What's new.

Repo scanner

• Working-tree walk that respects .gitignore and .onuriignore, with size limits.
• Full git-history scanning, reporting the commit, author and date that introduced each secret.
• 30 built-in secret rules plus Shannon-entropy detection for base64 and hex.
• Trojan Source, invisible-unicode, homoglyph and minified-source checks.
• Lockfile parsing with OSV.dev malicious and vulnerable package lookups, typosquat detection and registry existence checks.
• Tamper checks for install scripts, CI workflows, git hooks and build scripts.
• Human, JSON and SARIF reporters. Stable finding IDs.
• Custom TOML rules, .onuriignore and inline suppressions.

Desktop app

• Tray app for macOS and Linux with dashboard, findings, scans, quarantine, feeds, guard and settings pages.
• Ed25519-signed updates, checked against onurilabs.com, installed only on click.
• In-app feedback with an exact preview of what gets sent, and opt-in diagnostics.

Hardening

• #![forbid(unsafe_code)] workspace-wide; fuzz targets for every parser.