MobSF/mobsfscan 1.0.0

on GitHub

Rules engine

• Port Kotlin and Swift pattern rules to Semgrep; keep Objective-C on libsast regex.
• Organize Semgrep rules by language: semgrep/{java,kotlin,swift}/ and best_practices/{java,kotlin,swift}/.
• Preserve best-practice missing-control inversion per language (SafetyNet/root/tapjacking/pinning/etc.).
• Android code scanning is Semgrep-only (removed Android regex pattern dirs).

New / expanded security coverage

• Clean-room Android rules researched from Minded Security MASTG Semgrep work (biometric crypto, weak TLS, sensitive input/notifications, XOR crypto, layout XML), with credits.
• iOS Info.plist App Transport Security checks.
• Additional Kotlin ports of common Java sinks (WebView, crypto, injection, XXE, etc.).

Reporting & CI

• Native GitLab SAST report output (--gitlab-sast).
• SonarQube formatter upgraded to generic issue format 10.3+.
• Richer SARIF rule titles/dashboard metadata.
• README CI examples updated (actions/checkout@v5, setup-python@v6, SARIF upload).

Reliability / false-positive fixes

• Require libsast 3.1.8 for Semgrep ARG_MAX batching on large scans.
• Fix network_security_config crash with multiple domain-config siblings.
• mobsf-ignore applies correctly per match across files.
• .mobsf severity-overrides for per-rule severity.
• Hardcoded-secret FP reductions (#111) and longer secret literals (#88).
• Exclude Swift print() from ios_log (#112).

Packaging

• Version bump to 1.0.0; setuptools classifier set to Production/Stable.
• Refresh Pipfile.lock / requirements.txt (used by the composite GitHub Action).

Validation

• Unit tests and Semgrep rule fixtures updated/passing.
• Spot-checked against vulnerable apps: PIVAA (Java), InsecureShop (Kotlin), iGoat-Swift, OWASP iGoat (ObjC) — scans completed with findings and no engine errors.

What's Changed

• [iOS] Update best_practices.yaml / ios_keyboard_cache with latest SwiftUI changes by @yanz-safe in #100
• Update kotlin_rules.yaml by @ajinabraham in #106
• docs(readme): add Bitrise integration by @OhMyApp in #113
• Update Semgrep to 1.172.0 for Python 3.10–3.14 by @ajinabraham in #120
• Release 1.0.0: Semgrep Kotlin/Swift migration, new rules, reporting, and reliability fixes by @ajinabraham in #121

New Contributors

• @yanz-safe made their first contribution in #100
• @OhMyApp made their first contribution in #113

Full Changelog: 0.4.5...1.0.0