--- title: "Changelog" description: "StackHawk platform and HawkScan updates - page 2 of 8." url: https://docs.stackhawk.com/changelog/page/2/ --- # Changelog Tracking updates to the StackHawk platform and HawkScan since 2019 ## September 19th, 2025 ### HawkScan (4.7.0) Improvement #### HSTE Update **Beta Scan Rules:** - Active: API Broken Authorization 40050 - Active: API Broken Function Level Authorization 40051 - Active: API Lack of Rate Limiting 40052 - Active: API Broken Authentication 40053 - Active: API Broken Object Property Level Authorization 40054 - Active: API Enhanced Broken Object Level Authorization 40055 - Active: API Active IDOR Validation 40056 - Active: API Unrestricted Resource Consumption 40057 - Active: API Server Side Request Forgery 40048 - Active: LLM Injection 40049 - Active: GraphQL Circular Reference 40099 - Active: GraphQL Deep Recursion Query Attack 40100 - Active: GraphQL Interface Exploit 40101 - Active: GraphQL Batch Query 90052 - Active: GraphQL Resource Intensive Query 90053 - Active: GraphQL Introspection Exploit 90054 - Active: GraphQL Field Suggestion Exploit 90055 - Active: GraphQL Interface Protection Bypass 90056 **Updated Rules:** - Update: MongoDB Injection Timing Rules (improved accuracy, better timing analysis) - Update: MongoDB Injection Regular Rules (improved accuracy, less false positives) Improvement #### Hosted OpenAPI Support added `openapi.usePlatform` for directly fetching and using generated OpenAPI specifications from code repositories mapped to the scanned application from the platform. Improvement #### Application Scanning The scanned application name is now included in the HawkScan terminal output banner. Fixed #### External Command Authentication Redaction configured app.redact now applies to external command authentication parameters. ## September 10, 2025 ### StackHawk Platform Added #### Hosted Scanner Hosted Scanning enables users to run scans directly from the StackHawk infrastructure. [More info on Hosted Scanning](https://docs.stackhawk.com/web-app/hosted-scanner.html) ## August 28, 2025 ### StackHawk Platform Added #### Model Context Protocol (MCP) Server Embed StackHawk's DAST & API security testing directly in your MCP-enabled AI code assistants like Cursor, Claude Code, and Windsurf. With our MCP server, developers get real-time vulnerability detection and remediation using intuitive, natural language commands. [Read the docs to learn more.](https://docs.stackhawk.com/model-context-protocol/) ## August 19, 2025 ### StackHawk Platform Added #### OpenAPI Spec Generation StackHawk now automatically and continuously generates OpenAPI sSpecifications from your source code using AI. Current support includes Java/Spring and JavaScript/Express.js applications. ## July 2nd, 2025 ### HawkScan (4.6.0) Improvement #### HSTE Update - Update Proxy Disclosure Rule (improved accuracy) - Update MongoDB Injection Rules, timing and Regular (improved accuracy, less false positives) - Additional GraphQL Tests in Beta: - Passive: Endpoint Detected 90051 - Active: Batch Query 90052 - Active: Resource Intensive Query 90053(series 1-4) - Active: Introspection Exploit 90054 - Active: Field Suggestion Exploit 90055 - Active: Interface Protection Bypass 90056 - Passive: Introspection Detected 90050 - Active: Circular Reference 40099 - Active: Deep Recursion Query Attack 40100 - Active: Interface Exploit 40101 Improvement #### waitForAppTarget Custom Header Added support for sending a custom header when using waitForAppTarget. Improvement #### API Paths Sorting Added deterministic sorting to API-path output for cleaner, predictable diffs. Improvement #### gRPC Reflection Support Added gRPC v1 and v1alpha reflection handling to service handlers. Improvement #### Authentication Validation Fixed authentication validation to not depend on starting perch daemon. Fixed #### Rolling-Appender Log Order Corrected rolling-appender logic so hawkscan.log entries stay in chronological order. Improvement #### Hosted OpenAPI Support Support for fetching AI generated OpenAPI specs. Improvement #### Base-Image Upgrade to Ubuntu 22.04 Migrated build base image to Ubuntu 22.04. ## June 9th, 2025 ### StackHawk Platform Added #### Sensitive Data Connected repositories can now be scanned for Sensitive Data terms, like PII, PCI and PHI word patterns, that can be detected within repositories and reviewed in the API Discovery view. ## April 28th, 2025 ### HawkScan (4.5.0) Improvement #### OSX signing and notarization Hawkscan pkg install is now fully signed and notarized by Apple to avoid any security warnings when installing Fixed #### Large log files are fully sent to StackHawk platform When Hawkscan generated multiple large log files not all files were being uploaded to the platform. This has been fixed and max log file control is now configurable. Added #### Openapi helper tool merge command The openapi-helper cli tool now has a merge command to facilitate merging OAS files. ## February 4th, 2024 ### StackHawk Platform Improvement #### Multiple Project Management tool support Improvements to our Jira Cloud and Azure Devops Integrations now allow administrators to connect multiple workspaces to a single StackHawk organization. Improvement #### Project Management tool selection Triaging findings with multiple workspace ticketing integrations connected will give the option to select the preferred ticketing tool. ## January 29th, 2025 ### HawkScan (4.4.0) Fixed #### Failed Authentication Request/Response Fixed an issue where HawkScan was not showing requests and responses for failed authentication. Fixed #### Passive Scan Stats Fixed issue where scan stats were not showing up for all scans. Improvement #### Java Opts Command Line Options Allow user to add jvm args/opts to HawkScan via command line `--hawk-jvm-opts`. Improvement #### Automatically Enable Scripts in Scan Automatically enable passive/active script scanning without it being expressly set in scan policy. Improvement #### Brew Installer Install correct version of Java when installing from Homebrew. Fixed #### Java Version Throw exception and stop the scan if no compatible version of Java is found. Improvement #### Dependency Updates Updated outdated dependencies. Improvement #### Remote OS Command Injection Introduced a separate timing based attack used for unauthorized execution of operating system commands. ## December 11th, 2024 ### StackHawk Platform Added #### Product Update 🎄🎁 Explore all the features we've recently released in our new product update. [December Product Update](https://www.stackhawk.com/blog/december-product-update) ## October 30th, 2024 ### HawkScan (4.3.0) Improvement #### WSDL File Base Path When using a wsdl `filePath`, the SOAP parser will use the directory of the specified file as the base directory for resolving linked files. Improvement #### HTTP Request display Updated display of HTTP Request to display accurately what was sent over the network. Fixed #### Specifying Outbound Proxy in stackhawk.yml Fixed issue where HawkScan was not resolving the `hawk.outboundProxy` configuration before trying to authenticate to the platform. Fixed #### Hawk Plugin Commands Fixed null pointer exceptions when running `hawk register plugin` and `hawk list plugin`. ## October 14th, 2024 ### HawkScan (4.2.0) Improvement #### Log Cleanup Reduced noisy debug logs by moving them to the trace level. Fixed #### Http Log Redaction Enhanced sensitive data protection by redacting specified headers from logs when using `--log-http` Added #### External Command Timeout Added a timeout for `externalCommand` authentication to exit problematic scripts sooner. Fixed #### Intermittent Hanging on Scans Fixed an issue where HawkScan would sometimes hang while scanning. Improvement #### gRPC Auto Input Vectors Added gRPC auto input vectors to speed up scanning. Improvement #### Ignore Unimplemented gRPC Methods The scanner will now skip paths that are not implemented on the gRPC server. Improvement #### Allow small OpenAPI spec Allow for OpenAPI specs where the only route is the `testPath`. Added #### Hosted Scan Configuration HawkScan can now run with a configuration hosted on by running `hawk scan hawk://policy-name` ## August 7th, 2024 ### StackHawk Platform Added #### Organization Scan Policy Management Added a page in the organization settings for management of Organization Scan Policies and to review readonly StackHawk Scan Policies. Organization Scan Policies allow teams to choose which vulnerability checks are applicable to their StackHawk scans, improving scan performance and accuracy. [Scan Policy Management ](https://app.stackhawk.com/settings/policy-management)[Using Scan Policies](https://docs.stackhawk.com/web-app/policy-management) ## July 26th, 2024 ### HawkScan (4.1.0) Added #### Organization Level Scan Policy Added support for scan policies defined at the organization level. [scanPolicy configuration reference](https://docs.stackhawk.com/hawkscan/configuration/#appscanpolicy) Added #### Check for polyfill.io Vulnerability Added check to test for polyfill.io cdn vulnerability. Fixed #### Progress Bar Display Fixed an issue where the progress bar was displayed multiple times in the terminal output. Fixed #### Updating HawkScan from .pkg Installer Fixed an issue where HawkScan was not available on the command line after upgrading. Fixed #### OpenAPI Parsing Fixed issues where HawkScan could not parse some OpenAPI 3.1 specs. Fixed #### GraphQL Configuration Banner Display Fixed an issue where the GraphQL configuration file was not shown in the console output. Improvement #### Scan Policy Display in Banner Added scan policy for HawkScan run in the console output. Improvement #### Updated Details in SARIF Output Updated details with more information in the SARIF output. Improvement #### Updated OpenAPI Helper Improved OpenAPI parsing for the HawkScan OpenAPI helper tool. ## June 27th, 2024 ### HawkScan (4.0.0) Added #### Use HSTE (HawkScan Testing Engine) instead of ZAP Switched the scanner to HSTE which is a renamed fork of ZAP the StackHawk team has been maintaining. To learn more about this change see the link to the blog post below. Please note if you are using custom scripts all references to `org.zaproxy.zap` should be renamed to `com.stackhawk.hste`. [HawkScan Testing Engine (HSTE)](https://www.stackhawk.com/blog/stackhawk-announces-hawkscan-test-engine/) Added #### Multiple API spec support for OpenAPI and gRPC The `app.openApiConf` and `app.grpcConf` now support `.filePaths` allowing for multiple specification files to be used in a single scan configuration. This is especially useful when an API is comprised of multiple lambdas. [openApiConf configuration reference ](https://docs.stackhawk.com/hawkscan/configuration/#appopenapiconf)[grpcConf configuration reference](https://docs.stackhawk.com/hawkscan/configuration/#appgrpcconf) Added #### PassiveScan script support Passive scripts can now raise alerts in StackHawk by registering a custom plugin id, like active scripts. This is useful to create alerts for PII data, missing HTTP headers, and more. Added #### New details to SARIF output Added links and more details about the alert to the SARIF output format's new markdown fields. Improvement #### Updated the scan throttle settings to increase scan speed The default throttle settings have been tuned to facilitate faster scanning. Users with scanner resource constraints may need to adjust these settings back to their lower values to avoid crashes due to resource consumption. Fixed #### Custom data variables override example data in OpenApi spec Custom data variables in the StackHawk configuration will override example variables that are in the Openapi spec at runtime. Improvement #### Docker user changed from zap to steve The `stackhawk/hawkscan` docker image default non-privileged user is now named `steve` instead of `zap`. The home and default working directory have also been updated to reflect this change and are `/home/steve` and `/steve` respectively. For reference the StackHawk mascots name is Steven S. Hawk ;). ## June 27th, 2024 ### StackHawk Platform Added #### Scan policy name in the scan details pane The scan policy name is displayed in the scan details pane indicating which policy was chosen for the scan run. ## May 30th, 2024 ### StackHawk Platform Improvement #### Official Support for Multiple GitHub Integrations Connect multiple GitHub Accounts or Organizations to a single StackHawk Organization. ## May 10th, 2024 ### HawkScan (3.9.0) Fixed #### GraphQL Misconfiguration Error Fixed an issue where a validation error was thrown when the GraphQL configuration specified both file and filePath. Improvement #### StackHawk Config JSON Schema Updated StackHawk JSON schema to the latest version. Improvement #### HawkScan Launcher Icons Updated the HawkScan Launcher items for .msi and .pkg installs. Fixed #### Wait For App Target Fixed a bug where the `waitForAppTarget` feature would exit after 64 attempts. Improvement #### HTTP Request/Response Logging Capture more http logs from earlier in the scan. Improvement #### gRPC Data Generation Allow configuration of the recursion depth of gRPC data generation in the StackHawk.yml. Added #### Prompt For API Key Added a feature that will prompt and create an API key when HawkScan detects no API key is installed. ## May 7, 2024 ### StackHawk Platform Improvement #### Account Set Up Simplified sign up form for new users. Improvement #### Getting Started Page This update introduces new video resources to help new users run their first scan successfully and get started with StackHawk quickly. ## April 16th, 2024 ### HawkScan (3.8.0) Added #### 3rd party/OAuth stackhawk.yml configuration Most 3rd party/OAuth providers can now be directly configured in the stackhawk.yml without addditional authentication scripts. Added #### PKG installer HawkScan can now be installed via a pkg file for Mac OS. Fixed #### Hawk Perch Fixed a bug where HawkScan perch would not run from the Windows Executable version. To run `hawk perch browser` or `hawk perch start --with-chrome` on Windows arm 64 versions, Visual C++ Redistributable needs to be installed. Follow the link below and select the link for the x86 architecture to download the vc_redist.x86.exe installer. [Visual C++ Redistributable Downloads](https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170#latest-microsoft-visual-c-redistributable-version) Added #### Weak Cipher Detection Added custom test to check if weak ciphers are enabled on the host during `hawk scan`. Added #### Preflight CDN Header Check When HawkScan is run with the `--enable-preflight` flag, it will detect if the application is possibly running in a CDN. Fixed #### gRPC Data Generation Limited the recurssion depth of gRPC data generation and added in more data types. Added #### HawkScan HTTP Request/Response logging When HawkScan is run with the `--log-http` flag, it will log all http requests and responses. ## April 15, 2024 ### StackHawk Platform Improvement #### Create New Application This update enhances the clarity of the host URL information and adds a dropdown to specify the required URL format. Added #### Getting Started Page This newly added page provides key context to help new users get started with StackHawk successfully. ## February 29, 2024 ### StackHawk Platform Improvement #### Repositories Page Users can create multiple applications per repository. Improvement #### Repositories Page Improvements to the repositories table data display. Improvement #### Repositories Page Clicking on the repository table row will navigate users to the repository details page. Added #### Repository Details Page Dedicated repository details page where users can manage it and its application mappings easily. ## February 22nd, 2024 ### HawkScan (3.7.0) Added #### OpenApi Splitter Max Parameters Added a flag to the open-api splitter to allow for max parameters in a single file or endpoint. Improvement #### Browser Detection For Ajax Spider HawkScan will now check to see if the browser is installed on the OS before running the ajax spider. Fixed #### Git Checkout Revision Fixed a bug where HawkScan would error if a branch was specified in the HAWK_GIT_REV environment variable Added #### Preflight Check (Alpha) Introduced the `--enable-preflight` flag, allowing users to run a preflight check during scans. This feature is designed to provide warnings for potential issues in application configurations. Please note that this feature is currently in its alpha stage, and we welcome your valuable feedback to enhance its effectiveness. Added #### New perch start command flags Added `hawk perch start --with-chrome` and `--with-proxy-info` to enable using hawk perch as a recording proxy. Run `hawk perch start --help` for details. Added #### New perch stop command flag Added `hawk perch stop --har-file=` to save the perch recorded session as a har file. Run `hawk perch stop --help` for details. ## February 6th, 2024 ### HawkScan (3.6.0) Added #### HAR file support Support for using a HAR file or directory of HAR files as the spider for the scan process. Added #### External Command Authentication Allows for supplying a command to authenticate to the scanned application. [Learn more](https://docs.stackhawk.com/hawkscan/authenticated-scanning/external-command-authentication.html) Added #### JWT support Automatically renews JWTs before token expiration. Added #### Additional OWASP API Top 10 Rules Added checks for Broken Object Property Level Authorization and Broken Function Level Authorization for OpenAPI specifications. ## January 29, 2024 ### StackHawk Platform Added #### Github Integration Page Added a link to repositories page. Improvement #### Bug fixes Various bugfixes and improvements. On this page