The Cyber Toolchain — issue 083, September 23, 2026

Researchers can now collaborate with others on a single submission via the new Submission Collaborator feature.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The maximum number of collaborators per submission was raised from 8 to 20, with reward allocation for all collaborators handled directly on the platform without manual processing delays.

Web application and API scans now support time-based one-time password (TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.) seeds for multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.), configurable via the REST API, and custom cookies for authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ API Scanning adds Scriptable Request Modification (SRM), allowing JavaScript to modify HTTP requests at runtime during authentication, and DAST Enterprise mode adds support for login scripts, scanner variables, client certificates, and Scriptable Request Modifications (SRM) for APIs as additional authentication configuration options.

The DAST Target Configuration Service REST API is now publicly available to automate management of DAST targets and trigger analyses.

DAST target creation and configuration now support assigning multiple teams to a single target for shared security ownership, selecting a business unit when creating a web application or API specification target or on the DAST configuration page, Directory Restrictions to control scan scope, and custom host-to-IP address mappings for scans when DNS lookup is unavailable or not desired.

The ISM endpoint 24.10.0 introduces a proxy exclusion list allowing specified hosts to bypass the configured proxy settings, and DAST Enterprise mode adds Internal Scanning Management (ISM) support for scanning web applications and APIs behind a corporate firewall.

Adds the ability to schedule an analysis pause and resume on specific days of the week, during specific periods, or both. The DAST scheduling API endpoints have changed as part of this enhanced scheduling rollout, so integrations using the REST API to manage schedules must be updated to use the new endpoints per the DAST API specification.

Adds the policy parameter to GitHub Workflow Integration v2.1.7 for infrastructure-as-code (IaC) scans.

DAST Enterprise mode now provides an AI-based authentication method (AI-Assisted Login) to cover complex login flows without recorded login scripts.

DAST now supports manual application linking to connect analysis run results to a Veracode Platform application for policy evaluation and combined multi-scan-type reporting.

Adds the ability to set URL scan settings at the organization level via the Dynamic Analysis REST API.

Adds the snyk fix --agentic CLI command, which applies and verifies vulnerability fixes automatically in an agentic pipeline without manual review steps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ snyk fix --agentic

$ snyk fix --agentic

Adds the Evo MCP Server (GA), letting any MCP client — Claude, Codex, Cursor — query discovered AI assets across code, developer machines, and pentest targets, inspect asset relationships (e.g. which MCP servers an agent uses), and read or write policies without leaving the agent.

Adds support for installing the hawk CLI via curl -sSf https://download.stackhawk.com/hawk/install.sh | sh, with SHA-256 verification against the published manifest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Supports HAWK_INSTALL_VERSION to pin a release and HAWK_INSTALL_DIR to control the install destination (default ~/.hawk/bin).

$ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/usr/local/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

$ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/usr/local/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

Adds basePath under app.openApiConf to prepend a base path to every operation discovered in an OpenAPI specification, taking precedence over both a path on app.host and servers[].url in the spec. Adds disableServerBasePath under app.openApiConf to suppress the base path declared in the specification's servers[].url when the API is served at the root of app.host.

app:
  host: http://localhost:8000
  openApiConf:
    basePath: /api/v2
    disableServerBasePath: true

The session-verification block under app.authentication.sessionVerification in stackhawk.yml/.stackhawk.yml enables periodic re-authentication polling during scans, with pollFrequency, activeScanPollFrequency, and maxUnauthenticatedRequestPercent controlling check cadence and tolerance. maxConsecutiveUnauthenticatedChecks flags suspect authenticated coverage when a burst of consecutive failed session checks occurs, catching gaps a scan-wide average would miss, and disabled: true explicitly turns off session verification, falling back to app.authentication.loggedInIndicator / loggedOutIndicator regex matching. The block is off by default — providing it (even empty) enables polling, while omitting it requires a loggedInIndicator or loggedOutIndicator instead, and those two fields remain supported (not deprecated) as the only per-request session check when verification is absent or disabled.

app:
  authentication:
    sessionVerification:
      maxConsecutiveUnauthenticatedChecks: 3

app:
  authentication:
    loggedInIndicator: 'Welcome, '
    sessionVerification:
      disabled: true

app:
  authentication:
    sessionVerification:
      pollFrequency: 20
      activeScanPollFrequency: 3
      maxUnauthenticatedRequestPercent: 5

app:
  authentication:
    sessionVerification:
      pollFrequency: 20
      activeScanPollFrequency: 3
      maxUnauthenticatedRequestPercent: 5

app:
  authentication:
    sessionVerification:
      pollFrequency: 20
      activeScanPollFrequency: 3
      maxUnauthenticatedRequestPercent: 2

Naming one technology flag in hawk op app tech-flags set no longer silently re-enables all other 34 flags; the command now reads the current flags, merges the requested change, and writes only the result.

Scan configuration now resolves ${VARIABLE} references against organization-wide secrets, so a team can share one copy of a scan credential instead of one per engineer. Personal secrets take precedence over organization secrets, HawkScan warns when both exist for the same name, and it names any unresolvable variable explicitly.

Adds a GET List user logins history API endpoint for auditing authentication activity, a Broker management API for programmatic control of broker configuration, a webhook event for when a new issue ignore/snooze request is accepted or denied, and a webhook event for when a Domain scan finishes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reply to a Deep Review comment requesting a fix and Aikido opens a new pull request with the fix built on top of your current PR.

Aikido now supports Code Coverage upload from GitLab CI, with per-file and per-line results visible in Aikido alongside existing GitHub coverage.

Altar is Aikido's first open-weight security model, built to run frontier-grade pentesting fully on-prem and air-gapped without sending data to third parties.

Adds a telemetry property to managed-settings.json for enterprise-managed Copilot settings, enabling OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. export and specifying the receiving endpoint, with prompt/response content excluded by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Supports sending Copilot agent activity data — including AI model requests, tool calls, and step-by-step execution traces — to any OpenTelemetry-compatible monitoring backend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

⤢

{
  "telemetry": {
    "endpoint": "https://otel-collector.example.com"
  }
}

Adds GPT-6 Sol, a balanced model for interactive and agentic coding with multistep validation, available on Copilot Pro+, Max, Business, and Enterprise plans, and GPT-6 Luna, a lightweight, cost-efficient model for smaller and faster tasks — the lowest-cost option in the GPT-6 family — available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

Enforces a minimum RSA SSH key size of 3072 bits for all new keys uploaded after October 14, 2026, for both signing and authentication; smaller keys will be rejected.

$ ssh-keygen -t ed25519 -C "your_email@example.com"
# or, if RSA is required for compatibility:
ssh-keygen -t rsa -b 3072 -C "your_email@example.com"

The ssh-rsa signature type (RSA keys using SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications., including ssh-rsa-cert-v01@openssh.com certificates) will be removed effective January 13, 2026, with brownouts on November 4 and December 9, 2026, and the diffie-hellman-group-exchange-sha256 key exchange algorithm will be removed on the same schedule; connections relying on either will fail.

GitHub Copilot CLI now builds a persistent symbol index across all project files for C++ to speed up code intelligence; use /lsp logs at any time to check indexing progress.

$ /lsp logs

Adds mlkem768x25519-sha256 post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key exchange for SSH sessions on github.com and GitHub Enterprise Cloud with Data Residency (excluding the U.S. region), with GitHub Enterprise Server support arriving in version 3.24.

Adds plan mode to the Codex agent, letting you review, refine, or approve a plan before the agent begins making changes.

Claude Opus 5.5 is now available in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse, aimed at agentic coding and long-running tasks with efficient multistep error recovery.

Adds a setting to toggle the built-in GitHub MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. on or off independently of manually configured MCP servers (enabled by default), plus persistent per-tool controls for MCP servers in Copilot agent sessions, letting you enable or disable individual tools without affecting others.

New keyless.enabled, keyless.region, keyless.secretName, and keyless.refreshIntervalHours Helm values let the Harden Runner daemonset fetch its StepSecurity API key from AWS Secrets Manager using the pod's IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role (IRSA) instead of a static Helm value, refreshing on a configurable schedule (default 3 hours).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The secret must be a JSON object containing an api_key field, and the IAM role requires the secretsmanager:GetSecretValue permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

⤢

serviceAccount:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<irsa-role>
env:
  customer: "<your-org>"
  keyless:
    enabled: "true"
    region: "us-east-1"
    secretName: "stepsecurity/orgs/<github-org>/arc-api-key"
    refreshIntervalHours: "3"

New env.customEnvVars Helm value injects arbitrary environment variables (e.g. HTTP_PROXY, HTTPS_PROXY, NO_PROXY) into the harden-runner container, enabling deployments behind a proxy.

⤢

env:
  customEnvVars:
    - name: HTTP_PROXY
      value: "http://proxy.corp.example.com:3128"
    - name: HTTPS_PROXY
      value: "http://proxy.corp.example.com:3128"
    - name: NO_PROXY
      value: "169.254.169.254,10.0.0.0/8"

SonarQube Cloud now analyzes Rust as a first-class language: it enforces 122 curated Clippy rules through quality profiles across all projects, and adds library- and framework-aware rules covering tokio async handling, serde serialization, and actix-web misuses beyond what Clippy detects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It calculates Cognitive Complexity and Cyclomatic Complexity for Rust code, runs duplicate code detection (CPD) across the codebase, and imports Rust coverage data in LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura format, correlating it with analysis results in the issue view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Rust projects appear inside the same multi-language project view as C/C++, Java, and JavaScript with no separate dashboard, and support quality gate enforcement with pass/fail thresholds scoped to new code for CI blocking. The Rust analyzer exposes sonar.rust.cargo.manifestPaths to point at non-default Cargo.toml locations, and sonar.rust.clippy.enabled (set to false to import an external Clippy JSON report instead of letting SonarQube run cargo clippy automatically).

$ sonar-scanner -Dsonar.rust.cargo.manifestPaths=services/myservice/Cargo.toml

$ sonar-scanner -Dsonar.rust.clippy.enabled=false

tirith capsule run --preset untrusted-project copies an untrusted project into a held ephemeral directory and executes an exact argv under fail-closed containment on x86_64 Linux with a usable Landlock ABI; all other platforms refuse before copy or spawn.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ tirith capsule run --preset untrusted-project --project ./untrusted-repo -- python build.py

tirith package inspect analyzes wheel files, sets of wheels, or installed environments without downloading them, using a bounded streaming wheel reader that rejects path traversal, entry collisions, encrypted entries, conflicting metadata, CRC failures, decompression abuse, and ambiguous identities.

MCP configuration locking binds source path, server identity, transport, descriptor set, declared tools, and code/config drift without persisting raw environment values or URL credentials. Existing MCP privacy lockfiles require an explicit re-lock when the documented schema migration says so, and generated wrappers must be regenerated via tirith setup <tool> --update-configs so they contain the current validated absolute interpreter and Tirith paths.

tirith setup now supports 19 named AI-agent hosts, adding Grok Build, OMP, OpenCode, Vercel Labs fx, Prime Agent, Cline, Roo Code, Continue, and OpenHands alongside previously supported hosts. Blocking pre-execution hooks are added for Prime Agent, OMP, Cline, and OpenHands where the host exposes one; Cline receives the platform-native PreToolUse wrapper on POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. and PreToolUse.ps1 on Windows.

Threat intelligence is upgraded to a signed v2 database that adds artifact SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., installed-file hash, malicious-URL, campaign, and behavior-tag indices to package, domain, and IP reputation, with monotonic sequence checks to prevent rollback. An old client must not be pointed directly at a v2 ThreatDB data file; ThreatDB v1 remains available during the v2 cutover.

tirith pkg approve and tirith pkg install bind resolution, exact artifact hashes, inspection results, approval state, contained execution, environment verification, and a tamper-evident receipt into one workflow.

Package inspection gains ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., Mach-O, and PE triage to find native extensions in Python wheels and correlate native imports, runtime launches, loaders, and payloads across distribution boundaries; Wheel RECORD and installed-environment RECORD verification to detect missing, modified, unowned, or multiply owned files; and modeling of Python startup execution through .pth, .start, sitecustomize, and usercustomize as an execution chain rather than ordinary data.

tirith task check and the preview-gated tirith_check_task MCP tool (requires TIRITH_MCP_PREVIEW=1) diagnostically assess untrusted task envelopes without executing anything.

tirith browser audit performs a one-shot, read-only integrity audit of Chrome, Chromium, Brave, and Edge extension source trees with signed baselines and typed drift.

The web3_guard policy section classifies network and signer policy, covering state changes, signer risk, and network-policy violations for Cast, Forge, Hardhat, Solana, and Anchor operations, without reading chain state or simulating a transaction.

tirith pkg attest-npm binds npm's own signature/provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. report to the exact lockfile and installed inventory.

MCP tool and resource output sanitization is on by default, using bounded structured traversal, leaf preservation, cross-leaf detection, strict blob decoding, MIME checks, URI rules, and explicit incomplete-analysis failures.

CI-focused directory scans correlate fork-reachable artifact producers with privileged workflow_run consumers and execution, PATH, publish, or deployment sinks. Structural GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. rules cover mutable action references, privileged trigger hazards, and expression-to-shell injection.

Files are classified by magic bytes read through a retained no-follow handle rather than by name or suffix, with explicit routing for misnamed, extensionless, malformed, polyglot, archive, native, and unknown binary content.

Detections now include reverse-shell and suspicious inline-interpreter command shapes, OpenAI/Hugging Face/PyPI/PGP credential patterns, hidden PDF instructions, and wallet and sensitive-asset exfiltration through promoted operands (xargs, find -exec, parallel), compressors, encoders, and staged encryption output.

A Prime Agent IPython guard extracts shell escapes, shell magics, and common Python process-spawn forms before delegating to the Tirith engine; unrecognised execution forms fail closed by default.

Command-card schema 2 binds ordered Web3 operations, network identity, signer kind, artifact hashes, and policy identity while keeping schema-1 signing bytes compatible.

Checkpoints created by older builds under /tmp/tirith/checkpoints are not migrated automatically — inspect and remove that directory manually; 0.4.0 uses private per-user state.

The new --output <dir> flag directs --json, --sarif, and --sbom output files into a specified directory, which is created if it doesn't exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Passing --output without one of those three flags is treated as an error rather than a silent no-op. A matching output input was added to the GitHub Action for the same directory-routing behaviour.

$ cve-lite /path/to/project --sarif --json --output reports

Scans SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3 documents through a derived copy instead of skipping them, sends SPDX documents to Dependency Track through a derived CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. copy, validates SPDX 3.0.1 claims against the vendored schema with clear version-edge messages, and honours VEX statements carried inside an SPDX 3 document about itself.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds an is_default_workspace field alongside is_default_team in the API and on-screen copy, and serves a v2 API that uses workspace terminology from the same views.

Cycode Workstation Protection intercepts package install commands in real time on developer workstations to enforce cooldown (release-age gating) policies and block known malicious packages—including typosquattingtyposquattingUsing a name close to a trusted domain or software package to catch spelling mistakes. Attackers use it to lure people or installers to a malicious lookalike., slopsquattingslopsquattingPublishing malicious packages under names invented by AI coding tools. A developer who installs a hallucinated dependency may then retrieve the attacker's real package., and persistent compromised-maintainer releases—before they install, checking every install against a continuously updated threat intelligence feed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It deploys via Mobile Device Management (MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.) with no new console, no new infrastructure, and no change to developer install workflows, and enforces at the device level so gating applies regardless of which package manager version is used or whether a local config file was set up correctly. It unifies this workstation enforcement with existing AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts., prompt guardrails, pipeline integrity, and secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. capabilities inside the Context Intelligence Graph.

Adds a detectors field to the config YAML to define custom regex detectors, each with name, keywords, regex, and optional verify sections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Verification supports verify.endpoint, verify.unsafe, and verify.headers to validate secrets via a webhook POST, plus verify.successranges and verify.rotatedranges (HTTP status codes or inclusive ranges like '200-202' or '401') to mark secrets live or rotated. regex supports named capture groups where every named pattern must match, a primary regex name to pick which pattern's line number is reported, exclude regexes capture and exclude regexes match to strip or suppress matches, an entropy parameter to filter low-randomness false positives, and exclude words to ignore strings containing listed words.

detectors:
  - name: hogtokendetector
    keywords:
      - hog
    regex:
      hogid: '\b(hog[0-9a-z]{17})\b'
      hogtoken: '[^a-zA-Z0-9+\/]{0,1}([a-zA-Z0-9+\/]{40})[^a-zA-Z0-9+\/]{0,1}'
    verify:
      - endpoint: http://localhost:8000/
        unsafe: true
        headers:
          - 'authorization: super secret authorization header'
        successranges:
          - '200'
        rotatedranges:
          - '401'
          - '403'

Adds customVerifiers to the root-level config YAML to point secret verification at self-hosted or enterprise endpoints for GitHub Enterprise Server, GitLab, Jira Data Center, Confluence Data Center, Bitbucket Data Center, JFrog Artifactory (access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and reference token variants), and HashiCorp Vault. Adds a --verifier CLI flag to the open-source binary to pass custom verifier endpoints at scan time (e.g. --verifier github=example1.github.com,example2.github.com) without a config file.

customVerifiers:
  - name: github
    endpoints:
      - https://github.example.com/api/v3
  - name: gitlab
    endpoints:
      - https://example.gitlab.com

$ trufflehog filesystem . --verifier github=example1.github.com,example2.github.com --verifier gitlab=example1.gitlab.com

TruffleHog Enterprise adds Share Secrets, turning a finding into a secure, access-controlled link where recipients authenticate via Google SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. or SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. against trusted domains and see a read-only view without a platform login. Links support four expiration options — on read, 1 hour, 1 day, 7 days, 1 month — and are managed on a Shared Secrets page with Active Shared Secrets (revocation) and Sharing Settings (trusted domains, default auth) tabs. Trusted domains are set under Settings > Shared Secrets > Edit Trusted Domains, and the sharing authentication setting picks Google OAuth or SAML SSO as default. Shared pages show secret type, locator, verification status, first-detected/last-seen timestamps, expiration time, location details, and rotation guidance, without exposing the plaintext credential.

Adds a notifiers field to the config YAML to configure alerts locally with options name, sendunverified, sourcestonotify, customtext, includesecretlink, type, numworkers, trufflehogaddress, trufflehogscannergroup, and trufflehogscannertoken. sourcestonotify accepts all, sources in this config, or a comma-separated list. Supports stdout (GA, open-source/on-premise), email/jira/slack/webhook (GA, cloud and on-premise), and splunk (alpha, on-premise) notifier types.

concurrency: '8'
loglevel: info
notifiers:
  - name: slack secrets notifications
    sendunverified: true
    sourcestonotify: sources in this config
    customtext: message to add to notifier
    includesecretlink: true
    type: slack
    numworkers: 16
    trufflehogaddress: https://gnarly-flying-pancake.c1.prod.trufflehog.org
    trufflehogscannergroup: account-1.us-west-2
    trufflehogscannertoken: thog-agent-xxxxxxxxxxxxxxxxxxxxxxxxxx

concurrency: '8'
loglevel: info
notifiers:
  - name: stdout secrets notifications
    sendunverified: true
    sourcestonotify: sources in this config
    type: stdout
    numworkers: 16

TruffleHog Enterprise adds email notification support via AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure., configurable in config.yaml under notifiers with connection '@type': type.googleapis.com/notifiers.email, ses.creds.key, ses.creds.secret, ses.region, recipients, and sender fields. Adds a ccleaker option to automatically CC the person who leaked the credential when their email address is available, and supports configuring the notifier through the Integrations tab in the web UI as an alternative to local YAML config.

notifiers:
  - connection:
      '@type': type.googleapis.com/notifiers.email
    ses:
      creds:
        key: AKIAXXXXXXXXXXXXXXXX
        secret: XXXXXXXXXXXXXXXXXXXXXXXXXX
      region: us-west-1
    recipients:
      - security@ourbusiness.org
    sender: <trufflehog> trufflehog@ourbusiness.org
    name: email secrets notifications
    type:
      notifier_type: email
    options:
      ccleaker: true

TruffleHog can now run as a server-side pre-receive hook on GitHub Enterprise Server, GitLab Self-Managed, and Bitbucket Data Center, blocking pushes without requiring anything installed locally by developers. Adds --no-update, --only-verified, and --fail flags for use in pre-receive hook scripts to control update checks, filter to verified secrets, and fail the push on findings.

$ #!/bin/bash
trufflehog git --bare --no-update --only-verified --fail file://

Adds detectors.config.aws.allowedAccountIds and detectors.config.aws.deniedAccountIds list fields to the config YAML to restrict or block AWS credential verification by account ID, with denied IDs always taking precedence over allowed IDs. Adds detectors.config.jdbc.ignorePattern to suppress unwanted JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. detector results via regular expressions.

detectors:
  config:
    aws:
      allowedAccountIds:
        - "111111111111"
        - "222222222222"
      deniedAccountIds:
        - "666666666666"

detectors:
  config:
    jdbc:
      ignorePattern:
        - "someP[aa]ttern[0-9]+"

TruffleHog Enterprise gains Topology, an interactive graph that maps verified live secrets from the source service where they were found to the target services they grant access to. Every service node is categorized as Scanned, Not Monitored, or Non-Scannable; selecting an edge surfaces source/destination service, secret count, secret types, and a link to findings. The graph can be filtered by service category and triage state (refreshing on triage-state filter changes), and selecting an unmonitored scannable service links directly to its configuration page.

Adds a trufflehog analyze subcommand with self-discovery analyzers that perform non-state-changing API calls to determine a secret's resources and permissions, plus cloud analyze (enterprise-only) to examine cloud secrets against live environments for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. posture, currently supporting GCP. The GitHub analyzer's output now also includes an is_fine_grained metadata field indicating whether a scanned token is a fine-grained personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., and gist enumeration failures no longer abort the analyzer.

TruffleHog Enterprise adds source archiving to stop scanning an integration while retaining all findings it has already reported; archived sources show a gray archived badge and are hidden from the integrations list by default, with a Show archived filter to surface them dimmed. Findings whose only sources are archived get a verification frozen badge, freezing the last known status without re-verifying and excluding them from MTTR calculations. Already-archived sources can be permanently deleted (destroying their findings), and archive actions are recorded in the activity log.

Deprecates the entrypointsStatuses property in the Scan Configuration API in favor of the new entryPointFilter property, which accepts securityStatus (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 'new') and connectivityStatus (e.g. 'ok') arrays for more flexible entry point selection.

{
  "entryPointFilter": {
    "securityStatus": ["new"],
    "connectivityStatus": ["ok"]
  }
}

Adds a Fuzzing Mode to STAR Harness that hunts robustness and memory-safety bugs — crashes, hangs, type confusion, unhandled exceptions, unbounded allocation, and algorithmic complexity — in code past input validation, without requiring a scan, authentication, or Repeater.

Improved Workflow Run details now show execution progress as executed-out-of-total nodes, a node status breakdown, a warning indicator for problematic nodes, a View Scans action filtered by Workflow Run, and configurable table columns.

The GitHub Marketplace Actions and npm packages under the Neuralegion GitHub organization will move to BrightSec on October 20; workflows or integrations that reference Neuralegion directly will need to be updated.

Introduces the Bright Optimizer, a new experience surfacing scan improvement opportunities such as manually triggered scans, low health scores, and long-running scans, configurable via Organization Settings -> General Details -> Optimizer Settings.