Changelog

Enables manipulation of request headers to better support apps running behind a proxy

Support for tuning the GraphQL introspection process

Provides more control over the aggressiveness of the scanning capability

ZAP open source contribution for Kotlin support

Supports advanced ZAP configuration via StackHawk YAML

More support for enumeration types and improvements to the test query builder

Adds support for debug logging

Better support for scanning localhost networking scenarios and reverse proxies

Assess completeness of scans by reviewing all paths scanned by HawkScan

New links to Concourse CI and Github Actions HawkDocs

Bulk controls UI improvements, findings table UI improvements, and findings are sorted alphabetically

Alert rules are now specific to request method

Pagination controls are accessible at the top of the Scans table

See specific changes for HawkScan and StackHawk platform

See up to 100 applications on Applications page

URI truncation in many places throughout the application for readability

curl command generated with double quotes around request body

Scan progress is now printed to the terminal output

Log in using any email via StackHawk authentication, or OAuth via Google and Github

Take action from the Findings Management right panel for triaging your application’s security vulnerabilities

Add missing escape characters to downloaded StackHawk.yml from App Creation Wizard

Announcement panel is a source for release notes, social links, docs and submitting feedback

Users may now triage scan findings by marking them as Assigned, Risk Accepted or False Positive

As part of Findings Management, the scan list will now reflect new findings (not yet triaged) and a count of triaged findings

Users on unsupported browsers will see a new informational page, and users logged out due to inactivity will be notified via toast notification

HawkScan now supports configuration for customers that utilize both OpenAPI spec and GraphQL API scanning

Customers utilizing the StackHawk integration with Gitlab will now see findings updated in their report dashboard.

Users may quickly validate a finding by clicking the “Recreate” button. This generates a curl command that a user may paste into their terminal in debug mode and quickly recreate an attack

You may now configure updates from specific applications to be sent to specific channels in Slack, ensuring that your teams are only getting updates about the applications relevant to their workflow