StackHawk

No entries match these filters. Clear filters

1. changelog Oct 16, 2026 · issue 110

   StackHawk: Adds Windows CLI installers: irm https://download.stackhawk.com/hawk/install.ps1 | iex for PowerShell, installing to %USERPROFILE%\.hawk\bin.

   └──▷ USE IT
   Pin or disable automatic base-path detection for an OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec that declares a conflicting or unwanted servers[] entry.
   stackhawk.yml copy

   app:
     openApiConf:
       basePath: /api/v2
       # or, to keep pre-6.6.0 behavior:
       # disableServerBasePath: true

   Install the HawkScan CLI on a Windows CI runner in a single PowerShell line.
   copy

   $ irm https://download.stackhawk.com/hawk/install.ps1 | iex

   • HawkScan now reads the declared servers[] base path (or basePath in Swagger 2.0) from an OpenAPI spec and automatically prefixes every operation request, so specs no longer return empty scans when the base path is not duplicated in app.url.
   • Removes the default per-rule alert cap so every matching alert is reported; existing scanner.maxAlertsPerRule / pscans.maxAlertsPerRule values set via hawk.config continue to apply.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !An unresolved ${VARIABLE} placeholder in configuration now stops the scan with Missing environment variable: VARIABLE instead of silently substituting an empty string. Pipelines that intentionally left a variable unset must either set it or use the ${VARIABLE:} (trailing-colon) form.
   • !Authorization alpha rules 40051, 40054, 40055, and 40056 have been removed; any configuration or workflow that relied on these single-identity rules will no longer produce results from them.
2. docs update Oct 15, 2026 · issue 109

   HawkScan 6.6.0 adds app.openApiConf.basePath and disableServerBasePath config keys to control OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. base path resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Override the base path when your spec's servers block can't express it or you can't edit the spec.
   stackhawk.yml copy

   # stackhawk.yml
   app:
     host: http://localhost:8000
     openApiConf:
       basePath: /api/v2

   Scan an API served at the host root even though the spec declares a base path, preventing HawkScan from prepending it.
   stackhawk.yml copy

   # stackhawk.yml
   app:
     host: http://localhost:8000
     openApiConf:
       disableServerBasePath: true

   • Adds app.openApiConf.basePath to stackhawk.yml to explicitly set the API base path HawkScan uses when requesting operations, taking precedence over the host path and spec's servers[].url.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds disableServerBasePath to stackhawk.yml to force HawkScan to request all operations at the root of app.host, even when the spec declares a base path in servers[].url.
   • Adds a defined priority order for base path resolution in HawkScan 6.6.0+: app.openApiConf.basePath → path on app.host → spec's servers[].url → root of app.host.

   3 details in Everything

3. docs update Oct 15, 2026 · issue 109

   StackHawk: Unresolved ${VARIABLE} references in config now fail the scan with Missing environment variable: VARIABLE; use ${VARIABLE:} to allow empty values.

   └──▷ TRY IT
   Upload HawkScan results to GitHub Advanced Security without silent validation failures — use --sarif-ghas to produce the GitHub-compatible file alongside your existing artifact.
   copy

   $ hawk scan --sarif-artifact --sarif-ghas
   # Then in your GitHub Actions workflow:
   - uses: github/codeql-action/upload-sarif@v3
     with:
       sarif_file: stackhawk-ghas.sarif

   Fix an OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. scan that returns empty results because the spec declares a base path but your app.host does not include it — let HawkScan read the path from servers[] automatically, or override it explicitly.
   stackhawk.yml copy

   app:
     host: https://api.example.com
     openApiConf:
       filePath: openapi.yaml
       basePath: /v2

   Install HawkScan on a Windows CI runner in PowerShell without manually managing binaries — the script verifies the SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checksum before installing.
   copy

   $ irm https://download.stackhawk.com/hawk/install.ps1 | iex

   • The ajax spider now loads each seed path in a browser after the start page, capturing and testing XHR calls and other requests made on load — not just adding routes to the site tree.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !An unresolved ${VARIABLE} in configuration that previously silently became an empty string now fails the scan with Missing environment variable: VARIABLE. Pipelines that intentionally left a variable unset must either set it or change the reference to ${VARIABLE:} (with trailing colon).
   • !Alpha authorization rules 40051, 40054, 40055, and 40056 have been removed. Configurations or workflows relying on these rules will no longer produce results from them.
4. updated seen Oct 15, 2026 · issue 109

   HawkScan 6.6.0 adds GitHub-ready SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, Windows CLI installer, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. base-path awareness, and ajax spider seed-path support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Pipe GitHub-accepted SARIF findings directly into Advanced Security code scanning without GitHub silently dropping results due to URL-style locations.
   copy

   $ hawk scan --sarif-ghas stackhawk.yml

   Enable mid-scan session verification for authenticated scans so HawkScan re-authenticates automatically when the session lapses, reducing missed findings on long scans.
   stackhawk.yml copy

   app:
     authentication:
       sessionVerification:
         pollFrequency: 15
         activeScanPollFrequency: 5
         maxUnauthenticatedRequestPercent: 5

   Pin the hawk CLI version in a reproducible CI pipeline on Windows using the new PowerShell installer.
   copy

   $ $env:HAWK_INSTALL_VERSION='6.6.0'; $env:HAWK_INSTALL_DIR='C:\tools\hawk'; irm https://download.stackhawk.com/hawk/install.ps1 | iex

   • Adds --sarif-ghas flag (SARIF_GHAS env var) that writes stackhawk-ghas.sarif — a SARIF file accepted by GitHub Advanced Security code scanning, with rule IDs keyed by plugin ID, relative request-path locations, and stable fingerprints; upload with github/codeql-action/upload-sarif.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds app.openApiConf.basePath to set the OpenAPI base path explicitly and app.openApiConf.disableServerBasePath: true to suppress automatic base-path detection from servers[] (Swagger 2.0 basePath), preserving prior behavior.
   • Adds official hawk CLI installers: on Windows, run irm https://download.stackhawk.com/hawk/install.ps1 | iex in PowerShell or use https://download.stackhawk.com/hawk/install.bat in cmd.exe; on Linux/macOS, run curl -sSf https://download.stackhawk.com/hawk/install.sh | sh with OS/architecture detection; all support HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR env vars for pinning version and install location (default %USERPROFILE%\.hawk\bin on Windows, ~/.hawk/bin on Linux/macOS), and verify SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. before installing.
   • The ajax spider now visits each path listed in hawk.spider.seedPaths, loading them in its browser after the start page so XHR and on-load requests are captured and tested.
   • Removes the per-rule alert cap: scanner.maxAlertsPerRule and pscans.maxAlertsPerRule in hawk.config still apply when set, but the default cap is now off so large applications report all findings.

   +3 more show less

   • Scan-engine traffic to the StackHawk platform (result upload, asset download, token refresh) now routes through the hawk CLI's outbound proxy and trusted-certificate settings, fixing silent upload failures behind corporate proxies.
   • Adds app.authentication.sessionVerification config block to poll authentication.testPath mid-scan and re-authenticate when the session lapses, tunable via pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); disabled: true turns it off explicitly.
   • Adds clear error messages and non-zero exit when the platform rejects a scan for an out-of-support CLI version, naming the minimum supported version and upgrade URL.
   • Adds --sarif-ghas flag (SARIF_GHAS env var) that writes stackhawk-ghas.sarif — a SARIF file accepted by GitHub Advanced Security code scanning, with rule IDs keyed by plugin ID, relative request-path locations, and stable fingerprints; upload with github/codeql-action/upload-sarif.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds official hawk CLI installers: on Windows, run irm https://download.stackhawk.com/hawk/install.ps1 | iex in PowerShell or use https://download.stackhawk.com/hawk/install.bat in cmd.exe; on Linux/macOS, run curl -sSf https://download.stackhawk.com/hawk/install.sh | sh with OS/architecture detection; all support HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR env vars for pinning version and install location (default %USERPROFILE%\.hawk\bin on Windows, ~/.hawk/bin on Linux/macOS), and verify SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. before installing.
   • Adds app.authentication.sessionVerification config block to poll authentication.testPath mid-scan and re-authenticate when the session lapses, tunable via pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); disabled: true turns it off explicitly.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !An unresolved ${VARIABLE} in scan configuration now stops the scan with an error instead of silently using an empty value; pipelines that relied on an unset variable being treated as empty must either set the variable or change the reference to ${VARIABLE:}.
5. docs update Oct 6, 2026 · issue 096

   StackHawk adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with.) / client-certificate support, configured via hawk.config and combinable with any auth type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

6. docs update Oct 6, 2026 · issue 096

   HawkScan gains mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with.) support via PKCS#12PKCS#12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file. client certificates configured with three new scan-engine override keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Scan an mTLS-protected application by supplying a PKCS#12 client certificate — keep the password out of the config file via an environment variable.
   stackhawk.yml copy

   network.clientCertificates.use=true
   network.clientCertificates.pkcs12.file=/path/to/bundle.p12
   network.clientCertificates.pkcs12.password=${MTLS_CERT_PASSWORD}

   Convert separate PEM certificate and key files into the PKCS#12 bundle that HawkScan requires before running the scan.
   copy

   $ openssl pkcs12 -export -inkey private.key -in cert.crt -certfile chain.pem -name "my-cert" -out bundle.p12

   • Adds network.clientCertificates.use, network.clientCertificates.pkcs12.file, and network.clientCertificates.pkcs12.password scan-engine override keys to present a PKCS#12 (.p12/.pfx) client certificate during the TLS handshake, enabling HawkScan to scan applications that require mutual TLS (mTLS).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

7. changelog Sep 26, 2026 · issue 086

   StackHawk: Adds disabled: true field inside app.authentication.sessionVerification to explicitly turn off session verification while still requiring a loggedInIndicator/loggedOutIndicator as a fallback check.

   └──▷ USE IT
   Enable mid-scan session verification so HawkScan re-authenticates automatically if it drifts into an unauthenticated state during an active attack, keeping finding coverage high.
   stackhawk.yml copy

   app:
     authentication:
       sessionVerification:
         pollFrequency: 20
         activeScanPollFrequency: 3
         maxUnauthenticatedRequestPercent: 5

   Pin a specific HawkScan CLI version in CI so the pipeline is reproducible, and install it to a project-local directory instead of the user home.
   copy

   $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=./bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

   • Reports a clear, non-zero-exit error — including the minimum supported version and upgrade location — when the platform rejects a scan due to an out-of-support CLI version, and logs deprecation advisories once per scan instead of on every platform call.
   • Entity and transport headers — Content-Type, Content-Length, Accept, Accept-Encoding, Host, User-Agent, Referer — are no longer stripped from replayed spider requests during rescans, even when listed in authentication.testPath.requestHeaders or app.redact.headers.

   2 more in Everything

8. changelog Sep 25, 2026 · issue 085

   HawkScan 6.5.0 adds mid-scan session verification, org-wide secret resolution, and a one-line CLI installer with version pinning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Enable mid-scan session re-authentication so HawkScan detects and recovers from logout during an active scan, tightening the check cadence during attack phases.
   stackhawk.yml copy

   app:
     authentication:
       sessionVerification:
         pollFrequency: 20
         activeScanPollFrequency: 3
         maxUnauthenticatedRequestPercent: 5

   Pin the CLI installer to a specific version in CI so the pipeline is reproducible and does not silently pick up a newer release.
   copy

   $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/usr/local/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

   • Adds app.authentication.sessionVerification config block to re-check authentication mid-scan by polling authentication.testPath, with tunable pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); a scan that spent too much time logged out finishes with a coverage warning instead of a quietly thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR environment variables to the one-line curl -sSf https://download.stackhawk.com/hawk/install.sh | sh installer, with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. verification against the published manifest; HAWK_INSTALL_DIR defaults to ~/.hawk/bin.
   • Fixes hawk op app tech-flags set so naming one technology flag no longer silently re-enables all other 34 flags; the command now reads current flags, merges the requested change, and writes the result.
   • Adds app.authentication.sessionVerification config block to re-check authentication mid-scan by polling authentication.testPath, with tunable pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); a scan that spent too much time logged out finishes with a coverage warning instead of a quietly thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR environment variables to the one-line curl -sSf https://download.stackhawk.com/hawk/install.sh | sh installer, with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. verification against the published manifest; HAWK_INSTALL_DIR defaults to ~/.hawk/bin.

   1 more in Everything

9. changelog Sep 24, 2026 · issue 084
   └──▷ USE IT
   Enable mid-scan session verification in a CI pipeline to catch and recover from authentication timeouts automatically, with tighter re-auth during active attack phases.
   stackhawk.yml copy

   app:
     authentication:
       sessionVerification:
         pollFrequency: 20
         activeScanPollFrequency: 3
         maxUnauthenticatedRequestPercent: 5

   Install the StackHawk CLI in CI with a pinned version for reproducible pipelines, landing the binary in a project-local directory.
   copy

   $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=./bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

10. changelog Sep 23, 2026 · issue 083

    StackHawk: Fixes hawk op app tech-flags set so naming one technology flag no longer silently re-enables all other 34 flags; the command now reads current flags, merges the change, and writes only the result.

    └──▷ USE IT
    Enable mid-scan session verification for an authenticated scan so HawkScan re-authenticates automatically if it drifts logged out, catching missed findings during active attack phases.
    stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          pollFrequency: 20
          activeScanPollFrequency: 3
          maxUnauthenticatedRequestPercent: 5

    Pin the HawkScan CLI to a specific version in CI so pipeline installs are reproducible and unaffected by new releases.
    copy

    $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/usr/local/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

    • Emits the platform's own message — including minimum supported version and upgrade location — and exits non-zero when a scan is declined because the CLI is out of support; logs deprecation advisories once per scan rather than on every platform call.

    1 more in Everything

11. docs update Sep 23, 2026 · issue 083

    StackHawk docs clarify session-verification config, add basePath and disableServerBasePath OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. options⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan an API served at the root of your host even though the OpenAPI spec declares a base path in servers[].url — use basePath and disableServerBasePath together to override both the spec and any path on the host URL.
    .stackhawk.yml copy

    app:
      host: http://localhost:8000
      openApiConf:
        basePath: /api/v2
        disableServerBasePath: true

    Detect short session-loss bursts during an authenticated scan without waiting for the scan-wide unauthenticated percentage to look unhealthy.
    .stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          maxConsecutiveUnauthenticatedChecks: 3

    Disable session-verification polling for an app that gives false positives, and fall back to per-request loggedInIndicator regex matching instead.
    .stackhawk.yml copy

    app:
      authentication:
        loggedInIndicator: 'Welcome, '
        sessionVerification:
          disabled: true

    • Adds basePath under app.openApiConf to prepend a base path to every operation discovered in an OpenAPI specification, taking precedence over both a path on app.host and servers[].url in the spec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds disableServerBasePath under app.openApiConf to suppress the base path declared in the specification's servers[].url when the API is served at the root of app.host.
    • Adds maxConsecutiveUnauthenticatedChecks to the session-verification block to flag suspect authenticated coverage when a burst of consecutive failed session checks occurs, catching gaps that a scan-wide average would miss.
    • Adds disabled: true to the session-verification block to explicitly turn off session verification and fall back to app.authentication.loggedInIndicator / loggedOutIndicator regex matching.
    • Clarifies that app.authentication.loggedInIndicator and loggedOutIndicator are NOT deprecated — they remain the only per-request session check when session verification is absent or disabled, and at least one is required in that mode.

    +1 more show less

    • Documents the session-verification block as off-by-default: providing the block (even empty) enables periodic re-authentication polling; omitting it requires a loggedInIndicator or loggedOutIndicator instead.
    • Adds basePath under app.openApiConf to prepend a base path to every operation discovered in an OpenAPI specification, taking precedence over both a path on app.host and servers[].url in the spec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds disableServerBasePath under app.openApiConf to suppress the base path declared in the specification's servers[].url when the API is served at the root of app.host.

    4 more in Everything

12. docs update Sep 23, 2026 · issue 083

    StackHawk: Supports ${VARIABLE} references in scan configuration resolving against organization-wide secrets, so a team shares one credential copy instead of one per engineer; personal secrets take precedence and HawkScan warns on collision or unresolvable names.

    └──▷ USE IT
    Enable mid-scan session verification for an app that uses form login, so HawkScan re-authenticates automatically if it drifts logged-out during a long active scan.
    stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          pollFrequency: 20
          activeScanPollFrequency: 3
          maxUnauthenticatedRequestPercent: 5

    • Entity and transport headers (Content-Type, Content-Length, Accept, Accept-Encoding, Host, User-Agent, Referer) are no longer stripped from replayed spider requests during rescans, even when listed in authentication.testPath.requestHeaders or app.redact.headers.

    1 more in Everything

13. updated seen Sep 23, 2026 · issue 083

    StackHawk: Adds support for installing the hawk CLI via curl -sSf https://download.stackhawk.com/hawk/install.sh | sh, with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. verification against the published manifest; supports HAWK_INSTALL_VERSION to pin a release and HAWK_INSTALL_DIR to control the install destination (default ~/.hawk/bin).

    └──▷ USE IT
    Enable mid-scan session re-authentication to catch missed findings caused by the scanner going unauthenticated mid-attack phase.
    stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          pollFrequency: 20
          activeScanPollFrequency: 3
          maxUnauthenticatedRequestPercent: 2

    Pin the hawk CLI to a specific version in CI to keep pipelines reproducible.
    copy

    $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/usr/local/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

    • Adds resolution of ${VARIABLE} references in scan configuration against organization-wide secrets, so a team can share one copy of a scan credential; personal secrets take precedence and HawkScan warns when both exist, and names any unresolvable variable explicitly.

    1 more in Everything

14. docs update Sep 22, 2026 · issue 082

    StackHawk adds opt-in sessionVerification block to re-authenticate mid-scan and warn when session coverage drops.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable mid-scan session re-authentication so HawkScan detects and recovers from dropped sessions during active attack phases, with a warning if more than 10% of checks are unauthenticated.
    stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          pollFrequency: 50
          activeScanPollFrequency: 10
          maxUnauthenticatedRequestPercent: 10
          disabled: false

    • Adds sessionVerification block under app.authentication in stackhawk.yml with pollFrequency, activeScanPollFrequency, maxUnauthenticatedRequestPercent, and disabled fields to actively re-check and re-authenticate sessions during scans rather than relying on passive response indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds maxUnauthenticatedRequestPercent threshold that triggers a coverage warning at scan completion when too many mid-scan session checks fail, surfacing scans that silently ran as an anonymous user.
    • Supports both HTTP testPath and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. testPath.grpcTestMethod styles for mid-scan session verification checks, with testPath.type values HEADER and BODY honored.
    • Adds sessionVerification block under app.authentication in stackhawk.yml with pollFrequency, activeScanPollFrequency, maxUnauthenticatedRequestPercent, and disabled fields to actively re-check and re-authenticate sessions during scans rather than relying on passive response indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds maxUnauthenticatedRequestPercent threshold that triggers a coverage warning at scan completion when too many mid-scan session checks fail, surfacing scans that silently ran as an anonymous user.

    1 more in Everything

15. docs update Sep 22, 2026 · issue 082

    StackHawk: Entity and transport headers — Content-Type, Content-Length, Accept, Accept-Encoding, Host, User-Agent, Referer — are no longer stripped from replayed requests during rescans, preventing spurious 415 responses from masking unresolved findings.

    └──▷ USE IT
    Enable mid-scan session verification for an API scan that frequently loses its authenticated state during active scanning.
    stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          pollFrequency: 20
          activeScanPollFrequency: 3
          maxUnauthenticatedRequestPercent: 5

    Pin the HawkScan CLI to a specific version in CI for a reproducible pipeline, installing to a custom directory.
    copy

    $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/opt/hawk/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

16. updated seen Sep 22, 2026 · issue 082

    HawkScan 6.5.0 adds mid-scan session verification, org-wide secrets, and a one-line CLI installer with version pinning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pin the hawk CLI to a specific version in CI so your pipeline stays reproducible and does not break when a new release drops.
    copy

    $ HAWK_INSTALL_VERSION=6.5.0 HAWK_INSTALL_DIR=/usr/local/bin curl -sSf https://download.stackhawk.com/hawk/install.sh | sh

    Enable mid-scan session re-authentication so unauthenticated drift during an active attack scan is caught and corrected automatically, with tighter polling during active scanning.
    stackhawk.yml copy

    app:
      authentication:
        sessionVerification:
          pollFrequency: 20
          activeScanPollFrequency: 3
          maxUnauthenticatedRequestPercent: 5

    • Adds app.authentication.sessionVerification config block to re-check and re-authenticate sessions mid-scan by polling authentication.testPath, with tunable pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); a scan that spent too much time logged out now finishes with a coverage warning instead of a silently thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds disabled: true field inside app.authentication.sessionVerification to explicitly turn off session verification while still requiring an indicator-based check.
    • Adds a one-line installer script at curl -sSf https://download.stackhawk.com/hawk/install.sh | sh that detects OS and architecture, verifies SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. against the published manifest, and supports HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR environment variables (default install location ~/.hawk/bin).
    • Adds HAWK_INSTALL_VERSION environment variable to pin the hawk CLI version during install — recommended for reproducible CI pipelines.
    • Adds HAWK_INSTALL_DIR environment variable to control where the hawk binary is installed (default ~/.hawk/bin).

    +2 more show less

    • Adds organization-level secret resolution so ${VARIABLE} references in scan configuration now resolve against org-shared secrets, not only per-user secrets; personal secrets still take precedence, and unresolved names now emit a named warning instead of silently resolving to an empty value.
    • Adds clear error messaging when the HawkScan CLI version is below the platform-enforced minimum, reporting the minimum supported version, upgrade location, and exiting non-zero instead of emitting a generic HTTP error; deprecated-but-not-blocked versions log an advisory once per scan rather than on every platform call.
    • Adds app.authentication.sessionVerification config block to re-check and re-authenticate sessions mid-scan by polling authentication.testPath, with tunable pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); a scan that spent too much time logged out now finishes with a coverage warning instead of a silently thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds disabled: true field inside app.authentication.sessionVerification to explicitly turn off session verification while still requiring an indicator-based check.
    • Adds a one-line installer script at curl -sSf https://download.stackhawk.com/hawk/install.sh | sh that detects OS and architecture, verifies SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. against the published manifest, and supports HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR environment variables (default install location ~/.hawk/bin).
    • Adds HAWK_INSTALL_VERSION environment variable to pin the hawk CLI version during install — recommended for reproducible CI pipelines.
    • Adds HAWK_INSTALL_DIR environment variable to control where the hawk binary is installed (default ~/.hawk/bin).

    2 more in Everything

17. 0.0.1 Sep 14, 2026 · issue 074

    API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • ~ GET /api/v1/org/{orgId}/audit: response schema changed
    • ~ GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added
    • GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

18. 0.0.1 Sep 11, 2026 · issue 071

    API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • ~ GET /api/v1/org/{orgId}/audit: response schema changed
    • ~ GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added
    • GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

19. updated seen Sep 7, 2026 · issue 067

    StackHawk adds native OS certificate trust for transparent TLS proxies and a non-interactive browser auth flow for hawk init.

    └──▷ TRY IT
    Authenticate in a CI pipeline or headless environment where TTY prompts would hang — the browser opens automatically for device-flow login.
    copy

    $ hawk init --browser

    • Adds native OS certificate trust store support so Zscaler, Netskope, and corporate CA proxies work with zero configuration; disable with --no-native-truststore or USE_NATIVE_TRUSTSTORE=false.
    • Adds --browser flag to hawk init for non-interactive device-flow authentication, skipping TTY prompts and the manual key-entry menu.
    • Adds native OS certificate trust store support so Zscaler, Netskope, and corporate CA proxies work with zero configuration; disable with --no-native-truststore or USE_NATIVE_TRUSTSTORE=false.

    1 more in Everything

20. changelog Aug 23, 2026 · issue 054

    StackHawk 6.4.0 adds multi-profile scan mode control, a new auth-bypass scan rule, and team ownership management for applications.

    └──▷ TRY IT
    Run a full policy scan against your primary profile while still covering all other profiles with BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data./BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions. checks — useful when you have multiple authenticated identities but want deep scanning on your main user.
    copy

    $ hawk scan --profile-scan-mode primary-full --full-scan-profile admin-user stackhawk.yml

    Run your full scan policy against every authentication profile — useful for comprehensive coverage across all user roles at the cost of longer scan time.
    copy

    $ hawk scan --profile-scan-mode all-full stackhawk.yml

    Re-confirm application-to-Team assignments via the API after the fix to PUT /api/v1/org/{orgId}/team/{teamId}/application — previously these calls returned success without saving.
    copy

    $ curl -X PUT https://api.stackhawk.com/api/v1/org/{orgId}/team/{teamId}/application   -H 'Authorization: Bearer <token>'   -H 'Content-Type: application/json'   -d '{"applicationId": "<appId>"}'

    • Adds PUT /api/v1/org/{orgId}/team/{teamId}/application endpoint behavior correction — Team assignments made through the API now persist correctly; previously the endpoint returned success without saving.
    • Applications table now shows Team ownership for each application and supports inline reassignment; applications without a Team are labeled Unassigned.
    • Team ownership field is also available in Application Settings > General, with Unassigned at the top of the list.
    • Members and View Only users can now view Teams pages: Members can open Teams they belong to, View Only users can review every Team in the organization.
    • Team management controls (Create a Team, Add Members, Add Applications, rename, Delete) now appear as disabled rather than hidden for users without permission.

    +1 more show less

    • Users who cannot manage Teams and belong to at least one Team must now assign a newly created application to one of their Teams in the Create Application flow.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hawk validate config previously exited 0 even on hard validation errors and missing configuration files; it now exits non-zero on those conditions. CI pipelines relying on the always-zero exit behavior (e.g., hawk validate config stackhawk.yml && ./deploy.sh) will now correctly fail when the configuration is invalid.
21. docs update Aug 21, 2026 · issue 052

    StackHawk 6.4.0 adds multi-profile scan mode control, an HTTP header auth-bypass scan rule, and fixes hawk validate exit codes.

    └──▷ TRY IT
    Run a full policy scan against your primary auth profile while still running BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data./BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions. against all other profiles, to get deep coverage without multiplying scan time.
    copy

    $ hawk scan --profile-scan-mode primary-full --full-scan-profile admin-user stackhawk.yml

    Configure external authentication credentials to suppress spurious re-auth attempts and misleading log lines during BOLA/BFLA testing.
    stackhawk.yml copy

    app:
      authentication:
        external:
          loggedInIndicator: ".*"
          loggedOutIndicator: "$^"
          testPath: /api/v1/me

    • Adds --profile-scan-mode flag (env: PROFILE_SCAN_MODE) to control plugin coverage across authentication profiles: business-logic (default, BOLA/BFLA only), primary-full (full policy on one profile, BOLA/BFLA on the rest), or all-full (full policy on every profile).
    • Adds --full-scan-profile flag (env: FULL_SCAN_PROFILE) to designate which profile receives the full scan policy when using --profile-scan-mode primary-full; defaults to the first profile declared in configuration.
    • Multi-profile scan findings now carry a [profile=<name>] prefix on their evidence to identify which identity a vulnerability was discovered under.
    • Adds active scan rule plugin 40059 (HTTP Header Authentication Bypass) that tests whether authentication can be bypassed via injected headers such as X-Forwarded-For, X-Original-URL, and X-Rewrite-URL; disabled by default, enabled through policy management.
    • Adds hawk config show app.authentication.external guidance recommending loggedInIndicator: '.*' and loggedOutIndicator: '$^' to prevent spurious re-authentication attempts with external credentials.

    +1 more show less

    • Oracle time-based SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection (plugin 40021) now uses dose-response confirmation rather than a single delayed response, improving accuracy.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hawk validate previously exited 0 even on hard validation errors and missing configuration files; it now exits non-zero in those cases, which will cause pipelines relying on the old always-zero behavior to correctly fail on a broken configuration.
22. updated seen Aug 21, 2026 · issue 052

    HawkScan 6.4.0 adds multi-profile scan mode control, a new auth-bypass scan rule, and improved CI validation exit codes.

    └──▷ TRY IT
    Run a full policy scan against your primary profile and BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data./BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions.-only against all others during multi-profile testing.
    copy

    $ hawk scan --profile-scan-mode primary-full --full-scan-profile admin stackhawk.yml

    Gate a deployment on a valid StackHawk config — the pipeline now stops on a broken configuration instead of silently continuing.
    copy

    $ hawk validate config stackhawk.yml && ./deploy.sh

    • Adds --profile-scan-mode flag (env: PROFILE_SCAN_MODE) with three modes — business-logic (default), primary-full, and all-full — giving explicit control over whether full scan policy runs against one or all authentication profiles in multi-profile scans.
    • Adds --full-scan-profile flag (env: FULL_SCAN_PROFILE) to designate which profile receives the full policy when using primary-full mode; defaults to the first profile declared in configuration.
    • New active scan rule (plugin 40059) tests HTTP Header Authentication Bypass by injecting headers such as X-Forwarded-For, X-Original-URL, and X-Rewrite-URL; off by default, enabled via policy management.
    • Findings from multi-profile scans now carry a [profile=<name>] prefix on their evidence, identifying which identity a vulnerability was discovered under.
    • hawk validate config now exits non-zero on hard validation errors and missing configuration files, making it usable as a real CI gate; warnings (unknown-property, lint) continue to exit 0.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hawk validate config previously exited 0 even on hard validation errors; it now exits non-zero for hard errors and missing configuration files. Pipelines relying on the always-zero exit code will now correctly fail on a broken configuration.
23. 0.0.1 Aug 20, 2026 · issue 051

    API surface changed: +2 endpoints

    API change

    API surface changed: +2 endpoints

    • + GET /api/v1/org/{orgId}/teams/available/applications
    • + GET /api/v1/org/{orgId}/teams/available/users
    • New endpoint GET /api/v1/org/{orgId}/teams/available/applications
    • New endpoint GET /api/v1/org/{orgId}/teams/available/users

    2 details in Everything

24. docs update Aug 19, 2026 · issue 051

    StackHawk's wingman plugin for GitHub Copilot bundles hawkscan, stackhawk-api, data-seed, and optimize skills in a single install.

    └──▷ TRY IT
    Install the full StackHawk skill set for GitHub Copilot, then add the CI scanning skill separately.
    copy

    $ copilot plugin install wingman@stackhawk
    copilot plugin install hawkscan-ci@stackhawk

    • Introduces wingman, a StackHawk umbrella plugin for GitHub Copilot that bundles four skills — hawkscan, stackhawk-api, data-seed, and optimize — in one install, since Copilot has no plugin-dependency resolution mechanism.
    • Adds separate hawkscan-ci skill installable via copilot plugin install hawkscan-ci@stackhawk for CI-focused scanning scenarios.
    • Plugins installed via copilot plugin install are stored in ~/.copilot/installed-plugins/ and are available across all projects.
    • Supports configuring additional project-skill directories via the chat.agentSkillsLocations setting.
    • The same marketplace catalog now serves GitHub Copilot, Claude Code, and Codex.

    5 details in Everything

25. docs update Aug 19, 2026 · issue 051

    StackHawk adds in-place Application Team ownership management, broader Team visibility for Members and View Only users, and a required Team assignment when creating applications.

    • Adds a Team ownership column to the Applications table, letting users change a Team assignment in place; applications without a Team are marked Unassigned and can be assigned by selecting the label and searching for a Team.
    • Adds a Team field in Application Settings > General (with Unassigned at the top) so clearing or changing ownership works uniformly alongside the table view.
    • Moving an application between Teams no longer requires removing it from its current Team first.
    • Members can now open Teams they belong to; View Only users can review every Team in the organization without needing permission to manage Teams.
    • Team management controls (Create a Team, Add Members, Add Applications, rename, Delete Team) are now shown as disabled for users without manage permissions, rather than hidden entirely.

    +2 more show less

    • In the Create Application flow, users who cannot manage Teams and who belong to at least one Team must now assign the new application to one of their Teams.
    • The Filter by Unassigned Applications checkbox on the Applications page now returns results for Members and View Only users.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !PUT /api/v1/org/{orgId}/team/{teamId}/application previously returned a success response without saving the Team assignment; it now saves correctly. Any application-to-Team assignments made through that endpoint must be re-run to confirm they are actually in place.
26. updated seen Aug 19, 2026 · issue 051

    StackHawk adds inline Team ownership for applications, Team visibility for Members and View Only users, and required Team assignment on app creation.

    • Adds a Team ownership column to the Applications table, letting users change a Team assignment in place; applications without a Team are marked Unassigned and can be searched and assigned from the same row.
    • Adds a Team field to Application Settings > General, with Unassigned at the top so clearing ownership works the same way as changing it.
    • Enables Members to view the Teams they belong to, and View Only users to review every Team in the organization, without requiring Team management permissions.
    • Makes Team management controls (Create a Team, Add Members, Add Applications, rename, Delete Team) visible-but-disabled for users without manage permissions, rather than hidden.
    • Requires users who cannot manage Teams and belong to at least one Team to assign a new application to one of their Teams during the Create Application flow.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The PUT /api/v1/org/{orgId}/team/{teamId}/application endpoint previously returned a success response without saving the Team assignment; assignments made through this endpoint were silently dropped and must be re-submitted to take effect.
27. August 19th, 2026 Aug 19, 2026 · release notes

    StackHawk HawkScan 6.4.0 adds --profile-scan-mode for multi-profile scanning control and HTTP Header Auth Bypass detection rule.

    • Adds --profile-scan-mode flag to hawk scan to control plugin coverage across authentication profiles
    • Adds --full-scan-profile flag to hawk scan (with PROFILE_SCAN_MODE=primary-full) to select which profile receives the full scan policy
    • Adds new active scan rule (plugin 40059) for HTTP Header Authentication Bypass via headers like X-Forwarded-For
    • Improves hawk validate config to exit non-zero on validation failures, enabling reliable CI gates

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hawk validate config now exits with a non-zero status code when configuration validation fails, potentially breaking existing CI pipelines that relied on the previous always-success exit code.
28. August 18th, 2026 Aug 18, 2026 · release notes

    StackHawk adds application team ownership controls and visibility for Members and View Only users

    └──▷ HOW TO FIND IT
    Use the UI to view which teams exist and their members
    📍Navigate to the Teams page as a View Only user to review all organization teams
    Filter the Applications table to see only unowned applications
    📍Check the Filter by Unassigned Applications checkbox on the Applications page
    • Added Application Team Ownership support in the Applications table and Settings allowing in-place assignment and search of owning Teams
    • Added Team Visibility for Members (to their teams) and View Only users (to all org teams) with disabled controls for unprivileged actions

    2 details in Everything

29. 0.0.1 Aug 8, 2026 · issue 039

    API surface changed: 1 modified

    API change

    API surface changed: 1 modified

    • ~ GET /api/v1/org/{orgId}/audit: response schema changed
    • GET /api/v1/org/{orgId}/audit: response schema changed

    1 detail in Everything

30. docs update Aug 8, 2026 · issue 039

    StackHawk adds hawk.scan.crashDetection to abort or warn when a scan target crashes mid-scan.

    └──▷ USE IT
    Abort a scan immediately when the target goes down, using a tighter failure threshold than the default to catch crashes faster.
    yaml copy

    hawk:
      scan:
        crashDetection:
          maxTimeouts: 10
          action: ABORT

    • Adds hawk.scan.crashDetection config block to detect and react when a target application crashes or becomes unresponsive during a scan — using a passive count of timeouts and connection failures to trigger an active liveness probe before taking action.
    • Adds hawk.scan.crashDetection.maxTimeouts to set the threshold of new timeouts + connection failures that triggers a liveness probe; defaults to 5 x concurrentRequests when unset or zero.
    • Adds hawk.scan.crashDetection.action to control what happens once the liveness probe confirms the target is down — supports ABORT, WARN, or DISABLED, defaulting to ABORT.

    3 details in Everything

31. docs update Aug 8, 2026 · issue 039

    StackHawk 6.3.0: faster rescans, crash detection, seedPaths validation, and unified CLI auth

    • hawk rescan now replays the exact requests that produced findings — fetched from the platform — instead of re-crawling the app, making rescans substantially faster and scoped only to the findings being verified; falls back to normal spider automatically if replay cannot run.
    • Adds hawk.scan.crashDetection configuration to detect a crashed or unresponsive target mid-scan: set action to ABORT (default, fails with scan.target-crashed), WARN (logs and continues), or DISABLED; tune the trigger threshold with maxTimeouts, which defaults to five times concurrentRequests, and uses app.waitForAppTarget as the liveness probe path.
    • hawk.spider.seedPaths entries are now validated at configuration parse time by hawk scan: entries over 200 characters or with more than 12 path segments produce a warning; entries over 1000 characters fail validation outright.
    • Commands embedded in the HawkScan CLI now read API key, API host, and organization from the same sources as the CLI itself — environment variables and ~/.hawk/hawk.properties — eliminating the need for a separate ~/.hawkop/config.yaml.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hawk rescan no longer re-runs discovery — all discovery is skipped, including OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., SOAP, GraphQL, and HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. imports. Workflows that relied on rescan to re-crawl the application will need to use a full scan instead.
    • !The separate ~/.hawkop/config.yaml credentials file is no longer used; credentials must now be in environment variables or ~/.hawk/hawk.properties.
32. updated seen Aug 8, 2026 · issue 039

    HawkScan 6.3.0 adds crash detection, faster rescans via request replay, and seedPaths validation.

    └──▷ USE IT
    Abort a scan immediately and surface a clear error when the target application stops responding mid-scan, rather than burning the full scan window against a dead host.
    yaml copy

    hawk:
      scan:
        crashDetection:
          action: ABORT
          maxTimeouts: 10

    • Adds hawk.scan.crashDetection config block to abort, warn, or disable scanning when a target crashes mid-scan; configure action: ABORT (default), WARN, or DISABLED, and tune the trigger with maxTimeouts (defaults to 5× concurrentRequests).
    • hawk rescan now replays the exact requests that produced findings — fetched from the platform — instead of re-crawling the app, skipping all discovery (OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., SOAP, GraphQL, HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session.) for substantially faster, tightly scoped retests.
    • Adds hawk.spider.seedPaths validation at parse time (run by both hawk scan and hawk validate config): entries over 200 characters or with more than 12 path segments emit a warning; entries over 1,000 characters fail validation outright.
    • hawk op now reads API key, API host, and organization from the same sources as hawk itself (environment variables and ~/.hawk/hawk.properties), eliminating the need to maintain a separate ~/.hawkop/config.yaml.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The separate ~/.hawkop/config.yaml credential file is no longer used by hawk op; credentials are now read exclusively from the environment and ~/.hawk/hawk.properties.
33. August 5th, 2026 Aug 5, 2026 · release notes

    HawkScan 6.3.0 adds hawk rescan replay, crashDetection, and seedPaths validation

    • hawk rescan replays alerted requests from the platform instead of re-crawling the entire application, skipping all discovery phases (OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., SOAP, GraphQL, HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. imports) for faster, tightly-scoped verifications
    • Adds hawk.scan.crashDetection configuration to abort scans when the target stops responding, configurable via action: ABORT|WARN|DISABLED and triggered by maxTimeouts
    • Adds validation for hawk.spider.seedPaths, warning on entries >200 chars or >12 segments and failing outright on entries >1000 characters during config parsing

    3 details in Everything

34. updated seen Jul 15, 2026 · issue 017

    StackHawk adds self-upgrade, scan drill-down commands, standalone binary, AI skills status, and org-wide Findings page.

    └──▷ TRY IT
    Check whether a newer HawkScan version is available before committing to an upgrade in a CI pre-flight step.
    copy

    $ hawk upgrade --check

    Iterate on an auth script against a live staging URL without running a full scan, with auto-reload on save.
    copy

    $ hawk validate script --watch https://staging.example.com

    Inspect the exact attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. (including GraphQL operations) exercised by a completed scan to verify coverage.
    copy

    $ hawk op scan uris --app my-api --graphql

    • New hawk upgrade command updates HawkScan CLI in place, detecting install method (Homebrew, binary, MSI, PKG, Docker) and printing the exact command when direct upgrade isn't possible; --check previews available versions and --version <x.y.z> pins to a specific release.
    • New hawk skills status command reports which StackHawk AI agent skills (Claude Code, Codex, Copilot) are installed and whether they are current, fetching latest published versions live.
    • New hawk op scan config retrieves the exact effective configuration a completed scan ran with; hawk op scan uris lists the full attack surface including GraphQL operations and JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. methods.
    • --app flag on all hawk op commands now accepts either an application name or a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., eliminating the need to look up UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. separately.
    • New hawk validate script command runs HawkScript auth logic against a single target URL without a full scan; --watch enables daemon mode that re-executes on every file save.

    +12 more show less

    • HawkScan 6.0.0 ships as a self-contained native binary for macOS (Apple Silicon/Intel), Linux (x86_64/arm64), and Windows (x64/arm64) — no JDK or JRE required.
    • hawk op is now fully integrated into the hawk binary, eliminating the separately installed hawkop binary for platform operations.
    • HawkScan 6.0.0 automatically trusts the OS native certificate store (macOS Keychain, Windows Certificate Store, Linux system PEM bundle), enabling transparent TLS-intercepting proxies (Zscaler, Netskope, corporate CAs) with zero configuration; disable with --no-native-truststore.
    • New --browser flag for hawk init skips all TTY prompts, opens the browser immediately, and always prints the authentication URL to stdout — designed for AI coding agents.
    • New hawk flightpath command runs the auth-authoring loop entirely locally, driving a browser-based login to produce a validated stackhawk-auth.yml without cloud infrastructure.
    • New hawk config subcommands (hawk config list, hawk config show <path>, hawk config recipe <path>) surface HawkScan's full configuration reference from the CLI; --text outputs raw markdown.
    • Primary-host matching is now exact (normalized scheme, default ports stripped), and hosted-scanner HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. uploads are scoped to the primary host only, excluding CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. and third-party traffic by default.
    • New StackHawk Storage Domains (scan-results.prod.stackhawk.com and hosted-assets.prod.stackhawk.com) front platform object storage via CloudFront with short-lived presigned URLs.
    • New Findings page provides a single org-wide table to view, sort, and filter all open findings across every app and environment, refreshed automatically after each scan.
    • New Service Keys provide long-lived, organization-owned API keys for CI/CD scanning with a Scan Only role, managed under Settings → Service Keys.
    • FlightPath (private preview) automatically generates authenticated scan configurations by capturing an interactive browser login session using an AI agent — no YAML required.
    • StackHawk CircleCI Orb v2.0.0 upgrades to orb-tools v12 build tooling.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hawk-{version}.zip download format is removed; pipelines downloading the ZIP must migrate to the OS/architecture-specific binary at https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk (Windows: hawk.exe).
    • !StackHawk CircleCI Orb v2.0.0: job and parameter names are renamed to snake_case — e.g., stackhawk/hawkscan-local becomes stackhawk/hawkscan_local and app-id becomes app_id. Pipelines pinned to a 1.x version are unaffected until upgraded.
35. July 14th, 2026 Jul 14, 2026 · release notes

    HawkScan 6.2.0 adds hawk upgrade, hawk skills status, and scan inspection commands

    └──▷ USE IT
    Check for CLI updates without applying them
    shell copy

    hawk upgrade --check

    View installed AI coding tool skills and their update status
    shell copy

    hawk skills status

    Retrieve the effective configuration used for a specific scan
    shell copy

    hawk op scan config --app <application_name_or_uuid>

    • hawk upgrade command updates your HawkScan CLI in place or prints the exact command to run for Homebrew, standalone binary, MSI, PKG, or Docker installs; supports --check and --version <x.y.z>.
    • hawk skills status reports which StackHawk agent skills are installed for Claude Code, Codex, Copilot and whether they're up to date by fetching the latest published versions live.
    • hawk op scan config retrieves the exact effective configuration a completed scan ran with.
    • hawk op scan uris lists the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. a scan exercised, including GraphQL operations and JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. methods for those scan types when using --graphql or --jsonrpc to force a source.

    4 details in Everything

36. updated seen Jul 13, 2026 · issue 014

    StackHawk adds standalone native binary, script validation daemon, org-wide findings table, service keys, and FlightPath AI auth config.

    └──▷ TRY IT
    Iterate on an auth script locally without triggering a full scan — daemon mode re-runs the script every time you save.
    copy

    $ hawk validate script --watch --app-id <your-app-id> --target-url https://app.example.com

    Browse all available HawkScan config sections and then inspect the exact schema for the authentication block before writing your stackhawk.yml.
    copy

    $ hawk config list && hawk config show app.authentication

    Provision a CI service key scoped to Scan Only and store it for pipeline use — without tying it to any individual user account.
    📍In the StackHawk console, go to Settings › Service Keys and click Create Service Key. Copy the generated key into your CI secret store (e.g., as HAWK_API_KEY). The key belongs to the org and survives team member changes.
    • Adds hawk validate script command to test active and passive HawkScripts against a live URL without running a full scan; pass --watch for daemon mode that re-executes on every file save.
    • Adds standalone native HawkScan binary (macOS, Linux, Windows) with bundled JRE — no Java installation required in CI or on developer machines.
    • Integrates hawk op directly into the hawk binary, eliminating the need for a separately installed hawkop binary for platform operations.
    • Adds OS-native certificate trust (macOS Keychain, Windows Certificate Store, Linux PEM bundle) for zero-config support of transparent TLS-intercepting proxies (Zscaler, Netskope, corporate CAs); disable with --no-native-truststore.
    • Adds --browser flag to hawk init for non-interactive device-flow authentication — opens the browser immediately and prints the auth URL to stdout, designed for AI coding agents.

    +11 more show less

    • Removes ZIP distribution format; pipelines must migrate to architecture-specific binary downloads from https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk.
    • Adds hawk flightpath command for running the auth-authoring loop entirely locally — no cloud infrastructure required — producing a validated stackhawk-auth.yml.
    • Upgrades StackHawk CircleCI Orb to v2.0.0 with snake_case job and parameter names (breaking change; e.g., stackhawk/hawkscan-local → stackhawk/hawkscan_local, app-id → app_id).
    • Adds hawk config subcommands (list, show <path>, recipe <path>) to browse and inspect HawkScan configuration schema from the CLI; --text flag outputs raw markdown.
    • Scopes primary-host matching to exact lowercase host with normalized default ports, excluding CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. and third-party traffic from hosted-scanner HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. uploads by default.
    • Adds two new CloudFront-fronted storage domains (scan-results.prod.stackhawk.com, hosted-assets.prod.stackhawk.com) for scan results and hosted assets (available on request).
    • Adds org-wide Findings page to view, sort, and filter all open findings across every app and environment in a single table, refreshed automatically after each scan.
    • Adds Service Keys — long-lived, organization-owned API keys with Scan Only role for CI/CD scanning, managed under Settings → Service Keys.
    • Adds FlightPath (private preview for Enterprise/Scale) — AI agent that captures auth flows via a built-in browser and auto-generates complete scan configurations without YAML.
    • Adds Organization IP Allow List to restrict inbound platform access to approved IPv4 CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges, covering UI logins, API key requests, and scan uploads (available on request).
    • Adds Test Config button in the Scan Config Drawer to validate stackhawk.yml with field-level feedback and execute the auth login flow against a live application before running a full scan.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hawk-{version}.zip download format is no longer available; pipelines or scripts that download the ZIP directly must migrate to the OS- and architecture-specific binary download at https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk (Windows: hawk.exe).
    • !The StackHawk CircleCI Orb v2.0.0 renames jobs and parameters from kebab-case to snake_case (e.g., stackhawk/hawkscan-local → stackhawk/hawkscan_local, app-id → app_id); existing pipelines must update job and parameter names when upgrading to v2.0.0.
37. July 7th, 2026 Jul 7, 2026 · release notes

    StackHawk 6.1.0 adds hawk validate for testing scripts and restores critical hawk init CLI flags.

    └──▷ TRY IT
    Iterate on script logic by running it against a live URL repeatedly as you save changes.
    copy

    $ hawk validate <target-url> --watch

    Provision the API key and configure outbound proxy non-interactively in CI or containerized environments.
    copy

    $ hawk init --api-key <key> --outbound-proxy-host <host> --outbound-proxy-username <user> --outbound-proxy-password <pass>

    • Adds the hawk validate command to test active and passive HawkScript logic against a live target URL without starting a full scan
    • Enables --watch flag on hawk validate to re-execute scripts in daemon mode upon file saves

    2 details in Everything

38. June 29th, 2026 Jun 29, 2026 · release notes

    HawkScan 6.0 adds standalone native binary with hawk op subcommand and --browser auth flag for zero-Java CI workflows

    • Adds self-contained native hawk binary (macOS, Linux, Windows) that bundles a trimmed Java runtime — no external JDK/JRE needed
    • Integrates hawk op subcommand directly into the hawk binary for platform operations
    • Enables OS-native certificate trust by default, supporting transparent TLS-intercepting proxies without manual configuration
    • Adds --browser flag to hawk init for non-interactive device-flow authentication in AI coding agents

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hawk-{version}.zip download format is removed; existing download scripts will break and must switch to the OS-specific binary URL.
39. June 10th, 2026 Jun 10, 2026 · release notes

    HawkScan 5.7.0 adds hawk flightpath command for local browser-based auth-authoring

    • Added hawk flightpath subcommand to run the auth-authoring loop entirely locally without cloud infrastructure, producing a validated stackhawk-auth.yml file.

    1 detail in Everything

40. May 27th, 2026 May 27, 2026 · release notes

    StackHawk CircleCI Orb v2.0.0 released with snake_case job and parameter names.

    └──▷ USE IT
    Update your CircleCI pipeline config to use the new snake_case job names.
    text copy

    - uses: stackhawk/hawkscan_local@v2

    Pass configuration using the new snake_case parameter names.
    text copy

    - app_id: 'my-app-id'

    • Releases the StackHawk CircleCI Orb as v2.0.0 built on orb-tools v12
    • Adopts snake_case for all orb jobs and parameters (e.g., hawkscan-local becomes hawkscan_local, app-id becomes app_id)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The stackhawk/hawkscan-local job is now named stackhawk/hawkscan_local
    • !The app-id parameter is now named app_id
    • !All existing orb jobs and parameters must be updated to use snake_case naming convention
41. May 20th, 2026 May 20, 2026 · release notes

    StackHawk HawkScan 5.6.0 adds hawk config CLI surface and tighter primary-host scoping for scans.

    └──▷ USE IT
    Browse all configuration sections available in HawkScan 5.6.0.
    shell copy

    hawk config list

    Dump the JSON envelope for a specific config section including type, default, and constraints.
    shell copy

    hawk config show <path>

    Get a worked example of a config section in raw markdown format.
    shell copy

    hawk config recipe <path> --text

    • Adds the hawk config subcommands to expose configuration knowledge from the command line
    • Adds support for the --text flag on hawk config commands to output raw markdown
    • Improves primary-host exact match logic and scopes HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. uploads to the configured app.host

    3 details in Everything

42. April 29th, 2026 Apr 29, 2026 · release notes

    StackHawk adds org-wide findings table, Service Keys for CI/CD, and FlightPath auto-config generation.

    └──▷ HOW TO FIND IT
    Create a service key for CI/CD pipelines that remains valid regardless of user turnover.
    📍Navigate to Settings → Service Keys and click Create Key
    Filter all open findings in your organization by severity or status in one view.
    📍Go to Findings › All Open
    • Added Settings → Service Keys menu for managing long-lived, organization-owned API keys with Scan Only role
    • Adds Read / Write / Delete Service Account permissions to control access to Service Keys
    • Added global Findings page to view, sort, and filter open findings across every app and environment in a single table
    • Added FlightPath feature for automated authenticated scan configuration generation via built-in browser

    4 details in Everything

43. April 22nd, 2026 Apr 22, 2026 · release notes

    StackHawk adds Organization IP Allow List to restrict platform access to approved IPv4 CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges

44. April 6th, 2026 Apr 6, 2026 · release notes

    HawkScan 5.4.0 adds --json-output, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server scanning, blind SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection, and strict YAML validation

    └──▷ TRY IT
    Pipe HawkScan results directly into an AI agent for automated triage
    copy

    $ hawk scan --json-output > /tmp/hawk_results.json

    Automate initial configuration by piping the app creation output directly into the config file
    copy

    $ hawk create app --yaml > stackhawk.yml

    Configure MCP server discovery to automatically test JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. methods for vulnerabilities
    yaml copy

    jsonRpcConf:
      mcp: {}
    jsonRpc:
      path: "https://api.example.com/openrpc"

    • hawk scan --json-output flag outputs structured JSON to stdout with console suppression for programmatic parsing
    • hawk create app --yaml flag outputs a stackhawk.yml configuration stub to stdout after app creation
    • MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) server scanning via app.jsonRpcConf.mcp configuration key for injection, SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., and path traversal testing
    • New blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. scan rule 400021 running after boolean-based check 400030 with distinct payloads
    • hawk.jsonRpc.path config key enables automatic OpenRPC method discovery for JSON-RPC scanning

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The stackhawk.yml schema validator is now strict: unknown properties produce warnings instead of being silently ignored
45. February 17th, 2026 Feb 17, 2026 · release notes

    StackHawk v5.3.0 adds JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets./gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. support, modern AJAX spider, and DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection

    └──▷ TRY IT
    Create a new application profile without typing the org ID on every command line invocation
    copy

    $ export ORG_ID="your-org-id"; hawk create app my-app

    • app.jsonRpcConf section in hawk-config.yaml enables security testing of JSON-RPC 2.0 APIs
    • New authentication types JSON_RPC and GRPC in app.authentication allow native auth for respective protocols
    • Rewritten AJAX Spider with multi-pass discovery automatically detects Angular, React, Vue, and Next.js to extract routes from framework routers and JS bundles
    • DOM XSS sink detection instruments dangerous DOM APIs during crawling to identify real-time vulnerabilities

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Firefox browser support is removed; FIREFOX_HEADLESS and FIREFOX options for hawk.spider.ajaxBrowser are deprecated and defaulting to CHROME_HEADLESS
46. December 17th, 2025 Dec 17, 2025 · release notes

    HawkScan 5.1.0 adds React2Shell RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. detection and fixes smart crawl path filtering

    • Enables fuzzing of endpoints discovered by the smart crawl plan via the active scanner

    1 detail in Everything

47. December 13th, 2025 Dec 13, 2025 · release notes

    HawkScan 5.0 adds multi-profile business logic testing, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. smart crawl plans, and sensitive data detection plugins.

    • Adds multi-profile scanning for business logic testing, enabling automated detection of BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. and BFLABFLABroken Function Level Authorization, an API vulnerability class where an application fails to enforce access controls on specific endpoints, letting lower-privileged users call admin or restricted functions. vulnerabilities by configuring multiple authentication profiles
    • Adds a smart crawl plan that automatically generates crawling strategies based on configured OpenAPI specifications to understand API structure and data relationships
    • Adds new passive scan plugins for sensitive data exposure: Credit Card Numbers (100008), Email Addresses (100009), HTML Comments (100011), and IBAN Numbers (100012)
    • Adds evidence chains to BOLA and BFLA alerts showing cross-profile access attempts and responses
    • Improves OpenAPI support by merging multiple specification files into a unified API definition

    5 details in Everything

48. November 13th, 2025 Nov 13, 2025 · release notes

    StackHawk adds automated testing for five OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces. risks (Prompt Injection, Output Handling, etc.)

49. October 23rd, 2025 Oct 23, 2025 · release notes

    StackHawk adds official Semgrep integration for correlating DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings

    └──▷ HOW TO FIND IT
    Correlate static and dynamic analysis results in the StackHawk platform to reduce noise.
    📍1. In the StackHawk Platform, navigate to Integrations. 2. Select Semgrep from the list of available integrations. 3. Follow the prompts to link your Semgrep account and enable automatic finding correlation.