Update README for v0.10.0

[thebenignhacker]

Summary

• Document the new --publish flag on secure, attack, and scan-soul commands
• Add Registry Integration section explaining community vs full-weight publishing
• Add --registry-url custom endpoint option to examples

Test plan

• Build passes
• All 838 tests pass
• README renders correctly (no broken markdown)

[github-actions]

Claude Code Review

VERDICT: APPROVE

SUMMARY: This is a documentation-focused PR that updates the README to document new --publish and --registry-url flags for version 0.10.0, along with version bumps in package files. The only code changes are minor improvements to the external scanner: protocol validation, private IP warnings, and fixing an insecure SSL default. After verifying the full source code, no security or correctness issues were introduced.

FINDINGS:
None. All potential security concerns were adequately mitigated:

• Protocol validation (lines 73-82 in external-scanner.ts): Blocks dangerous protocols like file://, gopher://, allowing only http:// and https://. This prevents SSRF via protocol smuggling.

• Private IP scanning (lines 61-72, 89-94): Detects RFC 1918 ranges and cloud metadata endpoints (169.254.169.254), logs a warning, but allows scanning to proceed — correct for a security scanner's legitimate use case.

• SSL certificate validation (line 318 in external-scanner.ts): The fix corrects inverted logic from the previous code (rejectUnauthorized: false hardcoded). Now properly respects the insecure flag with correct boolean logic (rejectUnauthorized: !insecure), defaulting to secure (rejecting unauthorized certs).

• Command injection mitigation (lines 562-564 in soul/scanner.ts): Replaced shell-interpolated execSync with execFileSync using array arguments, eliminating shell injection risk when passing the prompt to the claude CLI.

All changes pass the verification mandate — mitigations are present in the same code paths where vulnerabilities could have existed.

---

Reviewed 7 files changed (10577 bytes)