Hacktron

No entries match these filters. Clear filters

1. 1.0 Nov 2, 2026 · issue 128

   API surface changed: +13 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +13 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /pentests/{id}
   • + GET /credits
   • + GET /findings/counts
   • + GET /pr-review-settings
   • + PATCH /pentests/{id}
   • + PATCH /pr-review-settings
   • + POST /archives/uploads
   • + POST /pentests
   • + POST /pentests/{id}/estimate
   • + POST /pentests/{id}/login-checks
   • + POST /pentests/{id}/start
   • + POST /repos/pr-reviews
   • + POST /scans/{id}/stop
   • Adds new pentests endpoints: DELETE /pentests/{id}, PATCH /pentests/{id}, POST /pentests, POST /pentests/{id}/estimate, POST /pentests/{id}/login-checks, and POST /pentests/{id}/start.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /credits
   • New endpoint GET /findings/counts
   • Adds GET /pr-review-settings and PATCH /pr-review-settings endpoints for managing PR review settings.
   • New endpoint POST /archives/uploads

   +2 more show less

   • New endpoint POST /repos/pr-reviews
   • New endpoint POST /scans/{id}/stop

   7 details in Everything

2. Scope your pentest to exactly the folders that matter Oct 27, 2026 · issue 124

   Hacktron adds folder-based scan scope, Closed finding status, Attestation Letters, and raises the PR review file limit to 500⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When launching a Whitebox pentest, narrow the scan to only the directories that are in scope — such as a single service directory — instead of scanning the entire repository.
   📍In the Whitebox pentest wizard, advance to the Scope step, uncheck all top-level folders in the checkbox file tree, then check only the folders you want scanned (e.g. src/auth and src/payments), then continue to launch the scan.
   Share a compliance attestation letter with a customer or auditor who does not have a Hacktron account.
   📍Go to your organization's Attestation Letters page, copy the unique shareable link next to the relevant letter, and send it to the recipient — they can view or download the PDF without logging in.
   Stop Hacktron from posting automated code review comments on every pull request across the whole organization.
   📍In Hacktron, go to Settings, find the automated code review comments control, and turn it off at the org level.
   • Scope a Whitebox pentest to specific folders by picking paths to include or exclude in a checkbox file tree inside the new Scope step of the Whitebox pentest wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Mark a single finding as Closed directly from its status menu, keyboard shortcut, or command palette — the same place used to set False Positive.
   • Access an Attestation Letters page where Hacktron-issued letters appear with a unique shareable link and a PDF download that auditors can view without logging in.
   • (improved) Code Review limits are raised: pull requests with up to 500 changed files are now accepted, up from 200, and OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. organizations now get 50 free PR reviews per month, up from the previous limit.
   • Organization admins can now turn off automated code review comments for the whole org from Settings.

   +5 more show less

   • The People page now splits into a Members tab and an Invitations tab, with revoked invitations listed with a Delete option instead of disappearing.
   • Tooltips and prompts at every auto-assignment opt-in point now disclose that bot PR authors take billable seats, and the excluded-authors filter note clarifies that excluded authors never consume a seat.
   • The trial activation modal now has an enable-all button to turn on PR reviews for every connected repository in one step.
   • Connecting a GitLab installation no longer requires completing every step before saving — partial setups can be saved, and the connection page shows only the actions available at your current access level.
   • The final Whitebox review step is rebuilt as a structured summary panel with Source, Target, Access, and Context sections, each with an Edit button and visible verification status.
   • Scope a Whitebox pentest to specific folders by picking paths to include or exclude in a checkbox file tree inside the new Scope step of the Whitebox pentest wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Access an Attestation Letters page where Hacktron-issued letters appear with a unique shareable link and a PDF download that auditors can view without logging in.
   • Organization admins can now turn off automated code review comments for the whole org from Settings.

   7 more in Everything

3. Findings get an identity, a history, and a command palette Oct 21, 2026 · issue 116

   Hacktron adds stable finding IDs, an activity timeline, command palette actions, multi-ID search, and a whitebox retest wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Filter the findings list to a specific set of findings by pasting their IDs — useful when a ticket references multiple findings you want to triage together.
   📍In the findings search box, paste: HT-1042 HT-1078 HT-1091
   Request a whitebox retest after a scan is complete to verify that reported findings (excluding false positives and accepted risk) have been remediated.
   📍Navigate to Scans › [completed scan] › Retest, then follow the retest wizard to submit the request. Track status and results on the scan detail page.
   • Adds human-readable, stable finding IDs (shown in the row, panel, full page, and URL, with click-to-copy), an Activity tab in the finding detail panel showing the full detection and edit history with actor and changed fields per entry (switch to a Comments view to see only the thread), finding-scoped actions in the command palette (change status, change severity, mark/unmark duplicate, create ticket, start remediation, copy ID, copy link, open full page) when a finding is open, and multi-ID search that lets you paste two or more finding IDs into the search box to filter to exactly those findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Source, Reopened, and Date range filters to the findings list, each saved in the URL, and a CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. name tooltip on the CWE badge so the full weakness name is visible without leaving the page.
   • Adds a whitebox retest wizard to request a retest for a completed scan directly from the scans list or scan detail page, covering all reported findings except false positives and accepted risk, and shows retest status and results on the scan detail page once a retest is complete.
   • The Methodology section of a whitebox scan report now shows how many functions each area selected instead of an arbitrary list of five names, and Coverage Detail caps the unselected entry-points table at 50 rows.
   • Inline browser-auth audit instructions in the whitebox scan wizard's target step now appear directly on the page with live verification status, replacing the separate modal.

   +2 more show less

   • The Repositories page shows a notice when PR Review is toggled on for a repo but no active trial or subscription backs it, with a direct link to start a trial.
   • On-prem appliances that cannot reach GitHub.com now disable the GitHub.com integration card with a specific reason (DNS, blocked, or TLS) instead of failing at the code exchange.
   • Adds human-readable, stable finding IDs (shown in the row, panel, full page, and URL, with click-to-copy), an Activity tab in the finding detail panel showing the full detection and edit history with actor and changed fields per entry (switch to a Comments view to see only the thread), finding-scoped actions in the command palette (change status, change severity, mark/unmark duplicate, create ticket, start remediation, copy ID, copy link, open full page) when a finding is open, and multi-ID search that lets you paste two or more finding IDs into the search box to filter to exactly those findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a whitebox retest wizard to request a retest for a completed scan directly from the scans list or scan detail page, covering all reported findings except false positives and accepted risk, and shows retest status and results on the scan detail page once a retest is complete.
   • The Repositories page shows a notice when PR Review is toggled on for a repo but no active trial or subscription backs it, with a direct link to start a trial.

   4 more in Everything

4. See what a Whitebox scan actually established Oct 9, 2026 · issue 109

   Hacktron adds Jira/Linear two-way status sync, a unified Integrations page, and richer Whitebox PDF reports with live-validation evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Whitebox PDF reports now include repositories and targets in scope, testing window, severity rubric, limitations, confidentiality notice, and — where available — methodology and code-coverage detail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Findings with recorded live-validation evidence gain a Live Validation section in the PDF report showing what the attempt established, what it did not establish, any blocker, and observed output for successful exploits.
   • Adds two-way Jira and Linear status sync: finding status changes propagate to linked issues and supported issue status changes flow back into Hacktron, with each direction independently toggled by organization admins in integration settings; Jira updates follow the project workflow's available transitions.
   • Adds a unified Integrations page that lists all providers with connection details, repository counts where applicable, a Connect or Manage action, status badges for connected providers, and inline actions for connections needing attention.

   4 details in Everything

5. Choose GitHub repositories without leaving Hacktron Sep 25, 2026 · issue 109

   Hacktron gains in-app GitHub repo selection, per-repo PR-review toggles, and GitHub.com support for self-hosted appliances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Trigger a re-review of an already-reviewed commit to get the current status without waiting for the next push.
   📍@hacktronai review
   Keep a repo visible in Hacktron for findings tracking while disabling automatic PR reviews — useful for low-priority or archived repos.
   📍In Hacktron, go to Repositories, find the target repository, and toggle Automatic PR Reviews off while leaving the repository enabled in the GitHub integration.
   • Adds in-app GitHub repository selection so organization admins can choose which repos to enable from the GitHub integration without leaving Hacktron, within the access granted to the GitHub App.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds per-repository PR-review toggle to keep a repository available to Hacktron while independently switching its automatic PR reviews on or off.
   • Expands the Repositories table to show Repository and Owner as separate columns alongside Open Findings, PR Scans, and Last Scan, with a platform filter scoped to only connected providers.
   • Adds automatic re-selection of repositories that are added back to the GitHub App installation.
   • Adds @hacktronai review reply behavior: when posted for a commit that already has a review, Hacktron replies with the completed result or reports that the review is still in progress.

   +2 more show less

   • Adds a contact-the-team prompt for organizations using the large-estimate approval flow when Whitebox estimates exceed 5,000 credits.
   • Enables self-hosted Hacktron appliances to connect a customer-owned GitHub App and review GitHub.com pull requests on their own infrastructure.
   • Adds in-app GitHub repository selection so organization admins can choose which repos to enable from the GitHub integration without leaving Hacktron, within the access granted to the GitHub App.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds per-repository PR-review toggle to keep a repository available to Hacktron while independently switching its automatic PR reviews on or off.
   • Adds a contact-the-team prompt for organizations using the large-estimate approval flow when Whitebox estimates exceed 5,000 credits.
   • Enables self-hosted Hacktron appliances to connect a customer-owned GitHub App and review GitHub.com pull requests on their own infrastructure.

   3 more in Everything

6. Check your fixes without repeating the full assessment Sep 22, 2026 · issue 109

   Hacktron adds finding retest requests, login preview for dynamic validation, and improved People list search for Whitebox Code Review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   After remediating findings from a Whitebox scan, request targeted retests instead of re-running the full assessment.
   📍In a completed Whitebox scan, go to Retest findings, select the findings you have fixed, enter your fix instructions, and submit. The pentest team will record outcomes and notes; results appear under the scan's retest history and in the PDF report.
   Validate that login automation will work against your deployed target before committing a dynamic-validation scan.
   📍In the Whitebox scan wizard, navigate to the dynamic validation step, enter your login instructions and test credentials, then click the preview button to open the browser session and confirm authentication succeeds before starting the scan.
   • Adds Retest findings workflow on completed hosted Whitebox scans: select findings, provide fix instructions, and the Hacktron pentest team records each outcome and notes; completed retests appear in the scan's retest history and PDF report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds login instruction preview for dynamic validation in the Whitebox scan wizard: supply login instructions and test credentials, then preview the browser session before starting so Hacktron can authenticate against deployed targets during finding validation.
   • Adds name, email, and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. username search to the People list, with filters by role or Code Review seat, plus sort and pagination across the full member list rather than only loaded rows.
   • Adds Retest findings workflow on completed hosted Whitebox scans: select findings, provide fix instructions, and the Hacktron pentest team records each outcome and notes; completed retests appear in the scan's retest history and PDF report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds login instruction preview for dynamic validation in the Whitebox scan wizard: supply login instructions and test credentials, then preview the browser session before starting so Hacktron can authenticate against deployed targets during finding validation.

   1 more in Everything

7. A rebuilt findings view, and fix PRs that close themselves Sep 18, 2026 · issue 078

   Hacktron adds Azure DevOps remediation, Linear triage sync, appliance license controls, and a rebuilt findings view⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Prevent a specific bot account from receiving AI fix PRs by adding it to the author exclusion list in your Hacktron config.
   .hacktron/config.yaml copy

   exclude:
     authors:
       - renovate[bot]
       - my-internal-bot

   Cap the total scans an appliance license permits so a max_scans quota is enforced from the first scan attempt.
   yaml copy

   max_scans: 500

   Target a specific release tag for a GitLab Whitebox Scan instead of scanning the current branch tip — useful for auditing a pinned release candidate.
   📍In the Hacktron web app, go to Whitebox Scans › New Scan, select your GitLab repository, then enter the tag name (e.g. v2.4.1) or commit SHA in the Tag or commit field before starting the scan.
   • Adds exclude.authors trust-rule support for bot pull requests on GitHub, so Dependabot, Renovate, and similar bots are now reviewed alongside GitLab and Bitbucket.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds max_scans entitlement field to appliance licenses, capping the total number of full scans that may start over the life of the license, checked at scan start including restarts.
   • Supports Azure DevOps repositories for remediation automations — fix pull requests can now be opened and tracked on Azure DevOps alongside GitHub and GitLab.
   • Pins a GitLab Whitebox Scan to a specific tag or commit SHA instead of the tip of a branch.
   • Adds OWASP Top 10:2025OWASP Top 10:2025A ranked list of the ten most critical web application risk categories, maintained by the Open Worldwide Application Security Project, used by cyber tools to prioritize detection, testing, and remediation coverage. category to findings — settable from the overflow menu, visible in the findings table and drawer, and filterable.

   +13 more show less

   • Adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. identifier and plain-language fix recommendation to findings in the detail view, where the scan engine supplies them.
   • Adds a download button in the triage header to pull a scan's context documents — threat model, architecture notes, and uploaded files — without leaving the findings view.
   • Shows the engine-reported failure reason on the scan detail page when a scan fails.
   • Displays severity badges on findings in global search results.
   • Rebuilds the findings table and detail drawer with a unified header tray for Severity, Status, Remediate, Copy markdown, and Mark as duplicate actions, plus previous/next navigation and a full-page collapse control.
   • Scopes the Application filter on the PR Review dashboard to every widget, including the security score card and the low-score banner.
   • Consolidates Account and Settings into a single Personal settings page with sections for Profile, Security, Connected accounts, Preferences, Sessions, and Organizations.
   • Allows any organization member to create, rotate, and revoke their own API keys from personal settings without owner or admin involvement.
   • Adds license detail and expiry warnings to organization settings on appliances — showing licensee, expiry date, days remaining, seat count, and covered products — with a 30-day-out banner and scan blocking after the grace deadline.
   • Connects self-managed GitLab instances to appliances for merge-request scanning, enabling the Reviews link, PR Review dashboard tabs, and source control settings.
   • Connects GitHub Enterprise Server to appliances via a GitHub App installation instead of a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
   • Provides a dedicated appliance onboarding flow — Welcome, Connect your code, You're all set — pre-filled for the configured Git host.
   • Expands pentest PDF exports with more per-finding detail, display-order finding numbers, and syntax-highlighted code blocks.
   • Adds exclude.authors trust-rule support for bot pull requests on GitHub, so Dependabot, Renovate, and similar bots are now reviewed alongside GitLab and Bitbucket.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds max_scans entitlement field to appliance licenses, capping the total number of full scans that may start over the life of the license, checked at scan start including restarts.
   • Supports Azure DevOps repositories for remediation automations — fix pull requests can now be opened and tracked on Azure DevOps alongside GitHub and GitLab.
   • Adds OWASP Top 10:2025OWASP Top 10:2025A ranked list of the ten most critical web application risk categories, maintained by the Open Worldwide Application Security Project, used by cyber tools to prioritize detection, testing, and remediation coverage. category to findings — settable from the overflow menu, visible in the findings table and drawer, and filterable.
   • Adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. identifier and plain-language fix recommendation to findings in the detail view, where the scan engine supplies them.

   +5 more show less

   • Adds a download button in the triage header to pull a scan's context documents — threat model, architecture notes, and uploaded files — without leaving the findings view.
   • Adds license detail and expiry warnings to organization settings on appliances — showing licensee, expiry date, days remaining, seat count, and covered products — with a 30-day-out banner and scan blocking after the grace deadline.
   • Connects self-managed GitLab instances to appliances for merge-request scanning, enabling the Reviews link, PR Review dashboard tabs, and source control settings.
   • Connects GitHub Enterprise Server to appliances via a GitHub App installation instead of a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
   • Provides a dedicated appliance onboarding flow — Welcome, Connect your code, You're all set — pre-filled for the configured Git host.

   8 more in Everything

8. September 18, 2026 Sep 18, 2026 · release notes

   Hacktron adds OWASP Top 10:2025OWASP Top 10:2025A ranked list of the ten most critical web application risk categories, maintained by the Open Worldwide Application Security Project, used by cyber tools to prioritize detection, testing, and remediation coverage. categorization, Azure DevOps remediation, Linear triage sync, and appliance scan quotas.

   • Adds the OWASP Top 10:2025 category field on findings with table/drawer display and list filtering

   1 detail in Everything

9. Separate credit accounts and more on-premises scan options Aug 19, 2026 · issue 065

   Hacktron adds separate Automation/Whitebox credit accounts, Microsoft account linking, on-prem archive uploads, air-gapped Git support, and glob author filters.

   └──▷ HOW TO FIND IT
   Run a Whitebox Scan on an air-gapped codebase by uploading a source archive directly from the on-premises deployment UI.
   📍When starting a Whitebox Scan in the on-premises deployment, choose Upload source archive and select your prepared .tar.gz (or .zip, .7z, .tgz) file containing the repository source.
   Link a Microsoft account so Azure DevOps pull request activity is attributed to the correct Hacktron member and counts toward their Code Review seat.
   📍In Hacktron, go to Personal settings › Connected accounts and select Connect Microsoft account, then sign in with the Azure DevOps identity whose UPN matches your pull request author email.
   • Glob patterns (*, **, ?, {a,b}) now accepted in repository and organization author filters, in addition to exact names, with bounded limits on pattern length, wildcard count, and brace alternatives.
   • Billing now shows separate accounts for Automation credits and Whitebox Scan Credits, each with its own balance, current-period usage, purchase flow, and history; auto top-up is available for Automation credits only.
   • On-premises deployments can now select enabled GitHub Enterprise Server repositories or upload .zip, .7z, .tar.gz, and .tgz source archives when starting a Whitebox Scan.
   • Appliance operators can allow specific private Git hosts, add trusted CA certificates, and collect masked support bundles without an outbound internet connection (air-gapped support).
   • Deleting an automation now shows a confirmation with its name, and attempting to enable an incomplete automation identifies the missing configuration.
   • Billing now shows separate accounts for Automation credits and Whitebox Scan Credits, each with its own balance, current-period usage, purchase flow, and history; auto top-up is available for Automation credits only.
   • Appliance operators can allow specific private Git hosts, add trusted CA certificates, and collect masked support bundles without an outbound internet connection (air-gapped support).

   3 more in Everything

10. August 19, 2026 Aug 19, 2026 · release notes

    Hacktron adds on-prem source archive uploads, glob author filters, and MS account linking

    • Adds *.zip, *.7z, *.tar.gz, and *.tgz upload options for Whitebox Scans in on-premises deployments
    • Extends repository and organization author filters to accept glob patterns (*, **, ?, {a,b})
    • Adds Microsoft account connection in Personal settings to link Azure DevOps identities

    3 details in Everything

11. 1.0 seen Aug 4, 2026 · issue 035

    API surface changed: 1 modified

    API change

    API surface changed: 1 modified

    • ~ GET /repos: response schema changed
    • GET /repos: response schema changed

    1 detail in Everything

12. ​Azure DevOps is here, plus bulk triage and live AI runs seen Aug 3, 2026 · issue 034

    Hacktron adds Azure DevOps integration, bulk triage workflows, and live AI-assisted runs.

    • Adds Azure DevOps integration, enabling teams to connect Hacktron findings and workflows directly with Azure DevOps projects.
    • Introduces bulk triage, allowing practitioners to triage multiple findings simultaneously.
    • Supports live AI runs, enabling real-time AI-assisted analysis during assessments.

    3 details in Everything

13. ​Walk a taint trace, export your findings, and scan Bitbucket PRs seen Aug 3, 2026 · issue 034

    Hacktron adds taint trace navigation, findings export, and Bitbucket PR scanning.

    • Walk a taint trace interactively to follow data flows from source to sink during code analysis.
    • Export your findings for reporting or downstream workflows.
    • Scan Bitbucket pull requests to surface vulnerabilities before code is merged.

    3 details in Everything

14. Azure DevOps is here, plus bulk triage and live AI runs Aug 3, 2026 · release notes

    Azure DevOps integration, bulk triage, per-run credit caps, live AI transcript, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. category filters, and glob pattern support in author filters.

    • Adds Azure DevOps PR scanning as a new integration platform, connecting via personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. to automatically review pull requests.
    • Adds bulk findings triage allowing status or severity changes for multiple selected findings across all filtered pages in one action.
    • Adds per-run credit caps (per-run credit caps) that stop automation runs cleanly when the limit is reached and allow restart from the breakpoint.
    • Adds a live automation run transcript showing the AI agent’s reasoning, tool calls, and output in real time on the run detail page.
    • Adds manual remediation runs to the main runs history list for visibility alongside scheduled automation runs.

    +5 more show less

    • Adds auto-resolution of triage threads when commands (!fp, !valid, !accepted_risk, !fixed) are posted as replies to GitHub PR or GitLab MR comments.
    • Adds OWASP category badges and a corresponding filter for the findings list.
    • Reorganizes the usage page into three tabs: PR Reviews, Automations, and Whitebox, each with separate credit breakdowns.
    • Adds support for glob patterns (*, **, ?, {a,b}) in author include and exclude filters within .hacktron/config.yaml and organization scan settings.
    • Extends GitLab and Bitbucket MR/PR reviews to draw from the same org-wide review pool as GitHub with consistent spillover billing.

    10 details in Everything

15. August 3, 2026 Aug 3, 2026 · release notes

    Hacktron August 3, 2026 adds Azure DevOps PR scanning, bulk triage, per-run credit caps, live run transcripts, and glob-pattern author filters

    • Adds Azure DevOps integration to automatically review pull requests using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.
    • Adds Glob patterns support (*, **, ?, {a,b}) to the author include/exclude filters in .hacktron/config.yaml
    • Adds per-run credit caps to automation environments with restart capability
    • Adds live AI run transcript on the run detail page to view agent reasoning and tool calls in real time
    • Adds manual remediation runs to the main runs list alongside scheduled automation runs

    +3 more show less

    • Adds auto-resolution of triage threads when posting commands (!fp, !valid, !accepted_risk, !fixed) as replies on GitHub PR or GitLab MR comments
    • Adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. category badge and filter to the findings list
    • Reorganizes usage page into three tabs: PR Reviews, Automations, and Whitebox

    8 details in Everything

16. Walk a taint trace, export your findings, and scan Bitbucket PRs Jul 15, 2026 · release notes

    Hacktron adds interactive taint traces, PR export formats/endpoints, Bitbucket scanning, and .hacktron/config.yaml filters

    └──▷ TRY IT
    Programmatically export findings for automation pipelines
    copy

    $ curl -H 'Authorization: Bearer <token>' 'https://app.hacktron.ai/rest/findings/export?format=json'

    • Adds skip.authors, include.authors and include.labels to .hacktron/config.yaml to control which pull requests get scanned
    • Integrates native scanning for Bitbucket pull requests alongside existing GitHub and GitLab support
    • Exports findings as CSV, JSON, or SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. from the UI filtered by current view
    • Adds GET /rest/findings/export endpoint to programmatically export findings with repository scoping
    • Enables line-agnostic findings to post file-level comments on GitHub PRs instead of being dropped

    5 details in Everything

17. July 15, 2026 Jul 15, 2026 · release notes

    Hacktron adds interactive taint traces, Bitbucket PR scanning, findings export API, and skip.authors config key.

    • GET /rest/findings/export endpoint for programmatic findings export in CSV, JSON, or SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. with filter support
    • Adds skip.authors, include.authors, and include.labels to .hacktron/config.yaml to control which pull requests get scanned
    • New Bitbucket workspace integration for automatic pull request scanning
    • Interactive taint trace reader allowing step-through of source, propagation, and sink steps in the annotated code view
    • Findings export directly from UI as CSV, JSON, or SARIF respecting active filters

    +3 more show less

    • Model tier selection (Default vs Legacy) when starting a whitebox scan
    • File-level comments for line-agnostic findings on GitHub pull requests
    • Mark Resolved action added to finding Work Object overflow menu in Slack

    8 details in Everything

18. June 23, 2026 Jun 23, 2026 · release notes

    Hacktron adds Context page with app-level threat models, public PR redaction, org fail-on default, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. duplicate marking.

    • Adds a Context page with Repositories and Applications tabs to view and manage repository and application threat models
    • Adds the ability to group repositories into an Application for merged threat modeling and scanning
    • Adds inline reading view with file tree and outline for editing threat models while preserving changes across regenerations
    • Redacts full titles, descriptions, proof-of-concept code, and file locations in PR review comments on public repositories
    • Adds an organization-level fail-on severity threshold default for PR/MR checks via settings

    +2 more show less

    • Adds Enterprise SSO sign-in with a dedicated SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login page and button
    • Adds the duplicate_of field to the update_finding MCP tool

    7 details in Everything

19. A new Context page for your repositories, applications, and threat models Jun 23, 2026 · release notes

    Hacktron adds Context page for repos/apps/threat models, app-level threat synthesis, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. sign-in, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. duplicate marking

    └──▷ HOW TO FIND IT
    Navigate to the new Context page to view all repositories and applications sorted by recent threat model updates.
    📍In the Hacktron console, click Context in the left sidebar.
    Configure your organization to set a default severity threshold for PR checks, allowing individual repos to override it.
    📍In Settings › Organization › PR/MR Checks, set Fail-on severity (e.g., high)
    • Adds a dedicated Context page with Repositories and Applications tabs to browse code knowledge sorted by threat-model update time
    • Gains ability to group repositories into an Application so Hacktron merges member threat models for application-level scanning and upload fold-in
    • Enables setting an org-level fail-on severity default for PR/MR checks in settings, overriding the previous per-repo-only limitation
    • Adds a dedicated SSO sign-in page and Single sign-on (SSO) button on the login screen for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication with IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. round-trip token support
    • Updates the update_finding MCP tool to accept a duplicate_of field for programmatically marking findings as duplicates

    5 details in Everything

20. Dismiss a finding and your PR check clears instantly Jun 18, 2026 · release notes

    PR checks auto-clear on triage; duplicate finding support; stacked scan volume chart.

    • GitHub/GitLab PR checks flip to passing immediately when a finding is marked as false positive or accepted risk
    • Mark findings as duplicates of another finding in the same repository with severity inheritance for gate counts
    • Dashboard scan volume widget now displays a stacked bar chart with tooltip showing Code Review and Whitebox scan counts
    • Whitebox scans from uploaded archives take the archive's filename as the scan name

    4 details in Everything

21. June 18, 2026 Jun 18, 2026 · release notes

    Hacktron adds automatic PR status sync on triage, duplicate finding support, and stacked scan volume charts

    • PR and MR checks update on triage: GitHub check or GitLab commit status flips to passing immediately when a finding is marked as false positive or accepted risk, and reverts to failing if the finding is reopened.
    • Close findings as duplicates: Mark a finding as a duplicate of another in the same repository; duplicated findings inherit their canonical finding’s severity for PR gate blocking decisions.
    • Scan volume chart: Dashboard scan volume widget switches to a stacked bar chart with tooltips showing Code Review and Whitebox scan counts per day.
    • Upload scans named after the archive: Whitebox scans initiated from uploaded archives now use the archive filename as the scan name.

    4 details in Everything

22. Control your scans and account security like never before Jun 15, 2026 · release notes

    Hacktron v2026-06 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol access, and PR exclusion rules via .hacktron/config.yaml

    • New remote MCP server endpoint enables connecting external tools to Hacktron’s finding-triage toolset via the MCP protocol with OAuth or API key authentication
    • Admins can now enforce multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFA) requirements across their organization for account security

    2 details in Everything

23. June 15, 2026 Jun 15, 2026 · release notes

    Hacktron June 2026 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. API, and .hacktron/config.yaml PR filtering.

    • api remote MCP server endpoint with OAuth and API key authentication enables external tool integration for finding triage
    • Admins can enforce Multi-factor authenticationMulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFA) across their organization via new account security controls
    • Adds .hacktron/config.yaml to exclude pull request scans based on file patterns, titles keywords, or labels

    3 details in Everything

24. GitLab now works just like GitHub Jun 11, 2026 · release notes

    Hacktron adds native GitLab integration with automatic merge-request scanning and guided setup

    • Adds support for connecting a GitLab project, enabling automatic merge-request scans similar to the existing GitHub experience.
    • Enables GitLab connection during signup or trial with a guided setup flow consistent with GitHub onboarding.

    2 details in Everything

25. June 11, 2026 Jun 11, 2026 · release notes

    Hacktron adds GitLab integration with automatic merge-request scanning and signup support

    • Adds automatic merge-request scanning for GitLab projects, mirroring existing GitHub behavior with per-project toggle capability.
    • Enables direct GitLab connection during the account signup or trial onboarding flow.

    2 details in Everything

26. Go from a Slack alert to a fix in one click Jun 10, 2026 · release notes

    Hacktron adds Fix with AI button to Slack alerts and auto-closing findings for abandoned PRs

    └──▷ HOW TO FIND IT
    Use this to quickly jump from a Slack notification directly into an IDE to resolve the issue.
    📍In Slack, click Fix with AI on any Hacktron alert.
    Ensure findings remain accessible if a PR is closed by mistake, as they move to a recoverable state.
    📍Abandon a pull request; verify findings transition to the Closed state in the dashboard.
    • Adds a Fix with AI button in Slack alerts that deep-links into Cursor or Claude editors
    • Implements automatic transition of findings to Closed state when pull requests are abandoned without merging
    • Adds cost estimation notices for repositories containing languages unsupported by the scanner

    3 details in Everything

27. June 10, 2026 Jun 10, 2026 · release notes

    Hacktron adds Fix with AI Slack deep-links, auto-close findings on PR abandonment, and unsupported-language cost warnings

    • Adds a Fix with AI button in Slack alerts that deep-links directly into Cursor or Claude to open the issue and start fixing.
    • Allows starting a free trial without entering credit card details first; payment info is only required at subscription time.
    • Automatically moves findings to a Closed state when their associated pull or merge request is abandoned/unmerged, preserving triage status upon re-open.
    • Shows up-front notices in cost estimation when a repository contains primarily languages Hacktron cannot yet scan, preventing silent failures.

    4 details in Everything

28. Scan self-hosted GitHub Enterprise Server Jun 7, 2026 · release notes

    Hacktron adds GitHub Enterprise Server support, exact tag/commit scanning, richer Jira ticketing, and improved GitLab MR feedback.

    • Adds Scan self-hosted GitHub Enterprise Server capability for white-box scans and PR reviews
    • Allows targeting an exact tag or commit during Whitebox scan repository selection
    • Enables search within large Jira projects and assignee lists when filing tickets from findings
    • Adds severity badges, collapsible proof-of-concept, trace diagrams, and a Fix with AI block to GitLab MR feedback

    4 details in Everything

29. June 7, 2026 Jun 7, 2026 · release notes

    Hacktron adds GitHub Enterprise Server support, exact commit scanning, richer Jira ticketing, and GitLab MR feedback with severity badges.

    └──▷ HOW TO FIND IT
    Trigger a white-box review of a specific pull request using the new command syntax.
    📍@hacktronai review
    • Adds GitHub Enterprise Server integration for white-box scans and PR reviews
    • Allows targeting an exact tag or commit in Whitebox scan selection
    • Enables richer Jira ticketing with large project search, assignee lookup, and finding links
    • Adds severity badges, collapsible proof-of-concept, trace diagrams, and Fix with AI block to GitLab MR feedback

    4 details in Everything

30. PR comments that fix the bug for you Jun 4, 2026 · release notes

    Hacktron PR comments now use severity badges and Fix with AI prompt to reproduce, fix, and add regression test.

    └──▷ HOW TO FIND IT
    When you spot a vulnerability in a GitHub PR comment, click the prompt to auto-fix the code.
    📍Steps: In the GitHub PR discussion, locate the Hacktron comment with the severity badge and click Fix with AI.
    • Pull-request comments now display crisp severity badges instead of emoji icons
    • Pull-request comments include a Fix with AI prompt that reproduces the issue, fixes the root cause, and adds a regression test

    2 details in Everything

31. June 4, 2026 Jun 4, 2026 · release notes

    Hacktron adds severity badges and Fix with AI prompts in GitHub PR comments

    • PR comments now use severity badges instead of emoji
    • Adds a Fix with AI prompt in PR comments that reproduces the issue, fixes the root cause, and adds a regression test

    2 details in Everything

32. Share Code Review limits across your whole org Jun 3, 2026 · release notes

    Hacktron v2026-06-03 introduces org-pooled code review limits, on-demand @hacktron review PR comments, and Usage page.

    • Code Review limits are now pooled across the whole organization instead of being capped per seat
    • New command to request an immediate PR review by commenting @hacktron review on a pull request
    • New owner-only Usage page shows usage and overage for the billing period

    3 details in Everything

33. Findings open straight into the taint trace Jun 1, 2026 · release notes

    Vulnerability views redesigned with direct taint trace access and findings history timeline

    └──▷ HOW TO FIND IT
    View the evolution of a specific finding across multiple scans via its new timeline.
    📍In the console, go to a finding's full-page view to see the Finding history timeline.
    • The full-page finding view now opens directly into the taint trace with smooth collapse animations.
    • Adds a Finding history section showing a timeline of how each finding changed from one scan to the next.

    2 details in Everything

34. June 1, 2026 Jun 1, 2026 · release notes

    Hacktron introduces redesigned vulnerability views with direct taint traces, separates Whitebox scans from PR reviews, and adds finding history timelines.

    • Redesigned vulnerability views open findings straight into the taint trace with smooth collapse animations
    • Splits Whitebox Scans and PR Reviews into distinct categories for clearer distinction between full code scans and pull-request reviews
    • Adds a finding timeline showing how each finding changed from one scan to the next

    3 details in Everything

35. A rebuilt dashboard, split by the work you do May 19, 2026 · release notes

    Hacktron introduces a rebuilt dashboard with separate tabs for Code Review, PR Review, and Whitebox Scan, plus richer Linear integration.

36. May 19, 2026 May 19, 2026 · release notes

    Hacktron adds dedicated dashboard tabs, taint-trace visualization, and deep Linear integration.

    • Adds Overview, PR Review, and Whitebox Scan tabs to the dashboard for separated metrics views.
    • Displays a step-by-step taint-trace timeline and interactive call graph showing source, propagation, and sink nodes for vulnerabilities.
    • Enhances Linear integration with default project selection, finding severity-to-priority mapping, and status mirroring.

    3 details in Everything

37. Keep reviewing past your limit instead of getting blocked May 16, 2026 · release notes

    New spillover billing feature for Hacktron organizations

    • Organization owners can switch on spillover billing so PR reviews keep running past your included limit, billed as overage instead of stopping cold.
    • This new capability introduces a mechanism where review limits no longer stop PR reviews outright; rather, they trigger overage billing.

    2 details in Everything

38. May 16, 2026 May 16, 2026 · release notes

    Hacktron adds owner-controlled spillover billing to keep PR reviews running past limits

    • Adds organization-level spillover_billing setting that allows PR reviews to continue beyond included limits and bill as overage instead of stopping

    1 detail in Everything

39. 50 PR reviews a seat, then $1 each instead of a wall May 13, 2026 · release notes

    Hacktron v50 introduces per-seat PR review limits, $1 overage billing, resubscribe flow, custom trials, and Slack invites

    • Adds 50 PR reviews a seat, then $1 each billing model so extra reviews bill at $1 each instead of stopping.
    • Adds Resubscribe button for canceled organizations to restore previous plans in one click.
    • Adds Custom trial duration allowing selectable trial lengths with usage limit prompts.
    • Adds Slack invite flow to invite teammates directly from Slack into the Hacktron organization.

    4 details in Everything

40. May 13, 2026 May 13, 2026 · release notes

    Hacktron adds per-seat PR review quotas with overage billing, one-click resubscribe, custom trials, and Slack integration.

    • Every developer seat now includes 50 PR reviews per billing period, with extra reviews billed at $1 each
    • Canceled organizations get a Resubscribe button to pick their old plan back up
    • Trials can run for a length you choose, with a clear prompt when you reach their limits
    • Invite teammates to your Hacktron organization straight from Slack

    4 details in Everything

41. Stop a scan mid-run May 4, 2026 · release notes

    Adds ability to cancel running scans mid-run from the UI and a guided setup checklist

    • Adds Cancel action in the scan view to stop a running scan immediately
    • Adds a getting-started checklist to guide new teams through connecting repositories and enabling Code Review

    2 details in Everything

42. May 4, 2026 May 4, 2026 · release notes

    May 4, 2026 release focuses on UX improvements for new users and operational control for active jobs.

    • Adds the ability to stop a scan mid-run directly from the scan view without waiting for completion.
    • Introduces a guided setup checklist in the UI to help new teams connect repositories and enable Code Review.

    2 details in Everything

43. A home for your Code Review findings Apr 23, 2026 · release notes

    Dedicated Code Review page for findings and PR comments.

44. April 23, 2026 Apr 23, 2026 · release notes

    Dedicated Code Review page for findings and PR comments

    • Enables syntax highlighting for affected code within the finding view

    1 detail in Everything

45. Drive Hacktron from your own scripts Apr 20, 2026 · release notes

    Hacktron adds Public REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for programmatic access to scans and findings, plus new Slack and Linear integrations

    • Adds public REST API to reach scans, findings, and repositories programmatically with API keys
    • Enables Slack link unfurling for finding and scan links showing live status, severity, and triage
    • Allows creating a Linear issue directly from a finding with details pre-filled

    3 details in Everything

46. April 20, 2026 Apr 20, 2026 · release notes

    Hacktron adds public REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for programmatic access to scans and findings

    • Adds public REST API with interactive docs to programmatically reach scans, findings, and repositories using API keys
    • Enables Slack link unfurling for finding and scan links showing live status, severity, and triage
    • Adds ability to create Linear issues directly from findings with pre-filled details

    3 details in Everything

47. See how a vulnerability moves through your code Apr 6, 2026 · release notes

    Hacktron adds visual trace diagrams, markdown findings, flexible pentest starts and context documents

    • Adds visual trace diagrams to the finding view and PDF reports to show how a vulnerability moves through code
    • Allows starting a pentest from a public repository URL or an uploaded archive with pre-commit cost estimates
    • Enables uploading context documents (notes about a repository) to help reviews understand codebase conventions

    3 details in Everything

48. April 6, 2026 Apr 6, 2026 · release notes

    Hacktron adds visual trace diagrams to findings, flexible pentest sources, context docs, and Markdown support

    • Adds visual trace diagrams to finding views and PDF reports to show how a vulnerability moves through code
    • Adds start-pentest source options for public repository URLs or uploaded archives with pre-commit cost estimates
    • Adds context documents upload feature for repository notes to inform review conventions
    • Enables full Markdown rendering in findings descriptions, dismiss reasons, and comments plus one-click report copy

    4 details in Everything

49. Triage findings without leaving the browser Mar 23, 2026 · release notes

    Adds in-app finding dismissal with reason and activity thread via new web UI

    • Enables triage of findings directly in the browser app with dismiss options and an activity thread

    1 detail in Everything

50. Watch findings arrive as a scan runs Mar 18, 2026 · release notes

    Hacktron adds live stream scan progress, pre-scan cost estimation, and downloadable PDF reports.

    • Adds real-time whitebox billing streaming so users can watch findings arrive as the scan runs
    • Adds pre-scan cost estimation for scans and pentests before execution begins
    • Enables direct generation of downloadable PDF reports of findings from the browser

    3 details in Everything

51. March 18, 2026 Mar 18, 2026 · release notes

    Hacktron adds live scan progress streaming, pre-scan cost estimation, and downloadable PDF reports

    • Adds live scan progress streaming so you can watch findings arrive as a scan runs
    • Enables cost estimation before starting a scan or pentest
    • Allows generating a PDF report of findings directly from the browser

    3 details in Everything

52. March 1, 2026 Mar 1, 2026 · release notes

    Hacktron introduces pentest credit purchasing for on-demand scans and public scan disclosure via read-only pages.

    └──▷ HOW TO FIND IT
    Share scan results externally with stakeholders who need read-only access.
    📍Share a scan and its findings through public, read-only pages.
    • Adds the ability to buy pentest credits and spend them on pentests
    • Adds support for sharing a scan and its findings through public, read-only pages

    2 details in Everything