The Reliability Release

Nine ways a scan could report the wrong thing — found, fixed, and locked shut with a runtime release gate and boundary-contract sweeps. This is the release that makes Dino's verdict something you can gate a deploy on.

A QA tool is only useful if you can trust it to be right. 0.5.0 is a correctness milestone. A pre-release audit and live runtime verification found nine ways a scan could report the wrong thing — a clean result that wasn't true, or a critical finding that wasn't real — and fixed every one, each with a regression test. This is the release that makes Dino's verdict something you can gate a deploy on.

Your scans won't lie

The bugs we fixed all shared a signature: a confident result that wasn't earned.

• No more false CLEAN. If Dino couldn't actually authenticate — a blank credential, or a non-bearer method (API key, basic auth, session cookie) on a GraphQL API — earlier versions could scan *unauthenticated* and report "no findings." Credentials are now applied end-to-end across GraphQL and REST, or the scan fails loudly. It never pretends it tested something it didn't.
• No more fabricated criticals. A server error (5xx) on a permission-denied check was being reported as a confirmed auth bypass. A transport failure that never reached the auth layer is now correctly inconclusive — not a false alarm on your dashboard.
• Ad-hoc scans actually run. dino scan against a two-line config is repaired, along with redirect-following introspection — APIs that canonicalize http→https or apex→www now scan cleanly instead of failing at the door. OAuth2 flows that omit expires_in are accepted per spec, and the input-fuzzer no longer drops findings when a scan is time-boxed.

And they stay fixed

Every fix ships with a test, but we went further and closed the whole class.

• A runtime release gate now builds the CLI and runs its real command surface against a live API *before any release is published* — the exact check that would have caught these. A broken build can no longer reach npm.
• Boundary-contract sweeps make the two seams where the bugs lived exhaustive: a new response type or auth method can't be added without explicitly defining how it's classified and applied. The compiler enforces it.

Point it at an API in 20 seconds

No account, no test scripts, no setup: ``bash printf 'endpoint: https://your-api.com/graphql\nprotocol: graphql\n' > .dino.yml dino scan ` Dino introspects the schema, tests every operation for security, correctness, and breaking changes, checks the docs against reality, and scores each endpoint's health. GraphQL and REST, one command. npm install -g @dino-hq/cli`.