotation finding now understands cross-resource setup.

Added

• Secrets Manager rotation is now context-aware. The "secret should have automatic rotation" finding no longer fires when a sibling aws_secretsmanager_secret_rotation resource already configures it — audytx resolves the cross-resource link and suppresses the finding with a rationale, so it surfaces only on secrets with no rotation configured anywhere.
  v0.14.0

Performance — less CPU per scan, same findings. A determinism-safe optimization pass (verified byte-for-byte against a golden fixture): the engine no longer repeats avoidable work on every request.

Changed

• Rule catalog parsed once, not per request. The ~247-rule YAML catalog was re-parsed on every PR scan and every MCP call; it's now cached per isolate. Same rules, far less CPU on warm isolates.
  v0.13.0
• Hot-path regexes compiled once. Reference extraction, the EKS security-group check, and the comment-renderer regexes no longer recompile on every call.
  v0.13.0

Plan-enhanced scans (optional). terraform plan -json resolves what static parsing can't — final values, count/for_each expansion, and module-internal resources. Strictly opt-in and enriching: a scan with no plan input is unchanged.

Added

• Plan-JSON ingestion. The engine can merge terraform show -json output onto a normal scan — plan values win per attribute, and resources static parsing never saw (module-internal, count-expanded) are added. Surfaces findings on values behind undefaulted variables and computed expressions.
  v0.12.0
• MCP scan_terraform accepts an optional plan argument — an agent that ran terraform plan can hand the JSON to audytx for a richer scan. Best-effort; omitting it is a normal scan.
  v0.12.0
• Plan-enhanced PR scans via POST /plan-upload — a GitHub Actions workflow uploads its plan JSON, authenticated by the workflow's own OIDC token (nothing to paste, no secret to manage). audytx re-scans the PR with the plan merged in and updates the comment.
  v0.12.1

Suppression integrity — measuring the recall side of the moat. audytx's edge is suppressing false positives via cross-resource reasoning; every suppression is also a latent false negative. This series builds an adversarial "must-not-suppress" corpus, measures how often a suppressor fires when it shouldn't, and tightens the leakiest detectors.

Added

• Suppression-integrity baseline (Phase 8 M1). 16 context-suppression axes measured against 45 adversarial fixtures where the finding is real and must survive: 13 of 16 axes are leak-free. Published, re-runnable, beside the false-positive benchmark.

Fixed

• IMDSv1 no longer hidden by an inherited default. An EC2 instance that sets its own http_tokens = "optional" re-opens IMDSv1 even when a launch template or account default enforces IMDSv2 — instance-level settings win at runtime. The AWS_IAM_023 SSRF-credential-theft finding is no longer suppressed in that case.
  v0.11.0
• Internet-open security groups no longer excused by an "eks" name. An all-ports security group open to 0.0.0.0/0 now fires AWS_VPC_006 even when its name contains "eks" (including incidental matches like weeks-cache). Suppression now applies only to genuine intra-cluster rules (sourced from self / another SG), never to internet exposure.
  v0.11.1
• Missing-DLQ findings restored on async-wired Lambdas. A Lambda with parameterised function_name/handler is no longer treated as a "module template" when it is actually wired to an async-push source (SNS, S3 notification, EventBridge) in-plan — AWS_LAMBDA_004 / AWS_OPS_001 fire because the DLQ requirement is real.
  v0.11.1

IAM v2 — attack paths found by search, not by name. The curated attack-path rules are hand-written per shape; this series begins generalising them into a reachability search over an explicit graph (internet entry → compute → role → sts:AssumeRole chain → escalation-capable role), so multi-hop chains the pairwise rules miss surface too.

Added

• Reachability search — ATTACK_PATH_SEARCH (Phase 7 M4). Generalises the Lambda multi-hop search to ECS Fargate: a public-IP task whose role cannot escalate on its own but pivots via an sts:AssumeRole chain to a privileged role — the gap the pairwise ATTACK_PATH_004 leaves. Reuses the existing AssumeRole edge graph + cycle-safe BFS; additive and deduped against the curated paths so nothing is reported twice.
  v0.10.0

IAM v2 continues — statement math. The escalation engine now evaluates each policy through a single effective-permission entry point that folds Allow/Deny precedence, NotAction inversion (Allow NotAction:[X] grants everything except X), and Condition classification. A wildcard "everything except a few" grant is now attributed to the specific escalation methods it enables, not just flagged as broad.

Added

• IAM statement-math engine (Phase 7 M2). New effective_allows(policy, action) decision function — explicit Deny wins, NotAction is correctly inverted, and conditioned grants are classified (and held to the precision bar: conditions on unconstrained escalation grants stay suppressed rather than downgraded). The AWS_IAM_020/021 privilege-escalation catalog now runs on this engine — a strict superset of the prior matching, with precise per-method attribution for NotAction grants.
  v0.9.0

IAM v2 — reasoning about effective permissions, not just shapes. The engine now understands what an action pattern actually grants: iam:*, iam:Get*, s3:*Object* expand against a vendored table of real AWS service actions, so a wildcard grant is matched to the specific privilege-escalation actions it enables.

Added

• IAM action table + wildcard expansion (Phase 7 M1). A trimmed, compile-time table of ~3,200 actions across the 25 escalation-relevant AWS services drives expand() / pattern_covers(); the IAM escalation matcher now resolves globbed action grants, a strict superset of the prior exact/service wildcard matching. Foundation for the effective-permission engine (statement math, resource-policy intersection, reachability search).
  v0.8.0

Seeing through registry modules. Real Terraform composes terraform-aws-modules/* registry modules rather than raw resources — and the engine was blind to what they deploy. v0.7 vendors compact security models of the top modules and expands a module {} call into the resources it creates, so findings surface on module-based infrastructure too.

Added

• Registry-module expansion (Phase 6 M3). A module "x" { source = "terraform-aws-modules/…/aws" } call is expanded into synthesized pseudo-resources from a vendored model. Precision-first: a finding fires only on an explicitly-set insecure input — attributes that fall back to the module's safe default are injected (so nothing is falsely flagged as "missing") and suppressed, since module versions drift. Count of vendored models is at GET /status (module_models).
  v0.7.0

Raising the parser ceiling. The engine now resolves Terraform variables — a resource attribute set to var.x is evaluated against the variable's default (or a .tfvars override), so an insecure default is caught instead of skipped. Raw values are preserved, so the false-positive suppression on module-template code is unaffected.

Added

• Variable / locals / tfvars resolution (Phase 6 M1). variable {} defaults and .tfvars overrides are collected into a resolution map; the rule evaluator resolves var.<name> references to their literal value. Unresolved references keep prior behavior (no guessing).
  v0.6.0

Observability and visibility. Every scan now writes a telemetry row to D1 (installation, outcome, finding counts, duration) and, once the Checks permission is granted, posts a named check-run per PR so failures are visible rather than silent. A new GET /metrics endpoint exposes aggregate-only counts — no repo names, no logins — for operational monitoring.

Added

• Scan telemetry. Each scan inserts an app_scans row at start and updates it on completion with outcome (ok, engine_error, no_tf_files…), findings count, suppressed count, comment-posted flag, and duration. Best-effort D1 writes never block or fail a scan.
  v0.5.0
• Installation tracking. installation.created and installation.deleted webhook events upsert/mark-removed rows in app_installations. Requires Victor to subscribe the App to these events in GitHub App settings (BLOCKED note in code).
  v0.5.0
• Check-run per scan. A named audytx check-run is created as in_progress at scan start and concluded with success / neutral / failure after the comment attempt. Requires Checks: Read & write permission (BLOCKED — needs Victor). Until granted, scans behave exactly as before; the 403 is caught and logged.
  v0.5.0
• GET /metrics. Aggregate-only JSON endpoint: active installs, total installs, scans last 7/30 days, comment rate, outcome breakdown, average duration. No auth needed; aggregate data only (no repo names, no user logins). Cache-Control 60s, same as /status.
  v0.5.0

The agent surface. audytx is now consumable by coding agents, not just by humans reading PR comments: a zero-setup MCP server exposes the full engine — the same context-aware analysis the GitHub App runs — to any MCP-capable agent, plus a server-side autofix loop that applies audytx's precisely-anchored fixes and re-scans until nothing auto-fixable remains.

Added

• MCP server at POST /mcp (stateless Streamable-HTTP JSON-RPC). One line of agent config — claude mcp add --transport http audytx https://audytx.com/mcp — and a coding agent can review Terraform before the PR exists. No CI, no token, no install.
  v0.4.0
• scan_terraform tool. Pass all .tf/ .tfvars files, get findings with file/line evidence, severity, remediation and fix snippets — plus the findings the context layer suppressed as false positives, each with its rationale (suppressions are surfaced, never silent).
  v0.4.0
• autofix_terraform tool — the autofix loop. The server applies the sound one-click fixes (the same precision gates as GitHub suggestion blocks: only exactly line-anchored replacements, never a corrupting edit), re-parses, re-evaluates, and loops up to 3 passes. Returns the fixed file contents, what was applied, and what remains for the agent to fix itself.
  v0.4.0
• Engine autofix module. The fix-application logic lives in the WASM-clean engine (audytx_engine::autofix) with severity-priority conflict resolution, bottom-up splicing, and a real-HCL integration test that drives the full parse → evaluate → fix → re-evaluate loop.
  v0.4.0

Whole-repo reasoning. The engine now scans the full Terraform tree for context and diff-scopes findings back to the pull request — so cross-resource analysis (toxic combinations, orphaned resources, asymmetric multi-region config) is finally sound instead of guessing from the diff alone. On top of that: cost×security fusion rules, GPU/cryptojacking + bill-shock detection, third-party secret scanning, sound one-click GitHub suggestions, and a per-PR compliance-impact summary.

Added

• Cost × security fusion (AWS_FUSION_001–004). Cross-signal findings that no single-resource scanner can express: a GPU instance alongside an admin-equivalent IAM policy (the cryptomining blueprint), a GPU instance with an openly-assumable role and no budget alarm, an internet-exposed data store carrying a regulated-data signal, and public-facing compute with admin IAM and no WAF (the SSRF → IMDS → takeover chain).
  v0.3.0
• Cross-resource correlation rules (AWS_XREF_001–022). Lambda cold-start-in-VPC timeouts, single-AZ NAT single-points-of-failure, asymmetric Aurora/DynamoDB/CloudFront multi-region config, and orphaned roles / KMS keys / security groups / target groups. Sound now that the engine sees the whole repo, not just the changed files.
  v0.3.0
• GPU / cryptojacking + bill-shock detection (AWS_COST_005) with real us-east-1 GPU pricing. Flags GPU/accelerator instance families (the primary post-credential-compromise mining vector) and oversized *.24xlarge/*.metal types, with exact monthly cost figures from the embedded pricing snapshot.
  v0.3.0
• Secret detection — datastores + third-party keys (AWS_CRED_003 / AWS_CRED_007). Plaintext credentials in RDS / Directory Service / MQ / OpenSearch, plus Stripe, Slack, Google, SendGrid, OpenAI, npm and GitHub-OAuth keys — specific vendor patterns only, so references and Secrets-Manager lookups never trip them.
  v0.3.0
• One-click GitHub suggestions. Per-attribute line tracking anchors a finding at the exact offending line, so a single-attribute fix renders as GitHub's one-click suggestion block — applied cleanly in the Files Changed tab. 129 of 242 rules now carry a concise suggestion; non-scalar fixes fall back to a safe labeled block (never a corrupting apply).
  v0.3.0
• Compliance-impact summary. Each PR comment now aggregates the SOC 2 / PCI-DSS / HIPAA / CIS controls the change's findings touch — driven by the actual findings, with an honest advisory framing (signals that help with controls, not an attestation).
  v0.3.0

Changed

• Whole-repo scan mode. PR scans now fetch the full Terraform tree at the head commit for context and then diff-scope reported findings to the changed files. Cross-resource rules (XREF, FUSION, NAT-without-endpoint cost) that previously saw only the diff — and so could miss a role's consumer or a VPC endpoint in an unchanged file — are now correct. Degrades gracefully to changed-files-only if the tree fetch fails.
  v0.3.0

IAM depth phase: privilege escalation, reachability layer, role-chaining paths, and a 6th reasoning axis. Remediation layer: inline HCL fix blocks in GitHub's Files Changed tab for every finding in the catalog. 206 rules, 6 context-aware axes. First public benchmark vs Checkov shipped.

Added

• Inline HCL fix blocks in GitHub review comments. Every finding with a fix_snippet posts an inline review comment directly on the resource's opening line in the Files Changed tab — showing the corrected HCL block alongside the code being reviewed. All 206+ rules in the catalog now carry a fix_snippet.
  v0.2.35 · v0.2.36 — #82 · #83
• IAM role-chaining paths (AWS_IAM_022). Detects multi-hop sts:AssumeRole chains — where role A can assume role B which holds escalated privileges, even when B's inline policy looks scoped. Resolves targets across label≠name divergence in Terraform module patterns.
  v0.2.15 — #79 · #80
• IAM reachability layer + toxic combinations. Layer-3 cross-resource attack paths. Surfaces pairings where network exposure + over-privileged IAM combine into an exploitable path — e.g., internet-facing Lambda with iam:PassRole and no Condition gate.
  v0.2.12 — #77 · #78
• Privilege escalation skill (AWS_IAM_020). Detects 19 exploitable escalation methods from the Rhino Security Labs catalog, gated on actual exploitability (Allow + Resource:"*" + no Condition). 31 detections on the iam-vulnerable benchmark fixture; 4/5 safe configurations correctly suppressed.
  v0.2.1 — #73
• iam_policy_risk reasoning axis (6th axis). Suppresses IAM-related rules on demonstrably safe configurations — AWS_OPS_035 (permissions boundary) and AWS_OPS_037 (IAM user declaration) now consult the axis before firing.
  v0.2.1 — #74
• ELB rules (AWS_ELB_001/002) — access logging disabled, plaintext HTTP listener.
  v0.2.1
• Neptune rules (AWS_NEPTUNE_001/002/003) — storage encryption, audit log exports, IAM database authentication.
  v0.2.1
• Public benchmark vs Checkov at /benchmarks/checkov-2026-06-03 — 7 real open-source Terraform repos, SARIF-sourced findings, reproducible methodology.
  v0.2.1 — #72

Fixed

• jsonencode() IAM policy parsing. policy = jsonencode({...}) (the modern Terraform idiom) now populates the structured iam_policies model; was silently empty, causing all IAM content rules to miss findings on ~70% of real repos.
  v0.2.1 — #71
• CI path-filter bug. backend-deploy.yml was excluding audytx-aws-parsers/ from the trigger; a parsers-only change would silently skip the prod deploy.
  v0.2.1 — #70
• Role-chain target resolution across label≠name divergence. Terraform module outputs often use a label different from the resource name; the role-chaining resolver now normalizes both sides before matching.
  v0.2.15 — #80

First public version. 201 rules, 5 reasoning axes, visible suppression rationale in PR comments, SARIF v2.1.0, .audytx-baseline.yaml suppression file, and the GitHub App live on the edge.

Added

• 5 context-reasoning axes. lambda_invocation_graph, sqs_dlq_identity, encryption_variants, data_lifetime, network_exposure. Each axis is a pre-computed verdict the rule layer consults before firing. Axis inventory at /status.
• Visible reasoning in PR comments. Every finding the engine suppresses appears in a 🧠 audytx reasoned about N findings block with rule ID, resource address, and the axis-driven rationale.
• SARIF v2.1.0 emission uploaded to GitHub Code Scanning. Context suppressions surface as "dismissed" alerts with their reason — your security lead sees the same dismissals you see.
• 201-rule catalog across IAM, networking, encryption, observability, cost, reliability. Curated AWS rules, not breadth-first.
• Cost optimization findings in the same comment. gp2→gp3, NAT gateway vs VPC endpoints, non-prod Multi-AZ, and others. Dollar bands surface in the PR header when quantifiable.
• .audytx-baseline.yaml suppression file with required expires: dates. Suppressions can't rot silently.
• Per-rule loader resilience. One bad rule no longer poisons the YAML file it lives in. Recovered 57 silently-dropped rules in the first pass.
• JoinSpec::AnyMatch + CompanionRequirement::AtLeastTwo in the rule DSL — "plan-level presence" and "redundancy" checks now expressible without custom code.
• Public testbed repo. audytx-testbed holds long-lived PRs that exercise every reasoning axis end-to-end against the live App.
• Real-HCL integration tests. Three real parser-shape bugs were caught this way during M2.7 (bool-vs-string coercion, jsonencode() stored as string, sqs_managed_sse_enabled shape). Synthetic tests had stayed green.

Fixed

• AWS_OPS_025 gate inversion. "Public ALB has no Route53 health check" was firing on internal LBs and staying silent on public ones. Switched to all_unsatisfied match logic; two real-HCL regression tests added.
  #51
• Tolerant bool coercion + jsonencode scan. ttl.enabled = true stored as String("true"), sqs_managed_sse_enabled = true similarly, redrive_policy = jsonencode({...}) left unevaluated. Added a shared coerce_bool helper and a redrive-policy substring scan to fix three false-positive sources in one pass.
  #42

Changed

• SARIF emitter relocated from backend to engine. The format is part of the engine's output contract. Now lives in audytx-engine::sarif with a real-HCL integration test.
  #45
• Landing-page repositioning. From "cost + security on every Terraform PR" to "the Terraform scanner that knows when not to flag." Reasoning visibility is now the lead differentiator.
  #46 · #47