What's new

Platform rebuilt from the ground up: five independent capability oracles with provable accuracy — SQLi differential, IDOR/BOLA, session fixation, OOB/SSRF, race conditions. Every finding includes a proof package with full evidence chain.

AI attack planner builds exploitation chains after each scan: e.g., IDOR into privilege escalation. LLM proposes next steps, the deterministic oracle verifies them. No verdict is issued without a real experiment.

Provable findings instead of heuristics: every supported_candidate is backed by a cryptographically content-addressed evidence package and hash-chained lifecycle ledger. Re-evaluating the same frozen evidence always yields the same verdict.

Two-account authorization testing for IDOR: the platform registers two accounts on the target, checks cross-account resource access with ownership binding from JWT claims. First live finding: BOLA on Juice Shop /api/Users/{id}.

Full rescan of all authorized targets launched July 23, 2026 with expanded permissions (all HTTP methods, full port range, reversible_state_change). Results will appear in your reports within the next few hours.

Own OOB collaborator on oob.example.com: blind vulns confirmed by real DNS+HTTP callbacks. Precision proven end-to-end.

Playwright account factory: auto-registration, email verification via OOB inbox, session persistence. Scanner obtains 2+ accounts per target and runs cross-account authz tests (BOLA/IDOR/BOPLA).

Honest KPI after mass retro-verification: 528 false positives removed. Critical: 50, high: 241 (confirmed only). AI lead noise cleaned.

20+ new check classes: IDOR/BOLA, mass assignment, NoSQL/GraphQL, host-header, HTTP smuggling, prototype pollution, deserialization, LDAP/XPath, open-redirect/OAuth, CSV-formula, JWT attacks, exposed-services, heap/DB-PII/cloud bucket pointers.

Precision gate: no sprint may raise FP-rate. Severity routing: only OOB/differential get high/critical. Heuristic-only -> medium+needs_review.

Deployed our own public OOB collaborator: blind vulnerabilities (SSRF, RCE/CMDi, XXE, Log4Shell, NoSQLi, SSTI, deserialization) are now confirmed by real callback interaction from the targeted host, not a synthetic stub. This turns the previously silent blind class into real findings on production targets.

Major false-positive pass: legacy XSS reflection fallback removed, IDOR without ownership proof downgraded, NoSQLi success heuristic replaced with a positive differential, SQLi POST/JSON moved to two-sample stability, time-based checks are now jitter-robust. Result — less noise and more trust in high/critical.

Severity calibration: high/critical are now reserved for OOB- or differentially-confirmed findings; heuristic-only confirmations move to medium flagged as ‘needs review’.

10+ new check classes: IDOR/BOLA, mass assignment, NoSQL injection, GraphQL, host header/cache poisoning, HTTP request smuggling, prototype pollution, deserialization, open redirect deepening + OAuth chains, LDAP and XPath injection.

Engine depth: context-aware XSS, DOM-XSS via headless browser, parameter mining, header injection, REST/JSON-XML body fuzzing, content-type pivoting, WAF-evasion mutations, optional sqlmap confirmation for boolean-only SQLi.

Fixed auto-discovery of authorized domains: the full list of reachable targets is now imported from the checkpoint file (previously only 2 issue rows were picked up). 370+ new targets were automatically queued.

Added the Auto-discovered digest: fresh crawled/feed targets with critical/high findings, short impact summaries, and preview/PDF report links.

Private reports for manually submitted user domains now require the owner's Preview key. Only auto-discovered/operator-published reports stay public.

Added limited Tor/.onion support: Tor v3 validation, SOCKS routing, and a safe light profile without DNS/CT/WHOIS noise.

If another user already scanned a domain, duplicate launch is blocked: only critical/high/total counters are shown, with a Telegram contact path for report access.

Enabled the wave-based approach: promising signals are rechecked in later waves, so scans are deeper and now take more time.

Expanded active checks: auth-bypass, CMDi, LFI, SQLi/XSS, and AI hints now work together more coherently and target real high/critical classes better.

Public positioning moved from Beta to Preview: this is no longer a quick demo scan, but a deeper tester-facing pipeline.

All 31 scanner engines now active — including DNS hygiene, email audit, CSP/CORS, mixed content, cookies/JWT, WebSocket, CT-log mining, typosquat, dependency confusion, secret validity.

Lightweight checks (14 engines) now run in a parallel pool — scans ~25 min faster.

Blind SSRF confirmation via interactsh-client (OOB) — real OAST protocol, not a stub.

Scan budget increased to 2 hours — 31 engines have time to complete even on heavy domains.

JS secrets + source map detection — API keys, tokens, JWTs in client-side code.

XSS confirmation — actual unencoded reflection verification. SQLi — error + boolean-based confirmation.

TLS/SSL grade (A-F) from testssl scan — encryption posture at a glance.

Email auth — automatic SPF/DMARC check for the mail domain.

JavaScript secrets + source map detection — API keys, tokens, JWTs in client-side code. New js_secrets engine.

XSS confirmation — not just «possible», we actually verify unencoded reflection. SQLi — error-based + boolean-based confirmation without data extraction.

TLS/SSL grade (A–F) from full testssl scan. See encryption posture at a glance.

Email authentication suite (SPF/DMARC) — automatic mail-domain configuration check.

Moved to a new server (12 CPU / 125 GB RAM). Scans no longer choke the system; nuclei runs fast.

A key now gives up to 5 scans (was 1). All existing keys auto-upgraded — beta testers now have 4 extra scans each.

New «Find your reports by key» page — forgot your scan link? Enter your key to see all your scans with results. Button on the homepage.

The sign-in page now shows your scan history and remaining limit. No longer «1 key = 1 scan and you're done».

Realistic scan time on all pages (~15–40 min, up to 60 for large sites), not «10 minutes». Progress page timer also fixed.

The vulnerability-scanning phase works again — engines (nuclei, testssl, active checks, AI vectors) were silently disabled by one broken function. Scans now actually find holes instead of pretending to.

Stuck scans no longer hang forever: an auto-retry job (every 10 min) picks up lost/stuck tasks and re-queues them.

Heavy domains no longer block the worker for hours: a hard per-scan time budget and a subdomain cap (≈2000 prioritized instead of 41 000+) keep scans within budget instead of running 8 hours.

Honest security score: if the scan phase didn't run, we no longer show a misleading «100/100 secure». «Checked & clean» is now distinguished from «didn't finish checking».

Closed the database and queue (Redis) from the internet — ports 5432/6379 were exposed and Redis had no password. Now localhost-only, Redis password-protected.

Strict validation of the entered domain: argument-injection into engines (nuclei/nmap/ffuf etc.) is no longer possible. All validation goes through one function.

Fixed testssl.sh and dnsrecon engines (failed due to missing system dependencies). DNS enumeration and TLS checks produce results again.

Resilience: an engine that crashes no longer kills the whole scan — the rest keep running. Tool output no longer breaks on non-UTF8 bytes.

This very «What's new» page — we'll post meaningful daily changes here.