Frame 1.1.3

Proof-carrying findings now reach across languages and close the loop on fixes, plus new report formats for CI. Everything here is additive and opt-in; no existing behaviour changes.

pip install -U "frame-security[scan]"

Proof-carrying findings, across languages

A finding Frame proved reachable becomes a runnable test that drives your own code to the sink, confirmed only when attacker-marked data arrives there through your project (calling the sink directly does not count). See docs/ai.md.

• Code taint flows, not just dependencies: frame exploit --deps reproduces SQL injection, command injection, XSS, path traversal, SSRF and the other source-to-sink injections from a scan's findings JSON.
• Four languages: Python, JavaScript/TypeScript, Java and C#. Java spies the injected sink interface with a core-JDK java.lang.reflect.Proxy (only a JDK needed, no Maven or Mockito); C# uses xUnit + Moq (the .NET SDK).
• The fix-loop: frame exploit --deps --check-fixed DIR re-runs a confirmed reproduction against a fixed copy of the project and verifies it no longer reaches the sink, so a proof of the vulnerability becomes a proof of the fix. It flips for fixes that remove the flow (validation, a safe-API swap, a dropped call); a sanitize-in-place is confirmed by a re-scan or frame verify.
• Every cross-language reproduction runs in CI on real toolchains (JDK 17, .NET 8, Node 20), with worked exemplars.

Reports and CI

• New formats: frame scan -f markdown (a pull-request comment or $GITHUB_STEP_SUMMARY report), -f gitlab (GitLab SAST report) and -f sonar (SonarQube generic issue import). SARIF results now carry code flows and proofs.
• frame diff OLD.json NEW.json shows which findings a change introduced, fixed or left unchanged, paired by fingerprint.
• --fail-on-evidence LEVEL breaks a build only on findings at or above an evidence level, for example --fail-on-evidence solver-verified to fail only on what Frame proved.

Fixes

• The findings JSON now includes each finding's sink_call, so frame exploit --deps can build a reproduction of a code taint finding from a real scan. Before, taint reproductions only ran from the exemplars.

Project

• New CONTRIBUTING.md, SECURITY.md (including exactly what Frame runs and sends: by default no project code executed, nothing fetched during a scan, no telemetry) and CHANGELOG.md; issue forms for false positives and missed vulnerabilities; Discussions are open, and vulnerabilities in Frame can be reported privately.

Released alongside

• GitHub Action: lambdasec/frame-action@v1 runs 1.1.3 now that the v1 tag has moved; nothing to change in your workflow.
• pre-commit: rev: v1.1.3.

CI is green on this commit (tests on Python 3.10 and 3.13, lint, the cross-language reproduction job, self-scan, sca-real, and the full benchmark sweep).

Frame 1.1.2

A patch release fixing proof-carrying findings on GCC.

frame scan --confirm-proofs built its sanitizer harness with -fsanitize=implicit-conversion, which is Clang-only. On GCC (Linux CI and most Linux installs) that flag is rejected, so every proof harness failed to compile and nothing was confirmed. The sanitizer set is now probed per compiler: address,undefined everywhere (signed overflow via UBSan, out-of-bounds via ASan), and implicit-conversion (the narrowing/sign-change CWEs) only where the compiler supports it.

If you installed 1.1.1 and use --confirm-proofs, upgrade: pip install -U frame-security.

CI is green on this commit (tests on 3.10 and 3.13, lint, self-scan, sca-real, the full benchmark sweep).

Frame 1.1.1

A patch release: proof-carrying findings and a CI fix. Everything here is additive and opt-in; no existing behaviour changes.

Proof-carrying findings

A finding the engine already proved reachable becomes a runnable test that triggers it, raised to the exploit-confirmed evidence level when the fault is actually observed. A true positive by construction. See docs/ai.md.

• frame scan --confirm-proofs (no model): for a C integer-overflow/underflow, signed-size, truncation or out-of-bounds finding whose triggering value is a function parameter, Frame compiles a harness that calls the function with the solver's own inputs under AddressSanitizer + UndefinedBehaviorSanitizer and confirms only on an observed sanitizer fault. --proof-tests-dir DIR writes each confirmed test as a regression guard.
• frame scan --reproduce-proofs (uses the [llm] endpoint, opt-in): for a finding whose input comes from stdin/argv, a seeded agent writes a reproduction program; the sanitizer is the oracle, never the model's claim.
• frame exploit --deps (no live target): a tainted frame scan --sca finding becomes a pytest that drives the project to the vulnerable dependency call, with a harness spy confirming attacker data reaches it through the project.

Fixes

• sca-real: a case now skips (not fails) when the external package manager crashes in its own code (e.g. pdm via an upstream hishel change), since there is no ground truth to compare and Frame never runs that tool at scan time.

Released alongside

• GitHub Action lambdasec/frame-action@v1 tracks 1.1.1 once the v1 tag is moved.

Highlights

• Broken access control, ahead of the state of the art on detection. frame scan --hunt-authz runs an agentic hunt for IDOR, missing authorization, privilege escalation and mass assignment, with the engine as its tool. On BAC-Bench (30 real advisories in 25 apps) it finds 22/30 with Claude Haiku 5.5, against 19/30 for ABSENTIA and 0/30 for CodeQL and Semgrep; it pairs 11/30 with the fix (ABSENTIA 17/30). Scouts map routes the engine does not know and teach it packs; every handler, service function and authorization helper gets a verdict; code several units relied on but none owned gets a unit of its own; a member the repository cannot decide is reported as unresolved with the fact that would decide it, never a silent "safe". Report
• Infrastructure as code. Kubernetes against the Pod Security Standards, Dockerfiles as BuildKit parses them, Terraform as HCL evaluates it (AWS, Azure, Google Cloud), CloudFormation, Helm via --render-helm, and internet reachability, every policy decided with Z3. frame iac, frame scan --iac.
• Containers. OS packages of Debian, Ubuntu, Alpine, RHEL/UBI 8-10, AlmaLinux, Rocky, Wolfi/Chainguard, openSUSE, SLES 15 and Azure Linux, language packages in an image, and modules compiled into Go and Rust binaries.
• One configuration. Every setting in .frame.toml or [tool.frame] ([llm], [hunt], [kb], [sca], [engine]), validated strictly, resolved as flag > environment > file > default. Environment variables drop from 33 to 9; a retired one that is still set is warned about with the key that replaced it. Example configs in examples/configs/.

Also new

• SCA: Ruby, PHP, Dart and Elixir; Gradle build scripts without Gradle; Z3 upgrade planning for npm, PyPI, crates.io, NuGet and Go; --adapt to fix code an upgrade breaks, verified by the project's own command; licence policy and registry licences; configuration mitigations; govulncheck reachability; backported npm fixes; vendored C/C++ libraries by version header or git blob fingerprint; submodules pinned to untagged commits.
• Secrets: provider key formats in any string literal, opt-in live verification, and frame history across the git history.
• AI applications: prompt injection, model output and retrieved documents as taint, MCP tools and hidden instructions in tool metadata.
• Engine: no framework or benchmark knowledge in the core (40 stages), framework facts as pack data, Razor pages, weak randomness by flow, CWE-690, CWE-770 allocation sizes, C/C++ regions and solver-decided integer conversions, missing function-level authorization (CWE-862) by the app's own convention.
• Agent loops: durable traces (HF Session-Trace), resume, deterministic replay, prompt-cache-stable compaction, streaming with stall detection, outage waits.

Released alongside

• GitHub Action (lambdasec/frame-action@v1, Marketplace): runs Frame 1.1 from today; nothing to change in your workflow.
• MCP server (frame-mcp 0.2.0): scan takes hunt_authz for the authorization hunt (bounded by its step budgets, no subprocess timeout); requires frame-security>=1.1.0; FRAME_LLM_REPO_ROOT is gone.
• Agent skill (lambdasec/skills, frame-security-scan): the hunt, the [llm] config table, --root, and the pre-commit hook at v1.1.0.

Documentation

The AI layer guide is reorganised around the five stages, with a full section on the authorization hunt (how it works, the three verdicts, running it, cost). Secret verification moved into the secrets guide. The README gains the hunt, a BAC-Bench chart, model and config quick starts, and corrected counts (110 framework packs, 100+ finding types).

Changes to note

• Variables that held agent and engine tunables are no longer read: set the [llm] / [hunt] / [engine] keys instead (Frame warns, naming the key). FRAME_LLM_REPO_ROOT is replaced by scan --root.
• frame exploit --max-steps now defaults to llm.exploit_max_steps (250, was 40).
• --model now wins over FRAME_LLM_MODEL and the config file.
• frame scan --hunt-authz output gains a hunt section (JSON key hunt) and warns on stderr when the hunt did not finish.

The first stable release of Frame: a security agent that finds vulnerabilities by following attacker data through your code, proves each path with a solver, and optionally uses an LLM to add recall, exploit and fix.

Install

On PyPI as frame-security; the import name and the frame command are unchanged.

pip install "frame-security[scan]"
frame scan src/

Highlights

• Five languages: Python, JavaScript/TypeScript, Java, C# and C/C++.
• Cross-file taint by default: request data that enters a handler and reaches a query in another file is one finding, with the call chain in data_flow.
• 70+ framework packs (Flask, Django, FastAPI, Express, NestJS, Spring, ASP.NET Core and more), each proven by a vulnerable app and its safe twin. Teach Frame your own stack with one TOML file.
• Guardrails for CI and coding agents: --changed and --files scan only what a change can affect, baselines report only new findings, and frame verify confirms a fix removed the bug.
• GitHub Action (uses: lambdasec/frame@v1.0.0) with SARIF upload to code scanning, and a pre-commit hook (id: frame).
• AI layer on any OpenAI-compatible model, hosted or local: detect, triage, frame exploit against a live authorized target, and frame fix with a re-scan to confirm.
• Separation logic engine on Z3: entailment, frame inference, bi-abduction and countermodels, from the CLI (frame solve) or Python. It also decides C/C++ memory safety in the scanner.

Results

Methods and every suite: benchmarks/README.md.

Docs

Usage · Coverage · AI layer · Separation logic engine