NR-08 · Deimos AI LLC · California, USA · 2026-10-24
Wardlatch 0.1.9: every “safe” now names what it checked.
The free leak check’s new release says “could not be tested” wherever earlier versions could say “safe” without having really looked.
Wardlatch 0.1.9, the free open-source check Deimos AI LLC released for the leaked eMudhra keys, is out. It adds no new incident checks. It makes the answers it already gives harder to get wrong.
What earlier versions got wrong
Our own review, repeated by independent reviewers before this release, found ways versions 0.1.0 to 0.1.8 could report “safe” without having really checked. On a network that inspects TLS, every runtime could read as blocking the keys (GHSA-766p-78h4-77gr). A container that couldn’t reach the test sites could read safe (GHSA-gxqr-jm2v-mcm8). Folders it couldn’t open, test sites that didn’t answer and files it didn’t read were left out instead of reported (GHSA-9m5q-pvx5-fp26).
Before release, a bug hunt planted small bugs in the code to see which ones the tests missed, ran attack scenarios against it, and was followed by independent checks of every fix. It found more of the same kind, now fixed: WordPress sites kept in other layouts, keys in deleted or UTF-16 files, curl headers read from a file, and a Podman engine that refused permission.
What 0.1.9 does
Every “safe” line names what it looked at, and anything Wardlatch couldn’t look at says “could not be tested”. The programs it runs get only the settings their job needs, and each runtime is tested once for each compromised root, with only that root trusted. Anyone who relied on a “safe” from 0.1.0 to 0.1.8 should run it again: npx wardlatch@latest.
Wardlatch is free at www.deimoscore.com/wardlatch/.
Share this release
The facts in this item · from the Record
Each number is pinned as it stood when this item was published, 2026-10-24. The Record keeps the live value; if it moves, the row says so and this item’s text is not rewritten.
- 0.1.9Wardlatch, the free check: current version on npmCheck it: Wardlatch, the free check: current version on npm, on the Record
Sources
About Deimos AI LLC
Deimos AI LLC builds software that keeps people in charge of their AI agents: seen, approved, stoppable and provable. Its instruments include Ratchet, a live effect gate; Crimp, an open-source decision gate; Marklode, startup due diligence checked by a person; and Clockford™, whose private beta opens Nov 10th, 2026. It publishes a dated, sourced ledger of its claims. Defence only.
Media contact
No press inbox is published yet, and this site has no forms. Message Deimos AI LLC on LinkedIn, or use the contact page.