THE CYBER TOOLCHAIN
StackHawk is an application security testing platform that performs dynamic security scanning to find vulnerabilities in web applications during development and CI/CD pipelines.
StackHawk's HawkScan 6.4.0 gives explicit control over scan depth across multiple authentication profiles, adds a new HTTP header authentication-bypass scan rule, and fixes hawk validate so it actually fails CI on a broken configuration.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds --profile-scan-mode flag (env: PROFILE_SCAN_MODE) to control plugin coverage across authentication profiles: business-logic (default, BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data./BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions. only), primary-full (full policy on one profile, BOLA/BFLA on the rest), or all-full (full policy on every profile). Adds --full-scan-profile flag (env: FULL_SCAN_PROFILE) to designate which profile receives the full scan policy under primary-full mode, defaulting to the first profile declared in configuration. Findings from multi-profile scans now carry a [profile=<name>] prefix on their evidence identifying which identity a vulnerability was discovered under.
$ hawk scan --profile-scan-mode primary-full --full-scan-profile admin-user stackhawk.yml
$ hawk scan --profile-scan-mode primary-full --full-scan-profile admin stackhawk.yml
hawk validate / hawk validate config previously exited 0 even on hard validation errors and missing configuration files. It now exits non-zero in those cases, making it usable as a real CI gate; warnings (unknown-property, lint) continue to exit 0. Pipelines relying on the old always-zero behavior will now correctly fail on a broken configuration.
$ hawk validate config stackhawk.yml && ./deploy.sh
Adds active scan rule plugin 40059 (HTTP Header Authentication Bypass) that tests whether authentication can be bypassed via injected headers such as X-Forwarded-For, X-Original-URL, and X-Rewrite-URL. Disabled by default; enabled through policy management.
Adds hawk config show app.authentication.external guidance recommending loggedInIndicator: '.*' and loggedOutIndicator: '$^' to prevent spurious re-authentication attempts when using external credentials.
app:
authentication:
external:
loggedInIndicator: ".*"
loggedOutIndicator: "$^"
testPath: /api/v1/me
Oracle time-based SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection (plugin 40021) now uses dose-response confirmation rather than a single delayed response, improving accuracy.
- !
hawk validatepreviously exited0even on hard validation errors and missing configuration files; it now exits non-zero in those cases, which will cause pipelines relying on the old always-zero behavior to correctly fail on a broken configuration. - !
hawk validate configpreviously exited 0 even on hard validation errors; it now exits non-zero for hard errors and missing configuration files. Pipelines relying on the always-zero exit code will now correctly fail on a broken configuration.