Changelog
Release history and version notes
v2.1.0
LatestAugust 11, 2026- addedDeterministic false-positive verification that runs on every scan with no AI key required, downgrading likely false positives (empty-body exposures, SPA catch-alls, unproven CVE matches) instead of shipping a false "confirmed"
- addedDeep reconnaissance mode (the --deep-recon flag): exhaustive subdomain enumeration via CT logs, subfinder, and label, environment, and version permutations, then scans every live host discovered instead of a handful
- addedReports now open with a discovered-subdomains table, disclose scan coverage (testable versus WAF-gated hosts), and generate a real executive summary without an AI key
- addedGrouped security-header findings into a single consolidated issue and de-duplicated clickjacking against X-Frame-Options
- fixedFalse critical Spring4Shell RCE that matched any endpoint returning an empty JSON body
- fixedSwagger/OpenAPI exposure no longer misfires on single-page-app shells such as Grafana
- fixedEmpty-body 200 responses (ACME challenge directories, catch-alls) no longer reported as sensitive-file exposure
- fixedCertificate Transparency (crt.sh) failures now surface a warning instead of silently collapsing subdomain coverage
- fixedCorrected four latent scanner bugs surfaced by full type-checking (empty evidence on file-upload findings, degraded template and info-disclosure scanners)
- securityBumped cryptography (50.0.0) and click (8.4.2) to patch known CVEs, and closed a session-file permission race
v2.0.0
March 19, 2026- addedMulti-identity access control scanner (BOLA/BFLA) -- captures two or more authenticated sessions and detects broken tenant/object isolation and cross-identity writes
- addedBrowser-driven session capture for form and SSO/OAuth logins (WorkOS, Auth0, Okta)
- addedAPI surface discovery via OpenAPI/Swagger ingestion, GraphQL introspection, and JS-bundle endpoint mining
- addedOut-of-band collaborator support for blind SSRF, XXE, and command injection
- addedScope engine blocking private/loopback/cloud-metadata targets by default
- addedRun manifest, structured JSON logging, and scan resume/checkpointing
- addedRedesigned HTML/PDF/JSON reports with OWASP Top 10 coverage grid and auto-generated proof-of-concept requests
- fixedReflected XSS false-positive on encoded reflections
- fixedBlind command injection now requires a proportional two-probe timing confirmation
- fixedJWT forgery checks now require a reject-invalid-token oracle before trusting a 200 response
- securityBumped cryptography and lxml to patch two high-severity CVEs
v1.0.0
March 17, 2026- addedInitial public release with 26 scanner modules
- addedMulti-LLM AI engine supporting Claude, GPT-4, Gemini, and Ollama
- addedFive scan profiles: quick, standard, deep, stealth, and API-only
- addedProfessional report generation in HTML, PDF, and JSON formats
- addedAI-powered false positive validation
- addedAttack path analysis and mapping
- addedSmart context-aware payload generation
- addedFull OWASP Top 10 (2021) coverage
- addedExecutive summary generation with business impact analysis
v0.9.0
BetaMarch 5, 2026- addedBeta release with 22 scanner modules
- addedClaude and GPT-4 AI integration
- addedHTML report generation
- fixedSQL injection scanner false positives on PostgreSQL backends
- fixedSSL/TLS scanner timeout on slow connections
v0.5.0
AlphaFebruary 15, 2026- addedAlpha release with 15 core scanner modules
- addedBasic AI analysis with Claude
- addedCommand-line interface
- addedJSON output format