v3.0.0: AI-native detection engine — 87% recall across 3 benchmarks

What's New

VulnScout is now an AI-native security reasoning engine. Claude reads source code, traces data flows, and reasons about exploitability. Static tools (Semgrep, Joern, CodeQL) are supplements, not the primary.

Benchmark Results

App	Language	Known Vulns	Recall
OWASP Juice Shop	TypeScript	13	100%
DVWA	PHP	10	90%
WebGoat	Java	8	62%
Overall	3 languages	31	87%

Key Changes

Architecture: full-audit Step 4 rewritten — Claude reads every source file, traces user input to dangerous sinks, checks for missing security controls, invokes the code-reviewer agent, then runs static tools as supplement.

New Modules (20+):

• Semantic FP checks, entry point discovery, cross-tool correlation
• Attack chain detection (5 patterns), knowledge graph, blast radius analysis
• Auto-triage, incremental scan cache, feedback loop
• PoC generation, security mutation testing, differential analysis
• API spec parser (OpenAPI/GraphQL), business context extractor

New Detectors (11): SQLi template literals, SSRF two-pass, race conditions, prototype pollution, file upload, OAuth/OIDC, IDOR/missing ownership, frontend XSS, stored XSS risk, PHP injection, request smuggling

New Commands: /diff, /mutate, /auto-fix, /create-rule

New Tool Runners: Trivy (containers), Checkov (IaC), Slither (Solidity)

New Agent: attack-researcher — autonomous attack vector exploration

Stats

• 80 files changed, 13,373 lines added
• 116 tests passing
• 13 commands, 8 agents, 27 skills
• 9 supported languages