v0.8.2 is a security maintenance release.
It does not add CLI flags, change the JSON result schema, or expand LogShield into heuristic secret detection. The release hardens the existing redaction boundary in cases where malformed or unusual input could previously leave part of a supported secret value in output.
What changed
Unterminated private-key blocks
A log can be truncated after a PEM or OpenSSH private-key header and before its closing END line. In v0.8.2, once LogShield sees a supported private-key header, it redacts the header and all following block material when the closing line is missing.
The output marker remains <REDACTED_PRIVATE_KEY_BLOCK>.
Complete password values
Password fields now treat escaped quotes as part of a quoted value. This preserves valid JSON string boundaries while ensuring the entire password is replaced.
For unquoted password fields, punctuation within the same non-whitespace token no longer leaves a raw suffix in output.
Safe CLI diagnostics
Usage and input-file errors now use deterministic generic messages. LogShield no longer reflects a supplied unknown flag or input-file path back to stderr, which prevents an accidental secret in a command argument from being copied into CI or terminal logs.
Explicit single-file behavior
logshield scan [file] accepts stdin or one optional file. Extra positional file arguments now fail with exit code 2 instead of being ignored.
What did not change
The normal CLI and machine-readable contracts remain stable:
logshield scan
logshield scan --dry-run
logshield scan --json
logshield scan --json --dry-run- --dry-run --json still emits an empty output field and rule-name-only matches. - --dry-run --summary remains supported and continues to use the dry-run reporting contract. - Exit code 1 remains reserved for --fail-on-detect when a detection occurs. - Default and strict rule coverage remain documented separately; this release does not add broad new detection patterns.
Verification
The release gate covers typechecking, the full regression suite, and a dry-run package inspection. The v0.8.2 release also verifies that private-key bodies, password suffixes, JSON output, and CLI diagnostics do not expose the test sentinels used by the regression cases.
Upgrade
npm install -g logshield-cli@0.8.2For CI, the recommended detection gate remains:
logshield scan --dry-run --fail-on-detect < logs.txtv0.8.2 is deliberately a patch release: it closes concrete leak paths while preserving LogShield's deterministic, local, rule-based design.