---
title: "Changelog"
description: "Tracking updates to the StackHawk platform and HawkScan since 2019."
url: https://docs.stackhawk.com/changelog/
---
# Changelog
Tracking updates to the StackHawk platform and HawkScan since 2019
## October 14th, 2026
### HawkScan (6.6.0)
Added
#### `--sarif-ghas` — SARIF output that GitHub code scanning accepts
Uploading `stackhawk.sarif` (from `--sarif-artifact`) to GitHub Advanced Security code scanning failed validation, and GitHub silently dropped every result because each location was a URL rather than a path. The new `--sarif-ghas` flag (`SARIF_GHAS`) writes a second file, `stackhawk-ghas.sarif`, in the format GitHub requires: rule IDs keyed by plugin ID, rule names GitHub accepts, `helpUri` links to the rule's page in the [Vulnerability Index](https://docs.stackhawk.com/vulnerability-index/), locations given as relative request paths, and fingerprints that stay stable across HawkScan upgrades, so an upgrade doesn't close and reopen every alert. Upload it with `github/codeql-action/upload-sarif`. `--sarif-artifact` output is unchanged, and you can set both flags to get both files.
Added
#### OpenAPI scans honor the base path your spec declares
If your spec declares a base path in `servers[]` (or `basePath` in Swagger 2.0), HawkScan now requests each operation under that path. Before, it requested operations at the root of `app.host`, found nothing, and the scan came back empty unless you added the prefix to `app.host`, which also printed a warning saying the path would be dropped. A path on `app.host` still takes precedence, so existing configurations aren't affected and the prefix isn't doubled, and the warning now tells OpenAPI scans that the path is used as the base path. Set `app.openApiConf.basePath` to choose the base path yourself, or `app.openApiConf.disableServerBasePath: true` to keep the previous behavior. When a spec lists conflicting servers, or overrides `servers` on a path or operation, HawkScan doesn't apply a base path and logs why. See [OpenAPI Configuration](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration/).
Added
#### The `ajax` spider visits your `seedPaths`
`hawk.spider.seedPaths` used to only add routes to the site tree and give the `base` spider extra starting points. The `ajax` spider now also loads each seed path in its browser after the start page, so requests those pages make on load, such as XHR calls, are captured and tested. A seed path that doesn't form a valid URL is skipped with a warning; it doesn't fail the spider. See [seedPaths](https://docs.stackhawk.com/hawkscan/scan-discovery/spider/#seedpaths).
Added
#### Install the `hawk` CLI on Windows with a one-line script
`install.sh` now has Windows versions. In PowerShell, run `irm https://download.stackhawk.com/hawk/install.ps1 | iex`; for `cmd.exe` pipelines, use `https://download.stackhawk.com/hawk/install.bat`. They accept the same `HAWK_INSTALL_VERSION` and `HAWK_INSTALL_DIR` variables, install to `%USERPROFILE%\.hawk\bin`, and check each download's SHA-256 against the published checksum before installing. See [CI/CD Integration](https://docs.stackhawk.com/integrations/ci-cd/).
Improvement
#### An unresolved `${VARIABLE}` now fails the scan
Before, a `${VARIABLE}` in your configuration that matched no environment variable, user secret or organization secret became an empty value, with a warning, and the scan went on with a blank credential. It now stops before scanning with `Missing environment variable: VARIABLE`, the same message `hawk validate config` shows. If you want an empty value, write `${VARIABLE:}` (with the trailing colon). **This is a behavioral change.** A pipeline that left a variable unset on purpose must now set it or use the `${VARIABLE:}` form. See [Organization Secrets](https://docs.stackhawk.com/platform/organization-secrets/).
Improvement
#### Every alert per rule is reported by default
HawkScan used to cap how many alerts each scan rule could report, so large applications lost findings to the limit. The cap is now off by default, so a scan can report more findings than before. If you set `scanner.maxAlertsPerRule` or `pscans.maxAlertsPerRule` through `hawk.config`, your values still apply.
Improvement
#### The scan engine's StackHawk traffic uses the CLI's proxy and trust settings
Calls the scan engine makes to the StackHawk platform during a scan (uploading results and logs, downloading hosted assets, refreshing tokens) now go through the `hawk` CLI. They use the same outbound proxy and trusted certificates as the CLI's own platform calls. Before, a scan behind a corporate proxy could authenticate and start but then fail to upload its results.
Improvement
#### Dependency update for TLS advisories
The `hawk` binary and the `stackhawk/hawkscan` image now ship rustls 0.23.46, which fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349.
Removed
#### Single-identity API authorization rules 40051, 40054, 40055 and 40056
These alpha rules tried to find authorization flaws using only one identity, which can't confirm an authorization flaw, so they raised false HIGH alerts. They have been removed. To test authorization, use [multi-profile business logic testing](https://docs.stackhawk.com/hawkscan/business-logic-testing/), which checks BOLA and BFLA with real second identities. API SSRF (`40048`) now confirms out of band and compares against a baseline response, and API Broken Authentication (`40053`) checks for weak JWT HMAC secrets and the `none` algorithm on every scan.
Fixed
#### `hawk validate auth` intermittently failing after a successful login
`hawk validate auth` could fail just after authentication succeeded, reporting that it `lost the connection to the HSTE daemon`. A race between progress output and the final result caused it, and it is fixed.
Fixed
#### Scans with authentication profiles report their real duration
Scans with multiple authentication profiles reported only the duration of their last pass, which was often under a second, so the platform showed a duration of zero. The duration now runs from the start of the first pass to the end of the last.
Fixed
#### `hawk op scan triage --from-file` rejects entries it can't read
Bulk triage silently ignored keys it didn't recognize and turned an unrecognized `status` into a reset. A file that used `hash:`, or `status: false-positive`, reset findings to New without warning. Unknown keys are now rejected. `findingHash` (also accepted as `finding_hash` or `hash`) and `status` are required. `status` accepts the same values as `--status`. See [hawkop](https://docs.stackhawk.com/hawkop/).
## September 18th, 2026
### HawkScan (6.5.0)
Added
#### `sessionVerification` — check your scan is still logged in, mid-scan
A new `app.authentication.sessionVerification` block has HawkScan re-check its session during a scan by polling your `authentication.testPath`, instead of regex-matching `loggedInIndicator` / `loggedOutIndicator` against every response. When a check fails, HawkScan re-authenticates and carries on, and a scan that spent too much of its run logged out finishes with a coverage warning rather than a quietly thin result. Tune it with `pollFrequency` (default 15 requests while crawling), `activeScanPollFrequency` (default 5, tighter because a request sent unauthenticated during an attack is a missed finding), and `maxUnauthenticatedRequestPercent` (default 5). Verification is opt-in — adding the block, with fields or without, turns it on, and leaving it out keeps today's indicator behavior exactly. `disabled: true` turns it off explicitly, and in that case an indicator is required so that something is still checking the session. See [Session Verification](https://docs.stackhawk.com/hawkscan/authenticated-scanning/#session-verification).
Fixed
#### `hawk rescan` no longer strips `Content-Type` from replayed requests
A rescan replays the requests that produced your findings, with stale authentication stripped. Any header named in `authentication.testPath.requestHeaders` or `app.redact.headers` was treated as credential material and deleted from replayed spider requests. Entity and transport headers — `Content-Type`, `Content-Length`, `Accept`, `Accept-Encoding`, `Host`, `User-Agent` and `Referer` — are now never stripped.
Fixed
#### `hawk op app tech-flags set` no longer re-enables every other tech flag
Naming one technology flag silently switched the other 34 back on, so scans ran with every rule family enabled while you believed you had narrowed to a handful. `tech-flags set` now reads your current flags, merges your change, and writes the result. See [Tech Flags](https://docs.stackhawk.com/platform/tech-flags/).
Added
#### Install the `hawk` CLI with a one-line script
`curl -sSf https://download.stackhawk.com/hawk/install.sh | sh` detects your OS and architecture, downloads the matching `hawk` binary, and verifies its SHA-256 against the published manifest before installing. Set `HAWK_INSTALL_VERSION` to pin a version — worth doing in CI, where a reproducible pipeline matters more than tracking the latest release — and `HAWK_INSTALL_DIR` to change where it lands (default `~/.hawk/bin`). See [CI/CD Integration](https://docs.stackhawk.com/integrations/ci-cd/).
Added
#### Organization secrets resolve in your scan configuration
`${VARIABLE}` references in your configuration now resolve against secrets shared across your organization, not only your own user secrets, so your team can keep one copy of a scan credential instead of one per engineer. Your personal secret still wins where both exist, and HawkScan tells you when that happens. A name neither store can answer still resolves to an empty value — long-standing behavior — but HawkScan now names it in a warning, instead of leaving you to discover it as a credential that quietly stopped working. See [Organization Secrets](https://docs.stackhawk.com/platform/organization-secrets/).
Added
#### Clear errors when your HawkScan version is out of support
If the platform declines a scan because your CLI is too old, HawkScan now reports the platform's own message — naming the minimum supported version and where to upgrade — and exits non-zero, instead of failing with a generic HTTP error. When your version is deprecated rather than blocked, HawkScan logs that advisory once per scan rather than on every platform call, so it stays readable in CI output.
Improvement
#### Dependency updates for customer-reported CVEs
The `stackhawk/hawkscan` image and the `hawk` binary now ship BouncyCastle 1.85 (CVE-2026-8763, CVE-2026-59650, CVE-2026-58062), Apache HttpClient 5.6.4 (CVE-2026-71290) and Netty 4.1.137 (CVE-2026-75595).
## August 19th, 2026
### HawkScan (6.4.0)
Added
#### `--profile-scan-mode` — control plugin coverage across authentication profiles
Multi-profile scans previously always ran a fixed business-logic policy — BOLA and BFLA only — silently discarding the `policyName`, `includedPlugins`, or organization-level policy you had configured. The new `--profile-scan-mode` flag (`PROFILE_SCAN_MODE`) makes that choice explicit: `business-logic` (the default, and the previous behavior) runs BOLA/BFLA against every profile, `primary-full` runs your full scan policy against one profile and BOLA/BFLA against the rest, and `all-full` runs your full policy against every profile. With `primary-full`, `--full-scan-profile` (`FULL_SCAN_PROFILE`) picks which profile gets the full policy — by default the first one declared in your configuration. Scan time grows with the number of profiles scanned in full. When a scan uses more than one profile, findings now carry a `[profile=]` prefix on their evidence so you can tell which identity a vulnerability was found under. See [business logic testing](https://docs.stackhawk.com/hawkscan/business-logic-testing/).
Added
#### HTTP Header Authentication Bypass scan rule
A new active scan rule (plugin `40059`) tests whether authentication can be bypassed by injecting headers such as `X-Forwarded-For`, `X-Original-URL`, or `X-Rewrite-URL` that a proxy or gateway may trust. Like other alpha rules it is off by default — enable it through [policy management](https://docs.stackhawk.com/platform/policy-management/) to include it in your scans.
Improvement
#### `hawk validate config` now exits non-zero when validation fails
`hawk validate config` printed `Configuration Validation Error` and then exited `0`, so success and failure were indistinguishable to a caller. A CI gate written the obvious way — `hawk validate config stackhawk.yml && ./deploy.sh` — deployed anyway on an invalid configuration. Hard validation errors, and a missing configuration file, now exit non-zero. Warnings are unchanged: unknown-property and lint warnings still print and still exit `0`. **This is a behavioral change** — if a pipeline of yours was relying on the old always-zero behavior, it will now correctly fail on a broken configuration. See [hawk validate config](https://docs.stackhawk.com/stackhawk-cli/#hawk-validate-config).
Fixed
#### Scans failing with `No X509TrustManager implementation available`
On macOS, HawkScan builds a certificate trust store from your operating system's trust roots and hands it to the scanner engine. If that store came out unreadable, the JVM silently discarded **all** trust rather than reporting the problem — so every HTTPS request inside the scan failed for the life of the process, including the calls HawkScan makes to StackHawk itself. The store is now verified before it is handed over; if it cannot be read back, HawkScan warns and falls back to the bundled certificate roots instead of leaving the scanner with no trust at all. Scans behind a transparent proxy whose CA is installed in the OS trust store — rather than named explicitly via `outboundProxy.rootCACertPath` — now work correctly as well. HawkScan also logs one line describing what the handoff produced, so a trust problem is identifiable from a scan log:
```
OS-native trust: source=launcher-bundle(/tmp/hawk-os-ca-bundle.pem), proxyCAs=1, store=/tmp/hawk-truststore123.jks, anchors=145
```
Fixed
#### Absolute and `~` configuration file paths
An absolute path to a configuration file was appended onto your repository directory rather than used as given, failing with a doubled path such as `/home/you/repo//home/you/repo/stackhawk.yml`. Tilde paths only worked when your shell expanded them first, so a quoted `'~/stackhawk.yml'` — or any Docker invocation, where there is no shell — failed the same way. Absolute and `~` paths are now honored as written by `hawk scan`, `hawk validate config`, `hawk validate api`, `hawk validate auth`, `hawk list`, `hawk register`, and `hawk perch`.
Fixed
#### `hawk op policy get` could not fetch your organization's scan policies
`hawk op policy get --name ` resolved StackHawk preset policies only. Any policy belonging to your organization returned `Resource not found`, even though `hawk op policy list` showed it and `hawk op policy create` had reported success — meaning there was no way to read back a policy you had just written. Organization policies now resolve correctly. See [HawkOp CLI](https://docs.stackhawk.com/hawkop/).
Fixed
#### GraphQL scan rule false positives
A sweep across the GraphQL rules removed findings raised without real evidence. Introspection and field-suggestion checks no longer flag benign field names that merely contain a sensitive-looking substring, and now attach the probe response as evidence. Deep-recursion and circular-fragment checks no longer flag hardened servers that correctly reject the query, or benign timeout data — a denial-of-service finding now requires an actual server failure. Batch-query and resource-intensive-query checks attach the proving exchange so each alert is self-verifiable.
Fixed
#### Source code disclosure false positives
The Git, Subversion, `WEB-INF`, file-inclusion, and CVE-2012-1823 source-disclosure rules matched over-broad PHP and Java content patterns that fired on ordinary response bodies. Java detection now requires a modifier-qualified type declaration (and recognizes all type declarations, not just classes), the CVE-2012-1823 check diffs against a baseline response, and a decompiler failure on one candidate no longer aborts the rest.
Fixed
#### False positives across command injection, disclosure, and API scan rules
A broad accuracy pass tightened evidence requirements throughout the rule set. ShellShock now always sends its control request before alerting; Spring4Shell and React2Shell require a structurally-matched control response and real out-of-band execution evidence; padding-oracle, XPath, cloud-metadata, remote-file-include, parameter-tampering, directory-browsing, hidden-files, Spring Actuator, relative-path-confusion, HTTP-only-site, and username-enumeration checks each dropped an unanchored or reflection-driven match that produced guaranteed false positives. Broken-authorization checks now require concrete allowed roles, LLM prompt-injection no longer alerts on a merely reflected payload, CORS evidence is hardened against metacharacters and header casing, and cookie length-diffing is gated on response-length stability.
Improvement
#### Improved detection accuracy for SQL injection, HPP, and out-of-band XSS
Oracle time-based SQL injection now uses dose-response confirmation (plugin `40021`) rather than a single delayed response. HTTP parameter pollution correctly handles double-encoded payloads and raises alerts at Low risk with evidence and a clean parameter name. Out-of-band XSS regained its attribute-breakout payloads. Blind command injection and blind SQL injection render their time delays as rounded integers, so the reported payload matches what was sent.
Fixed
#### Corrected risk and CWE classifications
An unconfirmed `DELETE` method finding is now reported at Low rather than Informational, and its fingerprint no longer depends on response ordering. The `.htaccess` information-leak finding is mapped to CWE-529 instead of CWE-94, the ELMAH information-disclosure CWE mapping was corrected, and the API rate-limiting rule now recognizes standard IETF `RateLimit` headers and reports the correct WASC id.
Fixed
#### External authentication guidance in `hawk config show`
`hawk config show app.authentication.external` now tells you to neutralize the logged-in and logged-out indicators with `loggedInIndicator: ".*"` and `loggedOutIndicator: "$^"`. External credentials cannot re-authenticate, so a tripped indicator sent HawkScan down a re-authentication path that could not do anything — costing a duplicate request per tripped response and producing misleading `Authentication failed for user` log lines. This bites hardest during BOLA/BFLA testing, which deliberately provokes the 401 responses a realistic logged-out indicator matches. `testPath` remains the real authentication check for external credentials.
Fixed
#### Browser argument injection in the `hawk` binary (RUSTSEC-2026-0257)
The `hawk` CLI's browser-launching dependency allowed argument injection through the Unix `BROWSER` environment variable. Updated to a patched release.
## August 18th, 2026
### StackHawk Platform
Added
#### Application Team Ownership
For organizations using Teams, the Applications table now shows which Team owns each application and lets you change it in place. Applications without a Team are marked **Unassigned** — select the label to search for a Team and assign one. The same Team field is available in **Application Settings → General**, with **Unassigned** at the top of the list, so clearing ownership works the same way as changing it. Moving an application between Teams no longer requires removing it from its current Team first.
This also corrects Team assignments made through the API. `PUT /api/v1/org/{orgId}/team/{teamId}/application` previously returned a success response without saving the assignment. If you have assigned applications to Teams through that endpoint, re-run those calls to confirm the assignments are in place.
[Teams](https://docs.stackhawk.com/platform/teams/)
Added
#### Team Visibility for Members and View Only Users
Teams pages were previously reachable only by users who could also modify Teams, so Members and View Only users had no way to see the members and applications on their own Team. Viewing a Team no longer requires permission to manage one:
- **Members** can open the Teams they belong to.
- **View Only** users can review every Team in the organization.
Team management controls — Create a Team, Add Members, Add Applications, renaming a Team, and Delete Team — now appear disabled for users who cannot use them, rather than being hidden. Access to Teams is otherwise unchanged: a Member still cannot open a Team they do not belong to.
[Roles](https://docs.stackhawk.com/platform/roles/)
Improvement
#### Team Required When Creating an Application
In the Create Application flow, users who cannot manage Teams and who belong to at least one Team must now assign the new application to one of their Teams, and cannot change that assignment afterward. Users who belong to no Teams, and users who can manage Teams, can still leave a new application unassigned.
Fixed
#### Filter by Unassigned Applications
On the Applications page, the **Filter by Unassigned Applications** checkbox returned no results for Members and View Only users. It now returns the unassigned applications those users can see.
## August 5th, 2026
### HawkScan (6.3.0)
Improvement
#### `hawk rescan` replays alerted requests instead of re-crawling your app
`hawk rescan` no longer re-runs discovery. Instead it replays the exact requests that produced findings on the scan being retested — fetched from the platform — and attacks those directly. Rescans are substantially faster and stay tightly scoped to the findings you're verifying, rather than re-crawling your whole application. All discovery is skipped, including OpenAPI, SOAP, GraphQL, and HAR imports. Path-parameter endpoints such as `/widgets/{id}` still reproduce correctly, and if the replay can't run for any reason the rescan falls back to a normal spider automatically. See [hawk rescan](https://docs.stackhawk.com/stackhawk-cli/#hawk-rescan).
Added
#### `crashDetection` — stop a scan when the target application goes down
New `hawk.scan.crashDetection` configuration detects a target that has crashed or stopped responding mid-scan. HawkScan watches request timeouts and connection failures, and once they cross a threshold it runs a liveness probe against your `app.waitForAppTarget` path before acting — so a single slow endpoint won't trip it. Set `action: ABORT` (the default) to fail the scan with a clear `scan.target-crashed` error rather than spending the rest of the scan window against a dead target, `WARN` to log and keep scanning, or `DISABLED` to turn it off. Tune the trigger with `maxTimeouts`, which defaults to five times your configured `concurrentRequests`.
Added
#### `seedPaths` validation catches concatenated paths
`hawk.spider.seedPaths` entries are now checked when your configuration is parsed, by both `hawk scan` and `hawk validate config`. An entry longer than 200 characters, or with more than 12 path segments, is flagged with a warning — the usual cause is several paths jammed into one list entry instead of listed separately, which quietly seeded nothing you intended. An entry over 1000 characters now fails configuration validation outright. See [spider configuration](https://docs.stackhawk.com/hawkscan/scan-discovery/spider/).
Improvement
#### `hawk op` uses the same credentials as `hawk`
The `hawk op` commands embedded in the HawkScan CLI now read your API key, API host, and organization from exactly the same places `hawk` itself does — your environment and `~/.hawk/hawk.properties`. There's no longer a separate `~/.hawkop/config.yaml` to keep in sync: authenticate once with `hawk` and `hawk op` follows. See [HawkOp CLI](https://docs.stackhawk.com/hawkop/).
Fixed
#### Scans no longer fail with `Unable to validate applicationId` when a different organization's plan is expired
If you belong to more than one organization, HawkScan resolved your `applicationId` by asking each organization in turn. An expired plan on any one of them returned a payment error that aborted the entire lookup — even when the organization that actually owns the application was perfectly healthy — and it surfaced as a misleading `Unable to validate applicationId` message. HawkScan now resolves the application's owning organization directly, in a fixed number of requests no matter how many organizations you belong to. A genuine expired plan now reports an actual billing error instead of an application-id error.
Fixed
#### Hosted scans using both an authentication and a session script
In hosted scanning, when a flow used both an authentication script and a session script, both references resolved to the session script — so your authentication script never ran. Each script is now uploaded and referenced separately by type.
Fixed
#### Hosted scans failing to start
Hosted scan and profile runs could fail at container startup with `exec: "fly": executable file not found in $PATH`. The missing entry point has been restored.
Fixed
#### Path Traversal false positives on reflected input and directory-name substrings
The Path Traversal scan rule no longer reports a finding when your application merely echoes the injected value back in the response, or when a known directory name happens to appear as a substring of an unrelated word — for example `etc` inside `fetch`. A match now requires path-separator context or actual evidence of file disclosure.
## July 14th, 2026
### HawkScan (6.2.0)
Added
#### `hawk upgrade` — one-command self-upgrade
New `hawk upgrade` command updates your HawkScan CLI in place. It detects how hawk was installed — Homebrew, standalone binary, MSI, PKG, or Docker — and either performs the upgrade directly (standalone binary and Homebrew installs) or prints the exact command to run for your install method. Use `--check` to see whether a newer version is available without changing anything, and `--version ` to pin to a specific version.
Added
#### `hawk skills status` — check your StackHawk agent skills are current
New `hawk skills status` command reports which StackHawk agent skills are installed for your AI coding tools (Claude Code, Codex, Copilot) and whether they're up to date, fetching the latest published versions live so the report is accurate on the very first run.
Added
#### `hawk op scan config` and `hawk op scan uris` — scan drill-down
Two new scan inspection commands. `hawk op scan config` retrieves the exact effective configuration a completed scan ran with. `hawk op scan uris` lists the attack surface a scan exercised — and because it is config-aware, it includes GraphQL operations and JSON-RPC methods for those scan types, not just plain URLs. Use `--graphql` or `--jsonrpc` to force a source.
Improvement
#### `--app` accepts a name or UUID across `hawk op`
Every `hawk op` application selector now accepts either an application name or a UUID in the same `--app` flag. The separate `--app-id` flag is deprecated but continues to work as a hidden alias — no breaking change.
Fixed
#### `externalCommand` authentication no longer hangs on a missing command
Scans using `externalCommand` authentication now fail fast with a clear error when the configured command doesn't exist, instead of hanging.
Fixed
#### API scan rule false positives on MCP, JSON-RPC, and GraphQL endpoints
The OWASP API Top 10 scan rules (Broken Authentication, Broken Authorization, Broken Function/Object/Property Level Authorization, IDOR, Rate Limiting, and Unrestricted Resource Consumption) no longer treat an HTTP 200 carrying an in-band error envelope — JSON-RPC/MCP `"isError": true`, GraphQL `"errors"`, or a Server-Sent-Events error response — as a successful request. This eliminates high-severity false positives against MCP servers, JSON-RPC APIs, and GraphQL endpoints that signal failures in the response body rather than the HTTP status.
## July 7th, 2026
### HawkScan (6.1.0)
Added
#### `hawk validate script` — test auth scripts against a live URL
New `hawk validate script` command runs your active and passive HawkScript against a single target URL, so you can iterate on script logic without kicking off a full scan. Run it once, or pass `--watch` to run it in daemon mode and re-execute automatically each time you save the script.
Fixed
#### `hawk init --api-key` and outbound-proxy flags restored
`hawk init` again accepts `--api-key` for non-interactive key provisioning and the full set of `--outbound-proxy-*` flags (`--outbound-proxy-host`, `--outbound-proxy-username`, `--outbound-proxy-password`, `--outbound-proxy-auth-scheme`, and `--outbound-proxy-ca-cert-path`) — along with their `API_KEY` and `OUTBOUND_PROXY_*` environment-variable equivalents. These were dropped in the HawkScan 6.0.0 CLI rewrite. Proxy authentication supports basic auth with an optional PEM CA certificate, and a bad `--api-key` value no longer overwrites a previously validated key.
Fixed
#### Windows truststore certificate loading
Fixed native-truststore certificate loading (`cacerts`) on Windows so OS-native certificate trust — used for transparent TLS-intercepting proxies — works reliably on Windows hosts.
Fixed
#### MCP session handling for session-enforcing servers
HawkScan now captures and replays the `Mcp-Session-Id` header when testing MCP servers that enforce sessions, so scans against those servers no longer fail on session validation.
Fixed
#### Platform secrets resolve behind an outbound proxy
Local scan configurations that reference StackHawk platform secrets now resolve correctly when HawkScan runs behind an outbound proxy.
## June 29th, 2026
### HawkScan (6.0.0)
Added
#### Standalone binary — no Java required
HawkScan 6.0.0 ships as a self-contained native binary for macOS (Apple Silicon and Intel), Linux (x86_64 and arm64), and Windows (x64 and arm64). A trimmed Java runtime is bundled inside — no JDK or JRE installation needed on your machine or in your CI environment. On first run, `hawk` extracts the runtime to `~/.hawk/bin/` and launches normally; subsequent runs skip extraction and start immediately. Remove any Java installation steps from your pipelines — the `hawk` binary is the only thing you need.
Added
#### `hawk op` built in
`hawk op` is now fully integrated into the `hawk` binary — no separately installed `hawkop` binary required for platform operations. Because `hawk op` runs in the Rust launcher layer, it starts instantly without waiting for the Java runtime. The standalone [HawkOp CLI](https://docs.stackhawk.com/hawkop/) remains available for rich query and reporting workflows.
Added
#### OS-native certificate trust — transparent proxy support out of the box
HawkScan 6.0.0 automatically trusts your operating system's certificate store on every platform (macOS Keychain, Windows Certificate Store, Linux system PEM bundle). Transparent TLS-intercepting proxies — Zscaler, Netskope, corporate CAs — work with zero configuration. OS certificates are merged into the scanner's trust store additively, so your existing Java truststore is preserved. Disable with `--no-native-truststore` or `USE_NATIVE_TRUSTSTORE=false` if needed.
Added
#### `hawk init --browser` — non-interactive device-flow auth
New `--browser` flag for `hawk init` skips all TTY prompts — the existing-key confirmation dialog and the "log in via browser / enter key manually" menu — opens the browser immediately, and always prints the authentication URL to stdout. Designed for AI coding agents that need to surface the URL without user interaction.
Fixed
#### Security dependency updates
HawkScan 6.0.0 and HSTE h0.0.161–h0.0.164 ship with the following CVE fixes. No configuration changes required.
**nimbus-jose-jwt 10.0.2** — CVE-2025-53864
**commons-beanutils 1.11.0** — CVE-2025-48734; addressed in both HawkScan and HSTE where the library was pulled in transitively via jsonschemafriend → commons-validator.
**jsoup 1.16.2** — CVE-2022-36033; addressed in both HawkScan and HSTE as a transitive dependency of jsonschemafriend.
**json-smart 2.5.2** (HSTE) — CVE-2024-57699 (stack exhaustion DoS).
**Additional maintenance upgrades** (no CVE annotations in source): Jackson 2.18–2.19 → 2.21.4, Log4j 2.20.0 → 2.25.4, gson 2.3.1 → 2.13.2, Apache HttpClient5 5.2.1 → 5.2.3.
Removed
#### ZIP distribution removed
The `hawk-{version}.zip` download format is no longer available. Pipelines or scripts that download the ZIP directly should migrate to the OS- and architecture-specific binary download at `https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk` (Windows: `hawk.exe`). The [hawkscan-action v3](https://github.com/stackhawk/hawkscan-action) and updated Azure DevOps extension handle the binary download automatically.
## June 10th, 2026
### HawkScan (5.7.0)
Added
#### `hawk flightpath` — local auth-authoring loop
New top-level `hawk flightpath` command runs the auth-authoring loop entirely on your laptop — no cloud infrastructure required. Start your app, log in via a local browser, and `hawk flightpath` drives the auth-analysis loop to produce a validated `stackhawk-auth.yml` ready for scanning.
Fixed
#### Security dependency updates (BouncyCastle 1.84, GraalVM 25.0.3)
HawkScan 5.7.0 ships with BouncyCastle 1.84 (addressing CVE-2026-5588, CVSS 9.2) and GraalVM JS 25.0.3 (addressing CVE-2025-50106, CVE-2025-30749, and CVE-2025-21587). No configuration changes required.
## May 27th, 2026
### HawkScan
Improvement
#### StackHawk CircleCI Orb v2.0.0
The StackHawk CircleCI Orb has been upgraded to CircleCI's orb-tools v12 build tooling and released as **v2.0.0**. This is a breaking change: the orb's jobs and parameters are now `snake_case` — for example `stackhawk/hawkscan-local` → `stackhawk/hawkscan_local`, and `app-id` → `app_id`. Existing pipelines pinned to a `1.x` version are unaffected until you upgrade. When bumping to `2.0.0`, update your job and parameter names; see the [CircleCI integration guide](https://docs.stackhawk.com/integrations/ci-cd/circleci/) and the orb's migration guide for the full mapping.
## May 20th, 2026
### HawkScan (5.6.0)
Added
#### `hawk config` CLI
New `hawk config` subcommands surface HawkScan's configuration knowledge from the command line. Use `hawk config list` to browse every config section, `hawk config show ` to dump the JSON envelope (type, default, constraints, description) for a specific section, and `hawk config recipe ` to print a worked example. Add `--text` to any of them for raw markdown instead of JSON. The same knowledge artifact powers the MCP `get_config_reference` tool, so CLI and agent answers stay in sync.
Improvement
#### Primary-host exact match + HAR uploads scoped to `app.host`
The notion of "primary host" is now exact-match: lowercase host with default ports normalized (`http`→80, `https`→443), scheme ignored. `cdn.example.com` is no longer treated as primary just because `app.host=https://api.example.com`. Hosted-scanner HAR uploads to S3 are filtered to the primary host, so third-party traffic (CDNs, identity providers, analytics) is excluded by default. The CLI escape hatch `hawk perch stop --har-file` still writes the full unfiltered HAR.
Fixed
#### Platform-fetched secrets redacted from console output
Secrets fetched from the StackHawk platform secrets manager are now registered as redaction tokens immediately after retrieval. Previously, if a config validation error dumped the resolved YAML to the console, fetched secret values could appear in plaintext. `HawkValidationError` now applies redaction before rendering error output.
## May 14th, 2026
### StackHawk Platform
Added
#### StackHawk Storage Domains
Two new CloudFront-fronted custom domains — `scan-results.prod.stackhawk.com` and `hosted-assets.prod.stackhawk.com` — now front the platform's object storage for scan results and hosted assets. Objects remain private by default; the platform issues short-lived presigned URLs on these domains for the UI, `hawk`, and `hawkop`. If your egress firewall restricts outbound traffic, allow HTTPS to both domains. Available on request from StackHawk Support.
## April 29th, 2026
### StackHawk Platform
Added
#### Findings Page
View, sort, and filter all open findings across every app and environment in your org in a single table. Findings are refreshed automatically after every scan.
Added
#### Service Keys
Long-lived, organization-owned API keys purpose-built for CI/CD scanning. Unlike personal API keys that are tied to an individual user, service keys belong to the organization itself, so they keep working when team members come and go. Each key is created with the **Scan Only** role, which grants only the permissions needed to run and upload scans across any team's applications — and nothing more. Manage them under **Settings → Service Keys**, gated by the new **Read / Write / Delete Service Account** permissions.
Added
#### FlightPath - Private Preview
FlightPath generates authenticated scan configurations automatically. Log in to your application through FlightPath's built-in browser, and StackHawk's AI agent captures your auth flow, maps your endpoints, and generates a complete scan configuration in minutes. No YAML required. Now available in private preview for Enterprise and Scale customers.
## April 17th, 2026
### HawkScan (5.5.0)
Improvement
#### Field-Level Config Validation Errors
`hawk validate config` now reports validation errors at the specific YAML field that caused the problem with clear, actionable messages — explaining *why* a path is invalid, what is wrong with a regex, or which authorization method to add. Empty `cookieAuthorization` and `tokenAuthorization` blocks, malformed logged-in and logged-out indicator regexes, and missing authentication fields now produce precise errors instead of generic failures.
Improvement
#### Offline Config Validation
`hawk validate config`, `hawk validate auth`, and `hawk validate api` now skip calls to the StackHawk platform when every environment variable in your config resolves locally (via `System.getenv`, the env file, or `${VAR:default}` syntax). You can validate configurations without an API key when they don't need platform-managed secrets. When variables remain unresolved, the platform is contacted as before.
Fixed
#### Authenticated MCP Server Scanning
Fixed authentication headers not being applied to MCP server handshake and scanner re-fetch requests. Because MCP's `text/event-stream` transport requires a bare HTTP client instead of ZAP's `HttpSender`, the session-management pipeline was bypassed and `Authorization` headers from `externalCommand` authentication were never stamped onto MCP traffic — causing 401 responses and a Gson parse crash. MCP servers requiring authentication now scan correctly.
## April 22nd, 2026
### StackHawk Platform
Added
#### Organization IP Allow List
Restrict **all** inbound traffic to your StackHawk organization to a set of approved IPv4 CIDR ranges. When configured, only connections originating from a listed range can reach the platform — including UI logins (including SSO), API key requests, and HawkScan scan uploads. Changes to the allow list are captured in the organization Audit Log. Available on request from StackHawk Support.
## April 17th, 2026
### StackHawk Platform
Added
#### Scan Config Validation
Test your scan configuration and authentication setup against StackHawk-hosted infrastructure in seconds — before running a full scan. The new Test Config button in the Scan Config Drawer validates your `stackhawk.yml` with field-level error feedback (including exact JSON paths) and, if authentication is configured, executes the login flow against your application to confirm that credentials, success indicators, and cookies all work. Config errors and auth errors are reported separately so you know exactly what kind of problem you're dealing with. No local HawkScan install required.
## April 6th, 2026
### HawkScan (5.4.0)
Added
#### Machine-Readable JSON Output
New `hawk scan --json-output` flag outputs scan results as structured JSON to stdout, with all console output suppressed. Ideal for AI agent workflows and tool integrations that need to parse findings, errors, warnings, and threshold results programmatically.
Added
#### YAML Config Output for App Creation
New `hawk create app --yaml` flag outputs a `stackhawk.yml` configuration stub to stdout after app creation, enabling scripted workflows that pipe directly into config files.
Added
#### MCP Server Scanning
HawkScan can now scan MCP (Model Context Protocol) servers for security vulnerabilities. Configure `app.jsonRpcConf.mcp` to discover and test MCP tools for injection, SSRF, path traversal, and other attack vectors through the standard MCP handshake lifecycle.
Added
#### Blind SQL Injection Detection
The blind SQL injection detection check has been broken out into a separate scan rule (400021) that runs after the boolean-based check (400030). This allows for more accurate detection of blind SQL injection vulnerabilities by using a different set of payloads and response analysis techniques that are better suited for blind testing.
Improvement
#### OpenRPC Spec Path Discovery
JSON-RPC scanning now supports automatic method discovery via a hosted OpenRPC spec. Configure `hawk.jsonRpc.path` to point to your OpenRPC spec endpoint and HawkScan will discover all available JSON-RPC methods automatically.
Improvement
#### Sensitive Data Detection Scan Rules
Plugins that do detection for Credit Card Numbers, Email Addresses, HTML Comments, and IBAN Numbers in responses and local storagehave been improved to reduce false positives and improve accuracy.
Improvement
#### PostgreSQL Injection Detection Timing Based Check (420022)
Improved the timing checks for PostgreSQL Injection detection to reduce false positives and increase accuracy. The scanner now uses a more robust method of measuring response times and comparing them to baseline measurements, resulting in more reliable detection of timing-based SQL injection vulnerabilities.
Improvement
#### Schema Validation
The stackhawk.yml schema validator is now strict about unknown properties. Unexpected properties in `stackhawk.yml` now produce warnings instead of being ignored. AI agents should now produce cleaner configurations that adhere to the schema, and users will get immediate feedback on typos or misconfigurations in their YAML files.
Fixed
#### Profile Selection Crash
Fixed an `UnsupportedOperationException` crash when using scan profiles.
Fixed
#### Target Reachability Check
Fixed the target reachability check to properly fail with a clear error when the target host is unreachable, instead of proceeding with an invalid configuration.
Fixed
#### SARIF URI Encoding
Fixed double percent-encoding in SARIF artifact URIs (e.g. `%253C` instead of `%3C`), switched to IRI-form Unicode output.
## April 2nd, 2026
### StackHawk Platform
Added
#### Team Admin Role
Enterprise and Scale customers can now assign Team Admins to manage users, applications, and scan policies within their teams — without provisioning full org-level access.
Added
#### View-Only Role
A new View-Only role gives auditors and stakeholders full read-only visibility across all teams and applications without the ability to modify anything.
## February 17th, 2026
### HawkScan (5.3.0)
Added
#### JSON-RPC Scanning
HawkScan now supports security testing of JSON-RPC 2.0 APIs. Configure the `app.jsonRpcConf` section to scan your JSON-RPC endpoints for vulnerabilities.
Added
#### Modern AJAX Spider
A completely rewritten AJAX Spider with multi-pass discovery and framework-aware crawling. Automatically detects Angular, React, Vue, and Next.js applications and extracts routes from framework routers and JavaScript bundles for more thorough coverage of single-page applications.
Added
#### DOM XSS Sink Detection
The AJAX Spider now instruments dangerous DOM APIs during crawling to detect potential DOM XSS sinks in real time. The DOM XSS scanner uses these findings to prioritize attack vectors for more accurate results.
Added
#### JSON-RPC and gRPC Authentication
New authentication types `JSON_RPC` and `GRPC` allow HawkScan to authenticate natively against JSON-RPC and gRPC APIs. Configure `app.authentication` with the new type and specify the method to call (e.g., `auth.login` for JSON-RPC or `/auth.AuthService/Login` for gRPC).
Improvement
#### Migrated to Chrome for Browser Automation
HawkScan now uses Chrome via Puppeteer for all browser-based scanning, replacing Firefox and Selenium. This improves reliability and performance for AJAX spidering and DOM XSS scanning.
Improvement
#### OpenAPI Server Variable Resolution
OpenAPI 3.0 server URLs with `{variable}` placeholders are now automatically resolved to their default values during spec parsing. This fixes an issue where server variables like `{basePath}` were not being substituted correctly.
Improvement
#### Faster Scan Initialization
Scan initialization is significantly faster thanks to parallelized analysis. Applications with many endpoints will see up to 4x faster startup times before active scanning begins.
Improvement
#### DOM XSS Scanning Reliability
DOM XSS scanning is now more reliable with configurable timeouts, automatic popup and download handling, and smarter element targeting. Scans no longer hang on pages with complex JavaScript interactions.
Improvement
#### ORG_ID Environment Variable for CLI
The `hawk create app` command now supports the `ORG_ID` environment variable, matching the existing behavior of `hawk list plugin`. Set `ORG_ID` once instead of passing `--org-id` on every command.
Removed
#### Firefox Browser Support Deprecated
The `FIREFOX_HEADLESS` and `FIREFOX` options for `hawk.spider.ajaxBrowser` are now deprecated. HawkScan defaults to `CHROME_HEADLESS` for all browser-based scanning. If your configuration specifies Firefox, update it to use `CHROME_HEADLESS` or `CHROME`.
## January 15th, 2026
### HawkScan (5.2.0)
Improvement
#### Parameterized URL Alert Triage
Alerts for parameterized endpoints now use consistent fingerprinting across scans. URLs like `/users/123` and `/users/456` are recognized as the same endpoint pattern (`/users/{id}`), enabling accurate alert triage and trend tracking even when path parameter values change between scans.
Improvement
#### Global Parameter Priority
User-provided global parameters now correctly override crawl plan default values. Previously, faker expressions or context templates in the crawl plan could take precedence over explicitly configured global parameters.
Fixed
#### SQL Injection False Positives
Reduced false positives in boolean-based blind SQL injection detection. The scanner now correctly identifies when both true and false condition payloads return identical error pages, skipping alerts in these cases. Alert details now include both request/response pairs for easier validation.
Fixed
#### Crawl Plan URL Handling
Fixed an issue where URLs could be lost from the scan when using crawl plans with Data Driven Nodes (DDNs). The scanner now safely handles DDN conversion failures and preserves all discovered endpoints.
## December 17th, 2025
### HawkScan (5.1.0)
Added
#### React2Shell Vulnerability Detection
New active scan rule (40058) detects React2Shell remote code execution vulnerabilities (CVE-2025-55182, CVE-2025-66478) in Next.js and React Server Components. This critical vulnerability allows unauthenticated attackers to execute arbitrary commands through unsafe deserialization in the React Flight protocol.
Improvement
#### Smart Crawl Plan Active Scanning
Endpoints discovered by smart crawl plan are now properly fuzzed by the active scanner.
Fixed
#### Include/Exclude Paths with Smart Crawl Plan
Fixed an issue where `includePaths` and `excludePaths` configurations were not being applied to smart crawl plan operations. Path filtering now correctly filters operations before crawl plan execution begins.
## December 13th, 2025
### HawkScan (5.0.0)
Added
#### Business Logic Testing with Multi-Profile Scanning
HawkScan now supports multi-profile scanning for comprehensive business logic testing. Configure multiple authentication profiles to automatically test for:
- BOLA (Broken Object Level Authorization) - cross-user resource access
- BFLA (Broken Function Level Authorization) - privilege escalation
[Read the docs](https://docs.stackhawk.com/hawkscan/business-logic-testing) to configure multi-profile testing.
Added
#### Smart Crawl Plan for OpenAPI
When an OpenAPI specification is configured, HawkScan automatically generates a smart crawl plan that understands your API's structure and data relationships, enabling more effective security testing.
Added
#### Evidence Chain for Authorization Alerts
BOLA and BFLA alerts now include evidence chains showing the cross-profile access attempts and responses.
Improvement
#### Pre-flight Authentication Check
Multi-profile scans now verify authentication for all profiles before starting the scan, failing fast if credentials are invalid.
Improvement
#### Multiple OpenAPI File Support
HawkScan can now merge multiple OpenAPI specification files into a unified API definition.
Improvement
#### gRPC Custom Variables
Added object notation and path filtering for custom variables in gRPC configurations.
Improvement
#### Native Trust Store
HawkScan can now uses the native system trust store for multiple operating systems.
Added
#### Sensitive Data Detection Plugins
New passive scan plugins detect sensitive data exposure in HTTP responses:
- Credit Card Numbers (100008)
- Email Addresses (100009)
- HTML Comments (100011)
- IBAN Numbers (100012)
Fixed
#### Authentication Redaction
External command authentication parameters are now properly redacted in logs and output.
Fixed
#### SQL Injection False Positives
Reduced false positives in the SQL Injection scan rule for applications with input validation:
- Improved response comparison by stripping all query/form parameter values (not just the tested parameter) to handle validation error messages with non-deterministic ordering
- Added 4xx status code detection to skip alerts when both original and attack responses return the same 4xx status, indicating input validation rejection rather than SQL injection behavior
## November 13th, 2025
### StackHawk Platform
Added
#### Test Coverage for OWASP LLM Top 10
StackHawk now tests for five critical LLM risks from the OWASP LLM Top 10:
- LLM01: Prompt Injection
- LLM02: Improper Output Handling
- LLM04: Unbound Consumption
- LLM06: Sensitive Data Disclosure
- LLM09: System Prompt Leakage
[Read the docs to enable test coverage](https://docs.stackhawk.com/hawkscan/llm-security-testing).
## October 23rd, 2025
### StackHawk Platform
Added
#### Semgrep Integration
The official Semgrep integration is live, allowing joint users to correlate StackHawk DAST findings with Semgrep SAST results. When both tools identify the same vulnerability, findings are automatically linked to eliminate duplicates and provide unified remediation context.
## September 29th, 2025
### HawkScan (4.8.0)
Fixed
#### Scan Token Timeout
Fixed an issue where final results were not being uploaded to the platform for long running scans.
On this page