Refresh Gemini validation-engine model defaults (v2.7.1)

.env.example

@@ -15,17 +15,25 @@ DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN
 
 # Optional: two-tier Gemini validation engine (google-genai SDK).
 # Tier 1 pre-filters obvious noise cheaply; Tier 2 deep-validates real / critical
-# findings. Defaults track Google's current lineup (Gemini 3.x); override to pin.
-GEMINI_TIER1_MODEL=gemini-3.1-flash-lite
-GEMINI_TIER2_MODEL=gemini-3.5-flash
+# findings. Defaults track Google's current lineup: Tier 1 on 3.5 Flash-Lite
+# (fastest / most cost-effective 3.5-class), Tier 2 on 3.6 Flash (stronger
+# reasoning workhorse). Override to pin a specific model.
+# Tip — list the exact model IDs your key can call before overriding:
+#   curl -s "https://generativelanguage.googleapis.com/v1beta/models?key=$GEMINI_API_KEY" | jq -r '.models[].name'
+GEMINI_TIER1_MODEL=gemini-3.5-flash-lite
+GEMINI_TIER2_MODEL=gemini-3.6-flash
+# Security-focused option: point Tier 2 at the security-specialised 3.5 Flash
+# Cyber model (tuned to detect/reason about software vulnerabilities) once your
+# API key can call it — a strong fit for the deep secret-validation tier.
+# GEMINI_TIER2_MODEL=gemini-3.5-flash-cyber
 # Reasoning effort per tier (Gemini 3.x thinking_level): minimal|low|medium|high
 GEMINI_TIER1_THINKING=minimal
 GEMINI_TIER2_THINKING=high
 # Severities that ALWAYS escalate to Tier 2 even if the pre-filter rejects them
 # (comma-separated: CRITICAL,HIGH,MEDIUM,LOW).
 GEMINI_ESCALATE_SEVERITIES=CRITICAL
 # Back-compat: a single GEMINI_MODEL (legacy) is honoured as the Tier-1 model.
-# GEMINI_MODEL=gemini-3.1-flash-lite
+# GEMINI_MODEL=gemini-3.5-flash-lite
 
 # Optional: Comma-separated list of origins allowed to call the API from a
 # browser (CORS). Leave empty if the dashboard is always served from the

CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to SecretNode are documented here. This project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [2.7.1] — Gemini validation-engine model refresh
+
+Tracks Google's current Gemini lineup for the two-tier AI validation engine, with no
+change to the engine's logic — only the default model IDs (all remain env-overridable).
+
+### Changed
+- **Tier-1 pre-filter default → `gemini-3.5-flash-lite`** (was `gemini-3.1-flash-lite`): the
+  fastest / most cost-effective 3.5-class model, a natural fit for the high-volume noise-rejection
+  tier.
+- **Tier-2 deep-validation default → `gemini-3.6-flash`** (was `gemini-3.5-flash`): the stronger
+  coding/reasoning workhorse, for confirming genuine high-severity exposures.
+
+### Added
+- **Security-specialised Tier-2 option.** `.env.example` documents pointing `GEMINI_TIER2_MODEL`
+  at the security-tuned **3.5 Flash Cyber** model (built to reason about software vulnerabilities)
+  for security-focused deployments, once a key can call it — a strong fit for the deep
+  secret-validation tier.
+
+All model IDs stay overridable via `GEMINI_TIER1_MODEL` / `GEMINI_TIER2_MODEL`; the legacy
+single-model `GEMINI_MODEL` override is still honoured. No test or logic changes — suite stays green.
+
 ## [2.7.0] — Deep attack-surface platform (passive)
 
 SecretNode grows from a single-URL secret scanner into a **passive attack-surface platform**: give it

README.md

@@ -102,8 +102,8 @@ Pipeline: **browser-like spider (+ source-map mining) → regex (54 patterns) +
 │    └─ shannon_entropy()   (filter < 3.5 bits)                   │
 │                                                                  │
 │  validate_with_gemini()  — two-tier engine (google-genai SDK)   │
-│    └─ Tier 1 pre-filter:  gemini-3.1-flash-lite (thinking:min)  │
-│    └─ Tier 2 deep-valid.: gemini-3.5-flash      (thinking:high) │
+│    └─ Tier 1 pre-filter:  gemini-3.5-flash-lite (thinking:min)  │
+│    └─ Tier 2 deep-valid.: gemini-3.6-flash      (thinking:high) │
 │    └─ Structured output → Pydantic GeminiVerdict               │
 │       {is_valid, confidence, reason}                            │
 │                                                                  │

backend/report.py

@@ -45,7 +45,7 @@ def _tool_version() -> str:
                 return s.split("=", 1)[1].strip().strip('"').strip("'")
     except Exception:
         pass
-    return "2.7.0"
+    return "2.7.1"
 
 
 _TOOL_VERSION = _tool_version()

backend/scanner.py

@@ -44,9 +44,15 @@
 # and thinking levels are env-overridable so the engine tracks Google's lineup
 # without a code change. A legacy single-model GEMINI_MODEL override, if present,
 # is honoured as the Tier-1 model so existing deployments keep working.
+#
+# Defaults track Google's current lineup: Tier 1 on 3.5 Flash-Lite (fastest /
+# most cost-effective 3.5-class, ideal for the high-volume pre-filter) and Tier 2
+# on 3.6 Flash (stronger coding/reasoning workhorse). For security-focused
+# deployments, set GEMINI_TIER2_MODEL to the security-specialised 3.5 Flash Cyber
+# model (tuned to reason about vulnerabilities) once your key can call it.
 _LEGACY_MODEL              = os.environ.get("GEMINI_MODEL", "").strip()
-GEMINI_TIER1_MODEL: str    = os.environ.get("GEMINI_TIER1_MODEL", _LEGACY_MODEL or "gemini-3.1-flash-lite")
-GEMINI_TIER2_MODEL: str    = os.environ.get("GEMINI_TIER2_MODEL", "gemini-3.5-flash")
+GEMINI_TIER1_MODEL: str    = os.environ.get("GEMINI_TIER1_MODEL", _LEGACY_MODEL or "gemini-3.5-flash-lite")
+GEMINI_TIER2_MODEL: str    = os.environ.get("GEMINI_TIER2_MODEL", "gemini-3.6-flash")
 GEMINI_TIER1_THINKING: str = os.environ.get("GEMINI_TIER1_THINKING", "minimal")
 GEMINI_TIER2_THINKING: str = os.environ.get("GEMINI_TIER2_THINKING", "high")
 # Severities that ALWAYS escalate to the deep tier, even if the cheap pre-filter

frontend/index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>SecretNode v2.7.0 — ASM Scanner</title>
+  <title>SecretNode v2.7.1 — ASM Scanner</title>
   <meta name="color-scheme" content="dark" />
   <meta name="description" content="SecretNode — passive attack-surface &amp; exposed-secret scanner with a live dashboard. Self-hosted, offline-capable, multi-device." />
   <!-- No external CDNs: Tailwind and Google Fonts were removed. Fonts are
@@ -450,7 +450,7 @@
       </div>
       <div>
         <div class="header-title">SecretNode</div>
-        <div id="version-line" style="font-family:'Share Tech Mono';font-size:9px;color:#2d4a35;letter-spacing:0.2em;margin-top:1px;">v2.7.0 — ATTACK SURFACE MONITOR</div>
+        <div id="version-line" style="font-family:'Share Tech Mono';font-size:9px;color:#2d4a35;letter-spacing:0.2em;margin-top:1px;">v2.7.1 — ATTACK SURFACE MONITOR</div>
       </div>
     </div>
     <div style="display:flex;align-items:center;gap:24px;">
@@ -573,7 +573,7 @@
           </div>
         </div>
         <div id="console-output" style="padding:12px 14px;flex:1;">
-          <div class="log-SYS">SecretNode v2.7.0 initialised. Awaiting target...<span class="cursor"></span></div>
+          <div class="log-SYS">SecretNode v2.7.1 initialised. Awaiting target...<span class="cursor"></span></div>
         </div>
       </div>
 
@@ -653,7 +653,7 @@
     <!-- ── FOOTER ── -->
     <div class="app-footer">
       <span style="font-family:'Share Tech Mono';font-size:9px;color:#1a2e1f;letter-spacing:0.1em;">
-        SECRETNODE v2.7.0 — PASSIVE ASM SCANNER — RASPBERRY PI 5 / ARM64
+        SECRETNODE v2.7.1 — PASSIVE ASM SCANNER — RASPBERRY PI 5 / ARM64
       </span>
       <span style="font-family:'Share Tech Mono';font-size:9px;color:#1a2e1f;">
         ⚠ FOR AUTHORIZED SECURITY TESTING ONLY

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretnode"
-version = "2.7.0"
+version = "2.7.1"
 description = "Real-time passive attack-surface scanner for credential-leak detection, with a two-tier Gemini AI validation engine (google-genai), live verification, source-map mining, WAF-resilient fetching, SARIF export, and a live dashboard."
 readme = "README.md"
 requires-python = ">=3.11"