I released CodeInspectus v1.5 — a local-first security scanner for AI-generated code

V1.5 is now released. The main additions are:
86 curated detections:
65 first-party native rules
18 CodeInspectus-owned Opengrep rules
3 CodeInspectus Gitleaks rules
Expanded Python AI/API coverage to ten rules.
Bounded AI tool-execution checks for Go, Java, C#, PHP, Rust and Ruby.
GitHub Actions expression-injection and pwn-request detection.
Firebase public-write configuration checks.
Existing Flutter, Dart, Android, iOS, React Native and Expo coverage.
Scan → fix → rescan comparison with resolved, remaining, introduced and not-rechecked states.
Cross-platform CI across Windows, macOS, Linux amd64/arm64 and Node 22.
SHA-pinned scanner engines, provenance checks and secret redaction.
The language packs are deliberately scoped. For example, the new Go, Java, C#, PHP, Rust and Ruby packs each cover a bounded AI tool-execution pattern—they are not being presented as complete native SAST coverage.
I also added a reproducible public-repository case study. It scans a pinned commit from Textualize/Rich, detects an unsafe GitHub Actions expression, applies GitHub’s documented remediation in a temporary clone, and verifies:
1 resolved
0 remaining
0 introduced
0 not rechecked

GitHub:
https://github.com/Synvoya/codeinspectus

V1.5 release:
https://github.com/Synvoya/codeinspectus/releases/tag/v1.5.0

Reproducible case study:
https://github.com/Synvoya/codeinspectus/blob/master/examples/reports/rich-github-actions-v1.5.0.md

npm:
https://www.npmjs.com/package/codeinspectus
I’d particularly appreciate feedback on the CLI experience, false positives and security patterns commonly introduced by coding agents.