NSAuditor AI EE 0.32.8: The Overclaim Inside the Evidence Pack

Nsasoft US LLC has published NSAuditor AI Enterprise Edition 0.32.8, alongside Community Edition 0.2.33 and agent-skill 0.2.31. It is a documentation-and-prose release: no detection changes, no routing changes, no coverage-matrix movement. The plugin count stays at 28 and all seven coverageSummary blocks are byte-identical to 0.32.7. What changed is 27 claims across the three published packages that the company’s own code did not support — and five of them were not marketing copy at all.

The audit that did not stop at the README

The previous release removed six advertised capability flags with no implementation behind them. That fixed the tier map and the storefront. It did not ask the next question: where else does the product make a claim?

The air-gapped-delivery story turned out to be the answer. Documentation promised container images for amd64 and arm64 — the build forces --platform linux/amd64, and the only arm64 image ever produced was a build-host default that was diagnosed as a bug and corrected. It promised installation tarballs for offline install — no such artifact and no such tooling exists, and an npm pack tarball could not install offline anyway, because its dependencies still resolve from a registry. It promised monthly NVD feed bundles — nothing produces one, nothing downloads one, no pipeline delivers one. It promised an air-gapped installation script that is not in the tree, showed a docker load example against an image tag no pipeline publishes, and documented a feed import command that does not exist: the function behind it has zero non-test callers.

On the Community side, the Zero Data Exfiltration section claimed that every feature works without internet access. A default scan attempts NVD egress unless NSAUDITOR_OFFLINE_ONLY=1 is set.

Five of them were inside the evidence pack

This is the part worth reading closely.

When the intelligence engine cannot answer a CVE lookup, it does not stay quiet — it emits an explicit [COVERAGE GAP] finding with a reason explaining what happened and what the operator should do. That reason renders verbatim into the assessor-facing evidence pack. It is, by design, the sentence an auditor reads when the tool admits it does not know something.

Two of those sentences told the reader to import a feed via the importFeed CLI — a command that does not exist. A third said NSAUDITOR_OFFLINE_ONLY=1 would import a feed, when that variable only selects the local store and populates nothing. Two more said simply “import an offline NVD feed”, naming neither a command nor an artefact. Those last two survived the first pass and were caught by an external reviewer.

A README overclaim misleads a buyer, and a buyer can check. This one misled an auditor, inside the artifact sold to auditors as evidence, at the exact moment the tool was being honest about a gap. The audit that opened this lane had enumerated documentation surfaces; it had not enumerated runtime prose.

A risk register that mitigated a risk with a control that was never built

The company’s business plan carries a risk register. Against “NVD feed reliability” the mitigation read: “Monthly NVD feed bundles already supported.” They are not supported and they do not exist. The row now states what is actually built — the offline query path, and a fail-closed [COVERAGE GAP] on any lookup the local store cannot answer, so degraded feed data surfaces instead of reading clean — separates that from what is not built, and records the residual risk as carried, not mitigated.

Nothing was fixed by deleting sentences

Withdrawing an overclaim by deletion trades one inaccuracy for another: it under-claims something that genuinely ships and leaves the reader with less truth than before. So the air-gapped section was rewritten rather than cut.

What ships, stated positively: the container image is a delivery vehicle, not a security boundary, built linux/amd64; the npm host install is the other vehicle; license verification is fully offline — an ES256 signature checked against a public key embedded in the package and a revocation list inside the tarball, with no activation call and no heartbeat, and running tcpdump alongside license --status is the intended way to confirm that independently; and CVE matching runs offline under NSAUDITOR_OFFLINE_ONLY=1, emitting a coverage gap rather than a silent clean when the local store cannot answer.

Then, in as many words, “Deliberately not claimed” — no arm64 image, no dependency-complete offline installer, no recurring vulnerability-data delivery service, no scripted isolated-network setup. Three new Planned capabilities rows keep those legible as roadmap instead of silent.

Guards, and the escape they did not catch

Both the Enterprise and Community packages now carry a guard that fails the build if a withdrawn claim reappears. Two design details matter. First, every pattern carries a hand-written probe it must match — a pattern list that matches nothing reads exactly like a clean subject. Second, the guard is pinned at equality, so deleting a disclosure fails the build exactly as loudly as re-adding a claim; the “fix it by removing the sentence” escape is closed by construction. Every withdrawal also records what would have to ship to earn the words back, so the next engineer reads a specification rather than a prohibition.

Review then found the guard had been escaped anyway — by vocabulary. A separate document promised “Monthly NVD feed snapshots (downloadable archive)” to a wider tier than the claim that had been withdrawn: same deliverable, same guarded file, a synonym no amount of pattern-sharpening would have caught. The guard now enumerates the thing’s nouns rather than one of its spellings, and file-level exclusions were replaced with per-pattern ones after one blanket exclusion turned out to be hiding two further lines, one of which had never been scanned by anything.

A CLI defect the release gate caught

The pre-publish gate justified itself on its first run. Executing the documented scan command with a version-named output directory wrote all 228 artifacts to the parent directory instead — exit 0, no warning. The resolver decided file-vs-directory by asking whether the path had an extension, and path.parse('ee-0.32.8').ext is '.8', so a version-named directory was read as a file. The same shape breaks v1.2.3 and release-2026.07. Twelve unit tests covered that function and none used a dotted directory name; only running the real command the way an operator would surfaced it. It is fixed in Community Edition 0.2.33 — an extension counts as file-like only if it starts with a letter — which makes this cycle not purely prose-only on the CE side.

What this release does not close

It closes the package half of the class, not the class. Web pages and llms.txt files carried the same withdrawn air-gap wording and were corrected in the same cycle. Separately, a WORM claim remains inconsistent across surfaces — the business plan says S3 Object Lock “is wired into the WORM pipeline”, while the Community README and the monetization document correctly say NSAuditor validates and reports Object-Lock posture and does not itself write the archive. That sits outside this sweep’s declared scope and is named rather than folded in quietly.

Also explicitly not claimed: RFC 3161 timestamps and Ed25519 identity verification remain roadmap. No evidence-pack signer ships; SHA-256 chain-of-custody is the layer that does.

Availability

• Enterprise: @nsasoft/nsauditor-ai-ee@0.32.8 (restricted)
• Community: nsauditor-ai@0.2.33 (MIT)
• Agent skill: nsauditor-ai-agent-skill@0.2.31

Seven frameworks from one read-only scan: SOC 2 Type II, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, and the GDPR Article 32 infrastructure substrate. Coverage matrices are unchanged at SOC 2 10/4/33, HIPAA 7/3/45, NIST CSF 13/10/83, PCI DSS 19/9/39, ISO 27001 17/14/62, CIS v8 17/23/113 and GDPR Art. 32 4/5/2.

A note on how to read these claims: the product produces evidence packs; auditors decide outcomes. Nothing here is a guarantee of an audit result — and after this release, rather fewer things are a guarantee of anything that has not been built.

Details: nsauditor.com/ai/enterprise