The Cyber Toolchain — issue 056, August 25, 2026

Removed the unconditional post-run write of the sites database to the package directory, so Maigret no longer exits with PermissionError on read-only installations such as distro packages, snaps, the Nix store, or containers; the only remaining write now goes to ~/.maigret.

Runtime data, including the SQLite database and scan results, has moved from .data to .nettacker/data, with automatic database migration on upgrade. Any scripts or tooling referencing the old .data path must be updated.

A new js-audit preset (shipped at bbot/presets/web/js-audit.yml, and documented as living at ~/.bbot/presets/web/js-audit.yml) chains the trufflehog, retirejs, badsecrets, http, robots, and wayback modules to detect leaked credentials and vulnerable JavaScript libraries in client-side code. It enables the only_verified and include_sitemap options, runs trufflehog against HTTP bodies streamed via stdin while including the source URL on findings, and sets _module_threads to 2.

$ bbot -t example.com -p js-audit

$ bbot -t www.evilcorp.com -p js-audit

Researchers can now use Request a Response Expiration Removal to ask that a response expiration be removed from a submission, and RaRs no longer auto-expire. Each RaR now displays the date it was raised so teams can track how long it has been open, and the inbox adds filters for Active requests to Customers (outstanding requests) and Resolved requests to Customers (handled ones).

A new caido-mode skill in the web-security capability exposes the full Caido TypeScript SDK from within an agent, including Match & Replace rules, replay sessions, HTTPQL history search, findings management, and curl-through-Caido testing.

The web-security callback tool now supports a WEBHOOK_SITE_API_KEY environment variable, letting a paid webhook.site account bypass rate limits while preserving anonymous and interactsh fallback.

$ export WEBHOOK_SITE_API_KEY=your-api-key-here

On-prem deployments can now use Kubernetes Gateway API (HTTPRoute) routing instead of relying on Ingress, enabling installation on Istio, Envoy Gateway, and Cilium stacks.

The Worlds UI now supports downloading the full ATIF dataset from Worlds → Jobs, and exporting the normalized replay payload as JSON from the Trajectories page.

A new Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package managers (powered by Aikido Intel), extension governance covering VS Code, OpenVSX, Chrome, and skills.sh, a request-and-approval workflow where blocked installs trigger a one-click exception request reviewable in the Aikido admin Inbox, group-based policies for per-team rules, and continuous device inventory. The agent runs silently and only surfaces desktop notifications when a package is blocked or held for approval. Device Protection for Linux (beta) extends this to Linux desktops and servers, distributed as .deb and .rpm packages.

⤢ ⤢ ⤢ ⤢

A new Data Exposure Audit feature performs code-based DSPM using LLM agents to trace sensitive fields from sources (request bodies, DB reads, config) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) without connecting to production data stores. It detects credentials in URLs, API over-exposure (endpoints returning more fields than the caller is entitled to, missing tenant ownership checks), unsafe logging/exports of unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets, over-broad third-party and AI sharing of customer data, weak storage (unencrypted or only base64/MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. protected), incomplete deletion flows, and over-permissioned IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles/OAuth scopes and unauthenticated data stores. It runs against already-connected repositories with no new data source to onboard, and each audit consumes credits from the Aikido Wallet.

⤢

Code Audit runs agentic, pentest-grade security reasoning directly on source code to find logic flaws (e.g. cross-tenant data leakage) that pattern-based scanners miss, requiring no staging URL, traffic replay, or agent deployment. AutoFix generates remediation PRs from Code Audit findings with a few clicks alongside root cause analysis and remediation guidance, and it supports hard-to-test-by-URL codebases including mobile apps, smart contracts, desktop apps, embedded software, and libraries. It is priced in credits shown upfront before the audit starts, based on codebase size and complexity.

⤢

A new CVE Exploitability Analysis agent uses LLM reasoning over how code uses an affected package to evaluate whether a CVE is actually reachable and exploitable, and can act autonomously — upgrading, downgrading, snoozing, or ignoring findings — based on rules teams control, with each run logged with a short rationale for review or override. CVE Exploitability assessment now also supports containers.

⤢ ⤢

A new Secrets AutoTriage agent runs after entropy detection to assess whether a discovered secret is a real, exposed credential — evaluating liveness, scope, and surrounding code context — then applies defined rules or LLM reasoning for ambiguous cases. It can act autonomously (upgrading, downgrading, snoozing, or ignoring findings) based on rules teams control, and each run is logged with a short rationale for review or override.

⤢ ⤢

A preview feature of the JFrog Agent Plugin routes AI coding agent dependency downloads (Claude Code, Cursor) through JFrog Artifactory instead of public registries, covering npm, PyPI, Maven, Go, Docker Hub, Helm, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code.. Session steering automatically supplies the Artifactory URL for each governed package type at the start of an agent session with no per-project configuration, while the new jf setup command persistently binds a local package manager to an Artifactory repository across sessions and tools. JFrog Curation policy enforcement is extended server-side to all agent-driven downloads — blocking malicious packages, unapproved licenses, and policy-violating packages regardless of whether session steering or jf setup is active — and covers indirect/transitive installs such as postinstall scripts, pip install -r requirements.txt, and npm ci, producing complete audit trails for every agent-driven download, block, and policy decision alongside existing human-driven build logs.

$ jf setup

GitLab Dedicated gains a fully managed, single-tenant CI runner fleet isolated per customer, eliminating the need to provision or maintain your own runners. It supports machine sizes linux-small-amd64 (default, 2 vCPU / 8 GB), linux-medium-amd64 (4 vCPU / 16 GB), linux-large-amd64 (8 vCPU / 32 GB), linux-xlarge-amd64 (16 vCPU / 64 GB), and linux-2xlarge-amd64 (32 vCPU / 128 GB) on Linux x86-64 and Linux Arm64. Each CI job runs in a newly provisioned, short-lived VM deleted after completion for job-level process isolation; secure connectivity to internal artifact registries, secret managers, and deploy targets is available via AWS PrivateLinkAWS PrivateLinkAn AWS networking feature that exposes a service over a private VPC endpoint rather than the public internet, letting tools move data between accounts or to AWS services without traffic ever leaving Amazon's backbone.. Pricing is consumption-based via GitLab Credits with usage visible in the GitLab Credits Dashboard, the fleet is self-serviceable through Switchboard (the GitLab Dedicated management console), and the offering carries a 99.9% uptime SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. with autoscaling to handle bursty CI workloads.

build:
  tags:
    - linux-large-amd64
  script:
    - make build

test:
  tags:
    - linux-small-amd64
  script:
    - make test

Cloudsmith now hosts NAR and narinfo files over the standard Nix HTTP binary cache protocol at https://nix.cloudsmith.io/OWNER/REPOSITORY. Packages can be published with nix copy --to 'https://nix.cloudsmith.io/OWNER/REPOSITORY' --no-check-sigs and fetched with nix copy --from 'https://nix.cloudsmith.io/OWNER/REPOSITORY' STORE_PATH once the repository is added as a substituter via extra-substituters and extra-trusted-public-keys in nix.conf (e.g. /etc/nix/nix.conf or ~/.config/nix/nix.conf). Private repositories support entitlement tokens embedded directly in the substituter URL (https://token:TOKEN@nix.cloudsmith.io/OWNER/REPOSITORY) or via a netrc file referenced with netrc-file. Each repository gets a per-repository ED25519 signing key, with Cloudsmith re-signing every narinfo on every read to allow immediate key rotation and multiple simultaneously active keys. Upstream proxying and caching against NixOS release channels (e.g. https://channels.nixos.org/nixos-26.05) is also supported, with each upstream mapped to exactly one channel via the Proxy URL field; this is currently web-app only, with API-based upstream management not yet available.

⤢ ⤢

$ STORE_PATH="$(readlink -f result)"
nix copy --to 'https://nix.cloudsmith.io/OWNER/REPOSITORY' --no-check-sigs "$STORE_PATH"

extra-substituters = https://nix.cloudsmith.io/OWNER/REPOSITORY
extra-trusted-public-keys = KEY_NAME:PUBLIC_KEY

extra-substituters = https://nix.cloudsmith.io/OWNER/REPOSITORY https://cache.nixos.org
extra-trusted-public-keys = KEY_NAME:PUBLIC_KEY cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=

Broadcasts exposes a standard Cloudsmith repository to the public through a customizable, branded URL instead of a separate public repository, supporting both a default broadcast URL and workspace custom domains for browser browsing and native tooling pulls (Docker, npm, Maven, IDE, CI/CD). A dashboard Overview section shows aggregated analytics across broadcasting repositories — total requests per billing cycle, usage per package, recently downloaded packages, recently created broadcasts, a breakdown of requests by public/private/open source packages, and entitlement tokens consumed in the current billing cycle — plus a per-package toggle between storage Usage and Requests views. Broadcasting can be enabled at repository creation via a toggle, or toggled on existing repositories via Start broadcasting / Stop broadcasting in the repository page dropdown.

⤢ ⤢ ⤢ ⤢

Adds detection for CWE-99 (Improper Control of Resource Identifiers / Client Resource Injection) in JavaScript and TypeScript, plus detection for CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-321 (Use of Hard-coded Cryptographic Key) in Rust.

Java API Wrapper v26.3.19.0 adds page size support to the Platform Applications API (/appsec/v1/applications) and introduces support for the paginated Sandbox REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.. Java API Wrapper v26.2.18.0 adds support for the Veracode Platform Findings REST API to access open and mitigated application findings, and implements a configurable retry mechanism for the Platform Applications API (appsec/v1/applications) to handle transient failures and timeouts.

GitHub Workflow Integration v2.0.0 enables installing, configuring, and updating credentials for the Veracode GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps, and adds the ability to schedule Static Analysis, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and Infrastructure as Code (IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.) scans for GitHub organizations from the Platform. GitHub Workflow Integration v2.1.1 adds a new uninstallation workflow on the Veracode Platform to remove the Veracode app from GitHub organizations.

Azure DevOps Workflow Integration v2.4.3 adds a custom agent pool name parameter in veracode.yml to specify the agent pool used for pipeline execution; v2.3.10 adds analysis_branch support so scheduled scans run against a specified branch instead of the default; and v2.3.9 adds the ability to schedule scans for every organization where the integration is installed, based on veracode.yml configurations.

analysis_branch: main-security-review

Veracode Azure DevOps extension v3.35.0 replaces the deprecated Veracode Flaw Importer task (with spaces) with the new VeracodeFlawImporter task for compatibility with a future Microsoft TFX packaging library upgrade; the old task name is scheduled for removal in a future release.

Adds the debug configuration option in veracode.yml for the Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 to enable debugging and troubleshooting.

debug: true

Support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x ends November 30, 2026; upgrade to Jira 10 or later to continue using a supported version.

The Scan Configuration API gains entryPointFilter, supporting filtering by both securityStatus and connectivityStatus (values include 'ok', 'unauthorized', 'problem', 'unreachable') for precise scan scoping. The older entrypointsStatuses property is scheduled for deprecation on 22 September 2026, so integrations must migrate to entryPointFilter before that date.

Bright Workflows is a new visual orchestration layer that chains a trigger, Discovery, and Scan into a reusable, schedulable pipeline. It automatically identifies new and changed entry points since the last baseline and passes only those to the Scan.

GitGuardian can now scan AWS S3 buckets using the same detection engine and incident workflow as repositories, surfacing secrets in objects like CI logs, Terraform state, database dumps, .env files, and support exports. It connects via OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. role assumption — GitGuardian assumes a read-only IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role you create and scope in your own AWS account, with no long-lived AWS keys required — and opens and scans inside archives (e.g. tar.gz) nested in S3 objects. You select individual buckets to monitor and assign them to teams like any other source, starting with high-risk buckets such as backup and log archives; scans are scoped to the integration's configured region and S3 Standard storage class by default, with cross-region scanning and other storage classes opt-in to control retrieval and transfer costs. Incidents found in S3 carry the same severity ratings, validity status, playbooks, and notifications as code-repository incidents. Historical (on-demand) scans are available now, with recurrent scanning of new and modified objects coming soon.

Adds support for configuring RADIUS servers in Sophos Central for AP6 SSIDs with enterprise authentication, including Microsoft Entra ID as a cloud-based identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., and adds per-SSID RADIUS server assignment configuration in the local UI.

Adds traffic shaping configuration for AP6 SSIDs under Advanced settings > Quality of service in Sophos Central, letting administrators configure bandwidth policies for individual SSIDs.

Tracing policies gain a matchCEL selector for filtering kernel events using CEL (Common Expression Language) expressions, for example arg1 == int32(-1) && data0 == arg0 + int32(42), with syscall arguments exposed as zero-based indexed variables (arg0, arg1, …) and data: list items exposed as data0, data1, …. The older MatchArgs operator is deprecated in favor of MatchCEL.

matchCEL:
  expr: "arg1 == int32(-1) && data0 == arg0 + int32(42)"

returnArgAction no longer accepts Post as a value in TracingPolicy. Use returnArg to include return values in events and omit returnArgAction for default behavior; only TrackSock and UntrackSock remain supported values. Existing policies with returnArgAction: "Post" must remove that field.

hostSelector can now be used in TracingPolicy without requiring the daemon's enable-policy-filter flag, reducing configuration overhead for host-scoped policies. Uprobe and USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. events are now scoped through policy filters as well, bringing them in line with existing kprobe/tracepoint filtering.

TracingPolicy now supports btfType and btfTypeModule for more precise BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime.-based type resolution of kernel arguments, and adds int argument type support for tracepoints, expanding the set of kernel tracepoint arguments that can be traced and filtered.

Enables OpenTelemetry tracing for pool warmup phases via ConnectionConfig.enableTracing(true), covering queue wait and every warmup stage using the application's global SDK, exporter, sampler, and propagators.

Stages pool refill into a separate async pipeline covering create, readiness, prepare, post-prepare health checking, renewal, and commit, with per-pool rate-limited create admission via warmupCreateQps.

SandboxPool.Builder.reconcileInterval(...) and the corresponding PoolConfig setting have been removed; pool reconciliation now runs on a fixed one-second cadence. Callers must delete all uses of reconcileInterval with no replacement.

Adds shared OkHttp connection pool ownership in SandboxPool, sized from warmupConcurrency, reused across warmup, acquire, and direct-create paths, and evicted on shutdown.

Supports detached background runs inside persistent isolated sessions for Kotlin consumers, with incremental log polling bounded by session lifetime.

Catalog Starter can now be managed entirely from the CLI: chainctl starter init signs up for a new Catalog Starter account interactively, chainctl starter request-access requests access to an existing organization's Catalog Starter plan, chainctl starter add-images adds up to four images by name to a subscription, and chainctl starter status displays registry path, account provisioning status, image quota usage, and per-image readiness.

$ chainctl starter init

$ chainctl starter add-images python nginx

$ chainctl starter status

Promotes Chainguard API v2 to general availability at /v2/, with a stable contract covering organization and access management, registry metadata, vulnerability and security advisories, event subscriptions, and library artifacts; existing v2beta1 integrations only need to update the path prefix. The stable API adds cursor-based pagination, server-side ordering, resource naming, dedicated resource lookups, partial updates, and typed error details, plus an OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specification and v2 Go SDK clients.

Adds SCIM user provisioning (Early Access) for Okta and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. via the /Users SCIM resource, creating or updating provisioning records on assignment and blocking login within roughly one hour of deactivation or token expiry.

Enables self-serve Helm chart provisioning from the Chainguard Console for Catalog customers, resolving required images and adding them in a single request, then provisioning asynchronously without EOL tags.

Adds the anchorectl app version asset add filesystem subcommand with a --type virtual_machine_disk flag to generate SBOMs from live VM filesystems or mounted disk images and attach them to an application version. Supports offline scanning of VM disk images (read-only, no agent) via QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. NBD mount, e.g. sudo qemu-nbd --read-only --connect=/dev/nbd0 disk.qcow2, enabling forensic and golden-image workflows. Skips pseudo-filesystems (/proc, /sys) by default when scanning /; narrower paths such as /usr, /opt, and /srv are also supported for faster targeted scans.

$ anchorectl app add my-vm-fleet --contact-name "Platform Team"
anchorectl app version add 2026-06-01 --app my-vm-fleet
anchorectl app version asset add filesystem / \
  --app my-vm-fleet \
  --version 2026-06-01 \
  --asset web-server-vm \
  --type virtual_machine_disk \
  --wait

$ sudo qemu-nbd --read-only --connect=/dev/nbd0 disk.qcow2
sudo mount -o ro /dev/nbd0p1 /mnt/vm
anchorectl app version asset add filesystem /mnt/vm \
  --app my-vm-fleet \
  --version 2026-06-01 \
  --asset web-server-vm-image \
  --type virtual_machine_disk \
  --wait

Unifies container images (anchorectl app version asset add container-image), VM filesystems (anchorectl app version asset add filesystem), and third-party SBOMs (anchorectl app version asset add sbom) as three asset types under one application version, enabling cross-asset querying.

Imports and exports CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. (JSON and XML) and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. (JSON and tag-value) formats; generated SBOMs include NTIA minimum elements: supplier name, component name, version, purl, dependency relationships, SBOM author, and timestamp.

A new Unroll processor (event breaking) in Google SecOps data processing pipelines automatically expands log entries containing arrays or slices into multiple individual log events prior to parsing and ingestion. It requires structured input, so raw string payloads must first be converted using a Transform processor (e.g. set(body, ParseJSON(body))) placed before the Unroll processor in the pipeline execution sequence.

▶ ⤢

▶ ⤢

# Pipeline processor sequence (data processing pipeline config)
processors:
  - type: Transform
    expression: set(body, ParseJSON(body))
  - type: Unroll

Three new relative time filter operators — Past, Previous, and Current — are available in SecOps dashboards and Search to eliminate ambiguity between rolling windows and calendar-aligned periods, working across all time units from seconds through years. Currently in public preview.

A new redis:max_event_length config key (env: REDIS__MAX_EVENT_LENGTH) sets a maximum size in bytes for a Redis stream event; content exceeding the limit is offloaded to file storage automatically, and setting it to 0 disables the cap. This was extended so large stream event messages are stored to S3 instead of Redis, removing Redis size constraints for high-volume stream deployments.

redis:
  max_event_length: 1048576

Changelog project configuration gains require_author: true to require at least one author on unreleased entries and omit_pr: true to reject pull request numbers in unreleased entries. The validate command now applies the omit_pr and omit_author policies only to unreleased entries by default; pass --all-entries to audit every past release against the current policy instead. This is a behavior change: validate no longer checks released/published entries against omit_pr/omit_author by default, so workflows relying on full-history omission checks must add --all-entries to restore prior behaviour.

require_author: true
omit_pr: true

$ tenzir-ship validate --all-entries

runZero now supports exporting the asset inventory in OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.9.0 format, producing assets.ocsf.jsonl and assets.ocsf.json files accessible from the inventory export menu and the Export API. Assets are exported as Device Inventory Info events and observed services as Live Evidence Info events, with any unmapped fields preserved under the event's unmapped object.

Adds geo_distance function to Censys Query Language (CenQL) for finding assets relative to a geographic location; it currently supports host.location.coordinates and host.services.ntrip as target data objects and is available to all users.

$ services.service_name: NRPE AND geo_distance(host.location.coordinates, 37.7749, -122.4194, 50km)

$ services.service_name: KNXIP AND geo_distance(host.location.coordinates, 51.5074, -0.1278, 25km)

Expands searchable HTTP body size for web.endpoints.http.body (name-based web property endpoints) from 2 KB to 6 KB, enabling more targeted Platform queries.

$ web.endpoints.http.body: "Authorization: Bearer internal-" AND web.endpoints.http.body: "env=production"

Platform Audit Log adds 35 new event types across five areas: ASM risk management (ASM Exclude Created, ASM Exclude Deleted, ASM Risk Instance Accepted, ASM Risk Instance Unaccepted, ASM Risk Instance Severity Changed, ASM Risk Type Disabled, ASM Risk Type Enabled, ASM Risk Type Severity Changed, ASM Seed Created, ASM Seed Deleted), SAML configuration lifecycle (SAML Config Created, SAML Config Deleted, SAML Config Domain Verified, SAML Config Updated, available on Platform and ASM), Personal Access Tokens (PAT Created, PAT Deleted, Platform only), user authentication and account lifecycle (User Login, User Login Failed, User MFA Changed, User Password Changed, User Password Reset, User Settings Changed, User Created, User Disabled, User Updated), and organization/membership management (Organization Created, Organization Updated, Organization Deleted, Membership Created, Membership Removed, Membership Updated, Invitation Accepted, Invitation Created, Invitation Deleted, Invitation Resent).

⤢ ⤢ ⤢

Adds scanners for MPLS_LDP (MPLS Label Distribution Protocol, RFC 5036, all users), SMUX (SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. Multiplexing Protocol, RFC 1227, all users), IPERF3 (iPerf3 bandwidth-measurement control protocol, all users), TVT_CONTROL (TVT proprietary remote-management/CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. protocol for white-label DVR/NVR/IP camera firmware, all users), DLT (AUTOSAR Diagnostic Log and Trace / dlt-daemon for automotive ECU logging, Critical Infrastructure module users), DUBBO (Apache Dubbo RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. framework, Starter/Search/Core users), COMELIT_ICONA (Comelit ICONA Bridge intercom protocol, all users), FOURD_SERVER (4D Server client-server publish protocol, Starter/Search/Core users), KNXIP (KNXnet/IP building-automation bus, Starter/Search/Core users), NRPE (Nagios Remote Plugin Executor agent, all users), REDSHIFT (AWS Redshift analytics DB, Starter/Search/Core users), MANTICORE_SPHINXAPI (Manticore Search / Sphinx legacy SphinxAPI protocol, Starter/Search/Core users), HOOSAT_HTND_GRPC (Hoosat Network htnd full-node gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API, all users), and TAILSCALE_DERP (Tailscale Designated Encrypted Relay for Packets, Starter/Search/Core users).

Enabled via dojo-compose-cli config set --air-gapped true, which validates the license from /etc/defectdojo/dojopro.lic and blocks registry-dependent commands with an explicit error instead of failing silently. Supporting commands: --deploy-version and --version flags to pin the exact release across artifacts and images; dojo-compose-cli deploy download to pull the full deployment directory into /opt/dojo; dojo-compose-cli app pull-images to pre-fetch container images on a staging host; dojo-compose-cli environment print to capture generated secrets (DD_CREDENTIAL_AES_256_KEY, DD_SECRET_KEY); dojo-compose-cli environment add --key ... --value ... to set values (DD_CREDENTIAL_AES_256_KEY, DD_SECRET_KEY, DD_SITE_URL, DD_ALLOWED_HOSTS, DD_DATABASE_URL) on the air-gapped target; and dojo-compose-cli app start/stop/restart, which operate fully offline against the local compose file. Requires CLI 2.1.0+ — earlier versions have no air-gapped mode and fail with name resolution errors. The DOJO_CLI_KEY environment variable supplies the CLI's config encryption key non-interactively.

$ sudo ./dojo-compose-cli config set --air-gapped true
dojo-compose-cli config print

$ export DOJO_CLI_KEY="your-key"
dojo-compose-cli config set --deploy-version 2.1.0
dojo-compose-cli config set --version 2.1.0
dojo-compose-cli deploy download
dojo-compose-cli app pull-images
docker image ls

$ dojo-compose-cli environment add --key "DD_CREDENTIAL_AES_256_KEY" --value "<64-character-key-from-step-4>"
dojo-compose-cli environment add --key "DD_SECRET_KEY" --value "<64-character-key-from-step-4>"
dojo-compose-cli environment add --key "DD_DATABASE_URL" --value "postgres://<db_user>:<db_password>@<db_host>:5432/<db_name>"
dojo-compose-cli environment add --key "DD_SITE_URL" --value "https://defectdojo.internal.example.com"
dojo-compose-cli environment add --key "DD_ALLOWED_HOSTS" --value "*"
dojo-compose-cli app start

Adds config keys dojo.secureCookies (must be false behind an edge-terminated Route or login fails), dojo.skipInitContainer (set true after first install to skip the initializer wait on upgrades), and config.logLevel/celery.logLevel (accept DEBUG). Supports three resource profiles — minimal, standard, performance — the last enabling autoscaling, and ships an idempotent bootstrap script with a dry-run mode that handles storage, fsGroup, and Route creation. Runs under the default restricted-v2 SCC on OpenShift Container Platform, ROSA, and OKD with no anyuid/privileged grant required, exposing the service via an edge-TLS Route with HTTP-to-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirect (ROSA hostnames auto-generated as <release-name>-<namespace>.apps.<cluster-domain>). Requires ReadWriteMany storage for multi-node deployments, with NFS-backed fsGroup derived from the namespace's openshift.io/sa.scc.supplemental-groups annotation; exploitability enrichment can optionally pull EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores from api.first.org and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. data from www.cisa.gov over HTTPS.

dojo:
  secureCookies: false

$ oc get namespace <namespace> -o jsonpath='{.metadata.annotations.openshift\.io/sa\.scc\.supplemental-groups}'

dojo:
  skipInitContainer: true

Adds an -fips image tag suffix for FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 validated variants (standard images unchanged) and a DD_FIPS_MODE="1" environment variable to activate enforcement across Docker Compose, Kubernetes, and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.. Helm values fips.enabled auto-select FIPS images and inject DD_FIPS_MODE chart-wide, while fips.validate: false explicitly accepts partial coverage when non-FIPS components like Sensei or embedded datastores are also enabled; the chart otherwise refuses to render and names the offending components. Cryptographic operations run through OpenSSL FIPS Provider 3.1.2 (CMVP #4985) for Python/Django services and Go Cryptographic Module v1.0.0 (CMVP #5247) for Go services. FIPS mode works without a FIPS-enabled host kernel, including on ECS Fargate, with documented task definitions using DD_FIPS_MODE, DD_DATABASE_URL, DD_SECRET_KEY, DD_CREDENTIAL_AES_256_KEY, and DD_LICENSE sourced from Secrets Manager.

# In .env
DD_IMAGE_TAG=<version>-fips

# In docker-compose.yaml shared anchors
x-dojo-vars: &dojoenv
  DD_FIPS_MODE: "1"

x-nginx-vars: &nginxenv
  DD_FIPS_MODE: "1"

x-psirt-vars: &psirtenv
  DD_FIPS_MODE: "1"

# Then recreate the stack
docker compose up -d --force-recreate

fips:
  enabled: true
  validate: false
sensei:
  enabled: true

Visualizes parent-child Asset relationships as labelled, color-coded arrows with a Legend panel, and a Hide Asset List button to give the diagram full-page space. Per-node display can toggle Asset ID, Organization ID, Organization Name, and Child Count. Clicking a node exposes Open Asset, Edit Asset, Add Child, Change Parent, and Remove From Hierarchy actions without leaving the diagram: Add Child nests an existing or new Asset within the same Organization, Change Parent moves an Asset to a different parent, and Remove From Hierarchy detaches it with a prompt to orphan or re-parent its children. Large hierarchies load incrementally via Load Parents and Load (with configurable batch size).

⤢ ⤢ ⤢

Adds device-bound biometric authentication (Face ID, Touch ID, Android biometrics) as a passwordless sign-in option, implemented per platform: useTrustedDevices hook with enroll, signIn, and revoke methods in @clerk/expo; Clerk.shared.trustedDevices.enroll, Clerk.shared.auth.signInWithTrustedDevice, and Clerk.shared.trustedDevices.revoke(id: trustedDeviceId) on iOS; and Clerk.trustedDevices.enroll, signInWithTrustedDevice, and Clerk.trustedDevices.revoke(trustedDeviceId) on Android. Prebuilt auth and user profile views now surface a biometric enrollment prompt, a biometric sign-in button, and a current-device toggle without custom code.

import { useTrustedDevices } from '@clerk/expo';

const { enroll } = useTrustedDevices();
await enroll();

await Clerk.shared.auth.signInWithTrustedDevice()

Adds custom OAuth scope definitions in the Clerk Dashboard (examples: messages:read, tools:execute, resources/files:read, mcp_all) so MCP clients can request only the access each OAuth application needs. Also adds OAuth metadata advertisement control so MCP clients can discover which scopes an application supports via Clerk's OAuth metadata endpoint.

The HTTP Request action in Identity Security Cloud Workflows adds a Sensitive Request Headers field — a dedicated masked key-value store for API keys, bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., and other secrets that is encrypted in workflow definitions and omitted from execution history. Users move secret values (e.g. an Authorization key with a Bearer <token> value) from the plain-text Request Headers field into this new field when editing the action.

⤢