Changelog

HawkScan was released with a fix to support scanning endpoints that don't specify a port.

Hawkscan will now accept the app.includePaths configuration, specifying any routes the scanner should visit.

Hawkscan will now send additional telemetry and improved exception introspection.

Organization owners will now see a weekly email containing summaries of your weekly activity using StackHawk

Send your StackHawk scan notifications to Datadog.

Accessibility improvements around navigating the StackHawk platform via keyboard

View your applications and environments in a compact view from the Applications page

Added clarity around the steps of the Getting Started flow, as well as the ability to skip the Getting Started flow

The StackHawk application will detect your operating system and display the proper set of command-line shell commands

Applications page display on mobile and tablet size screens has been updated to improve usability

Panel will now persist user’s choice of viewing request or response metadata for a specific finding

Placeholder UI implemented for API key table, members table and account info pages

Application filter shows application name instead of ID when navigating to the Applications page with query strings in the URL

Support using GraphQL schema from file

Toast notifications now display error messages, in addition to success confirmations when taking action on scan findings

Use python print() in most places - errors still use the logging mechanism

term_color flag is checked in the Logger module to respect colored output in the terminal

Improved access to the billing page from the account settings view

Connect StackHawk with Slack and receive notifications on HawkScan events

Adds colors and logging for YAML exceptions and clear color delineation for problem items in the YAML config

Update the config loader to include the filename with the stream

Add new exception type for YAML exceptions, granulate the exception handler on the top level and add generic log output controls for info and error

Disables certain zap plugins causing false positive reports in scanned applications

Choose between the Startup, KaaKaww, or Enterprise Plans on the StackHawk settings page

Find documentation on the StackHawk Bamboo Integration from the Integrations tab

Improved display of findings status in the right panel, linking to Jira from the right panel and updating status experience

Each page of the settings menu has a dedicated URL

Increased size of the kebab button on the cards of the Applications page

Refreshing the page during the Getting Started flow will preserve your progress in the flow

Data returned for Findings and Scans tables is paginated to improve performance of unbounded data lists

Reset your password for accessing the StackHawk platform from the profile page

Settings navigation is optimized for mobile and small screen sizes

Hovering over the graphs on the Applications page will display details of a specific scan

From the Applications page view your latest scan results for a specific application by choosing one of the options in the kebab menu

See current status, history of past scans, and manage your applications and environments via the Applications tab in the sidebar

Findings Details page contains pagination controls

Modals display has been improved for usability on smaller screen sizes

Integrate with your Jira Software instance to manage your appsec bugs by assigning and linking to Jira tickets

Filter scans in the Scans List by Application and Environment

New link to Azure Pipelines HawkDocs

Scan findings URLs are now sorted alphabetically as well as by status

Enables manipulation of request headers to better support apps running behind a proxy

Support for tuning the GraphQL introspection process

Provides more control over the aggressiveness of the scanning capability

ZAP open source contribution for Kotlin support

Supports advanced ZAP configuration via StackHawk YAML

More support for enumeration types and improvements to the test query builder

Adds support for debug logging

Better support for scanning localhost networking scenarios and reverse proxies

Assess completeness of scans by reviewing all paths scanned by HawkScan

New links to Concourse CI and Github Actions HawkDocs

Bulk controls UI improvements, findings table UI improvements, and findings are sorted alphabetically

Alert rules are now specific to request method

Pagination controls are accessible at the top of the Scans table

See specific changes for HawkScan and StackHawk platform

See up to 100 applications on Applications page

URI truncation in many places throughout the application for readability

curl command generated with double quotes around request body

Scan progress is now printed to the terminal output

Log in using any email via StackHawk authentication, or OAuth via Google and Github

Take action from the Findings Management right panel for triaging your application’s security vulnerabilities

Add missing escape characters to downloaded StackHawk.yml from App Creation Wizard

Announcement panel is a source for release notes, social links, docs and submitting feedback

Users may now triage scan findings by marking them as Assigned, Risk Accepted or False Positive

As part of Findings Management, the scan list will now reflect new findings (not yet triaged) and a count of triaged findings

Users on unsupported browsers will see a new informational page, and users logged out due to inactivity will be notified via toast notification

HawkScan now supports configuration for customers that utilize both OpenAPI spec and GraphQL API scanning

Customers utilizing the StackHawk integration with Gitlab will now see findings updated in their report dashboard.

Users may quickly validate a finding by clicking the “Recreate” button. This generates a curl command that a user may paste into their terminal in debug mode and quickly recreate an attack

You may now configure updates from specific applications to be sent to specific channels in Slack, ensuring that your teams are only getting updates about the applications relevant to their workflow