Released Contract-Guard Version 3.0.0
I just shipped ContractGuard v3.0.0, a release focused on turning the project into a more polished developer tool.
ContractGuard scans code, configs, queries, Dockerfiles, dependency manifests, PII-like data, and secrets. The goal is to give developers fast local feedback before risky files reach CI or a public repo.
What changed in this release:
VS Code experience
Added a dedicated findings explorer inside VS Code.
Added inline diagnostics for detected issues.
Added quick fixes so users can disable noisy rules directly from diagnostics.
Added finding actions for open, copy, and disable.
Added a ContractGuard output channel for scan/runtime logs.
Added JSON export for findings.
Kept SARIF export for security workflows and CI tools.
Improved scan-on-save behavior so file rescans preserve the existing workspace findings instead of wiping the whole view.
Added timeout handling so analyzer processes cannot hang the extension indefinitely.
Added minimum severity filtering.
Added configurable analyzer selection.
Analyzer and engine improvements
Improved dependency scanning so nested manifests are discovered, not just top-level dependency files.
Added support for legacy npm lockfile dependency parsing.
Improved scanner output consistency by normalizing machine-readable finding text.
This release was less about adding a single good feature and more about making the product better: better UX, better defaults, safer packaging, stronger analyzer coverage, and fewer rough edges.
Congrats on v3. That scan-on-save fix sounds like a lifesaver—nothing kills the flow faster than a UI wipe every time you hit save.
I’m building a lightweight mobile linter (PasteCheck) and I’ve been debating moving toward AST tokens for better accuracy vs just keeping it fast and "vibey." Seeing you prioritize UX and "rough edges" over just stacking new features is a good reminder that the polish is usually what actually keeps people using the tool.
How are you handling the timeout logic for the analyzers? Is it a hard kill on the process or are you managing it through a wrapper?
Thanks, the scan on save fix was one of those places that needed to be addressed because of the unpredictable behaviour even a small change could bring about
On the PasteCheck question, I think the AST-token move would be rewarding if the accuracy gains justify the extra complexity. If you’re trying to stay lightweight and fast, you could probably keep the simple path as the default and add deeper parsing only where false positives are actually hurting trust.
For ContractGuard’s timeout, it’s a wrapper level hard stop. The VS Code extension launches one Python scan process, starts a timer, and if the scan runs too long it kills that child process and surfaces the error. The analyzers themselves run in-process, so there isn’t a separate timeout wrapper per analyzer inside Python.
Congrats on v3. That scan-on-save fix sounds like a lifesaver—nothing kills the flow faster than a UI wipe every time you hit save.
I’m building a lightweight mobile linter (PasteCheck) and I’ve been debating moving toward AST tokens for better accuracy vs just keeping it fast and "vibey." Seeing you prioritize UX and "rough edges" over just stacking new features is a good reminder that the polish is usually what actually keeps people using the tool.
How are you handling the timeout logic for the analyzers? Is it a hard kill on the process or are you managing it through a wrapper?