Gap Hunter Labs — new plugins

Undeclared Dependency Companion

Wed, 14 Oct 2026 00:00:00 +0000

Flags a package imported in JS/TS but not declared in package.json -- a common slopsquatting / supply-chain risk.

Dockerfile Missing USER Companion

Wed, 14 Oct 2026 00:00:00 +0000

Warns when a Dockerfile's final build stage never sets a non-root USER (containers run as root by default).

Postman OpenAPI Drift Companion

Fri, 11 Sep 2026 00:00:00 +0000

Warns when a Postman collection endpoint's method+path no longer exists in the project's OpenAPI/Swagger spec.

PHP Composer Script Companion

Fri, 11 Sep 2026 00:00:00 +0000

Flags an orphan composer.json script -- never called from itself, CI configs, or README.md.

Log Format String Companion

Fri, 11 Sep 2026 00:00:00 +0000

Flags a log call whose placeholder count doesn't match its argument count -- SLF4J {} and Python %-style format strings.

Semver Bump Mismatch Companion

Thu, 10 Sep 2026 00:00:00 +0000

Flags a CHANGELOG.md release that reads as a breaking change but didn't bump MAJOR.

SQL Concatenation Companion

Thu, 10 Sep 2026 00:00:00 +0000

Finds SQL built by unparameterized string concatenation or interpolation, then executed, across Java/Kotlin/Python.

Ruby Companion

Thu, 10 Sep 2026 00:00:00 +0000

3 turnkey Ruby checks in one extension: shell injection, Net::HTTP reuse in a loop, and ungrouped dev/test gems in Gemfile.

PHP Security Companion

Thu, 10 Sep 2026 00:00:00 +0000

5 turnkey PHP injection-sink checks in one extension: SQL, shell, file inclusion, function injection, and open redirect.

Merge Conflict Leftover Companion

Thu, 10 Sep 2026 00:00:00 +0000

Finds leftover Git conflict markers (<<<<<<<, =======, >>>>>>>) accidentally committed in any file.

Circular Dependency Companion

Thu, 10 Sep 2026 00:00:00 +0000

Flags real circular dependencies between modules of a multi-module Gradle project -- 100% static text parsing, no Gradle daemon.

Cert Companion

Thu, 10 Sep 2026 00:00:00 +0000

Decodes X.509 certificates (PEM/CRT/CER/DER) inline -- subject, issuer, validity, fingerprint, right in the editor.

Wrangler Config Companion

Wed, 09 Sep 2026 00:00:00 +0000

Validates wrangler.toml -- required fields (name/main/compatibility_date), and missing bindings.

Unleash Flag Usage Companion

Wed, 09 Sep 2026 00:00:00 +0000

Inventories Unleash feature flag usage across your codebase -- naming check, find-all-usages, stale-flag detection.

Turborepo Graph Companion

Wed, 09 Sep 2026 00:00:00 +0000

Shows your Turborepo workspace dependency graph as a sidebar tree -- parses turbo.json + package.json workspaces.

MLflow Companion

Wed, 09 Sep 2026 00:00:00 +0000

Browses local MLflow tracking-store runs (params, metrics, tags) in a sidebar tree, reading the store directly.

Flaky Test History Companion

Wed, 09 Sep 2026 00:00:00 +0000

Tracks pass/fail history per test across JUnit XML report runs and flags tests with mixed outcomes.

Embedded Stack Usage Companion

Wed, 09 Sep 2026 00:00:00 +0000

Parses GCC .su stack-usage files (-fstack-usage) and flags any function over a configurable stack budget.

Config Secrets File Companion

Wed, 09 Sep 2026 00:00:00 +0000

Flags a hardcoded secret (AWS key, GitHub/Slack token, JWT, PEM key, or high-entropy value) in config and env files.

Typosquat Dependency Companion