https://cybertoolchain.io/tools/stackhawk New releases and features in StackHawk, tracked by The Cyber Toolchain. en Fri, 16 Oct 2026 08:13:49 GMT https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Fri, 16 Oct 2026 08:13:49 GMT StackHawk: Adds Windows CLI installers: `irm https://download.stackhawk.com/hawk/install.ps1 | iex` for PowerShell, installing to `%USERPROFILE%\.hawk\bin`. • HawkScan now reads the declared `servers[]` base path (or `basePath` in Swagger 2.0) from an OpenAPI spec and automatically prefixes every operation request, so specs no longer return empty scans when the base path is not duplicated in `app.url`. • Removes the default per-rule alert cap so every matching alert is reported; existing `scanner.maxAlertsPerRule` / `pscans.maxAlertsPerRule` values set via `hawk.config` continue to apply. Breaking changes: • An unresolved `${VARIABLE}` placeholder in configuration now stops the scan with 'Missing environment variable: VARIABLE' instead of silently substituting an empty string. Pipelines that intentionally left a variable unset must either set it or use the `${VARIABLE:}` (trailing-colon) form. • Authorization alpha rules 40051, 40054, 40055, and 40056 have been removed; any configuration or workflow that relied on these single-identity rules will no longer produce results from them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Thu, 15 Oct 2026 07:42:05 GMT HawkScan 6.6.0 adds GitHub-ready SARIF output, Windows CLI installer, OpenAPI base-path awareness, and ajax spider seed-path support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--sarif-ghas` flag (`SARIF_GHAS` env var) that writes `stackhawk-ghas.sarif` — a SARIF file accepted by GitHub Advanced Security code scanning, with rule IDs keyed by plugin ID, relative request-path locations, and stable fingerprints; upload with `github/codeql-action/upload-sarif`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `app.openApiConf.basePath` to set the OpenAPI base path explicitly and `app.openApiConf.disableServerBasePath: true` to suppress automatic base-path detection from `servers[]` (Swagger 2.0 `basePath`), preserving prior behavior. • Adds official `hawk` CLI installers: on Windows, run `irm https://download.stackhawk.com/hawk/install.ps1 | iex` in PowerShell or use `https://download.stackhawk.com/hawk/install.bat` in cmd.exe; on Linux/macOS, run `curl -sSf https://download.stackhawk.com/hawk/install.sh | sh` with OS/architecture detection; all support `HAWK_INSTALL_VERSION` and `HAWK_INSTALL_DIR` env vars for pinning version and install location (default `%USERPROFILE%\.hawk\bin` on Windows, `~/.hawk/bin` on Linux/macOS), and verify SHA-256 before installing. • The ajax spider now visits each path listed in `hawk.spider.seedPaths`, loading them in its browser after the start page so XHR and on-load requests are captured and tested. • Removes the per-rule alert cap: `scanner.maxAlertsPerRule` and `pscans.maxAlertsPerRule` in `hawk.config` still apply when set, but the default cap is now off so large applications report all findings. • Scan-engine traffic to the StackHawk platform (result upload, asset download, token refresh) now routes through the hawk CLI's outbound proxy and trusted-certificate settings, fixing silent upload failures behind corporate proxies. • Adds `app.authentication.sessionVerification` config block to poll `authentication.testPath` mid-scan and re-authenticate when the session lapses, tunable via `pollFrequency` (default 15), `activeScanPollFrequency` (default 5), and `maxUnauthenticatedRequestPercent` (default 5); `disabled: true` turns it off explicitly. • Adds clear error messages and non-zero exit when the platform rejects a scan for an out-of-support CLI version, naming the minimum supported version and upgrade URL. Breaking changes: • An unresolved `${VARIABLE}` in scan configuration now stops the scan with an error instead of silently using an empty value; pipelines that relied on an unset variable being treated as empty must either set the variable or change the reference to `${VARIABLE:}`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Sat, 26 Sep 2026 07:48:32 GMT StackHawk: Adds `disabled: true` field inside `app.authentication.sessionVerification` to explicitly turn off session verification while still requiring a `loggedInIndicator`/`loggedOutIndicator` as a fallback check. • Reports a clear, non-zero-exit error — including the minimum supported version and upgrade location — when the platform rejects a scan due to an out-of-support CLI version, and logs deprecation advisories once per scan instead of on every platform call. • Entity and transport headers — `Content-Type`, `Content-Length`, `Accept`, `Accept-Encoding`, `Host`, `User-Agent`, `Referer` — are no longer stripped from replayed spider requests during rescans, even when listed in `authentication.testPath.requestHeaders` or `app.redact.headers`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Fri, 25 Sep 2026 07:51:30 GMT HawkScan 6.5.0 adds mid-scan session verification, org-wide secret resolution, and a one-line CLI installer with version pinning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `app.authentication.sessionVerification` config block to re-check authentication mid-scan by polling `authentication.testPath`, with tunable `pollFrequency` (default 15), `activeScanPollFrequency` (default 5), and `maxUnauthenticatedRequestPercent` (default 5); a scan that spent too much time logged out finishes with a coverage warning instead of a quietly thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `HAWK_INSTALL_VERSION` and `HAWK_INSTALL_DIR` environment variables to the one-line `curl -sSf https://download.stackhawk.com/hawk/install.sh | sh` installer, with SHA-256 verification against the published manifest; `HAWK_INSTALL_DIR` defaults to `~/.hawk/bin`. • Fixes `hawk op app tech-flags set` so naming one technology flag no longer silently re-enables all other 34 flags; the command now reads current flags, merges the requested change, and writes the result. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Thu, 24 Sep 2026 07:52:08 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Wed, 23 Sep 2026 13:13:00 GMT StackHawk: Fixes `hawk op app tech-flags set` so naming one technology flag no longer silently re-enables all other 34 flags; the command now reads current flags, merges the change, and writes only the result. • Emits the platform's own message — including minimum supported version and upgrade location — and exits non-zero when a scan is declined because the CLI is out of support; logs deprecation advisories once per scan rather than on every platform call. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Wed, 23 Sep 2026 07:34:40 GMT StackHawk: Adds support for installing the `hawk` CLI via `curl -sSf https://download.stackhawk.com/hawk/install.sh | sh`, with SHA-256 verification against the published manifest; supports `HAWK_INSTALL_VERSION` to pin a release and `HAWK_INSTALL_DIR` to control the install destination (default `~/.hawk/bin`). • Adds resolution of `${VARIABLE}` references in scan configuration against organization-wide secrets, so a team can share one copy of a scan credential; personal secrets take precedence and HawkScan warns when both exist, and names any unresolvable variable explicitly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Tue, 22 Sep 2026 07:33:51 GMT HawkScan 6.5.0 adds mid-scan session verification, org-wide secrets, and a one-line CLI installer with version pinning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `app.authentication.sessionVerification` config block to re-check and re-authenticate sessions mid-scan by polling `authentication.testPath`, with tunable `pollFrequency` (default 15), `activeScanPollFrequency` (default 5), and `maxUnauthenticatedRequestPercent` (default 5); a scan that spent too much time logged out now finishes with a coverage warning instead of a silently thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `disabled: true` field inside `app.authentication.sessionVerification` to explicitly turn off session verification while still requiring an indicator-based check. • Adds a one-line installer script at `curl -sSf https://download.stackhawk.com/hawk/install.sh | sh` that detects OS and architecture, verifies SHA-256 against the published manifest, and supports `HAWK_INSTALL_VERSION` and `HAWK_INSTALL_DIR` environment variables (default install location `~/.hawk/bin`). • Adds `HAWK_INSTALL_VERSION` environment variable to pin the `hawk` CLI version during install — recommended for reproducible CI pipelines. • Adds `HAWK_INSTALL_DIR` environment variable to control where the `hawk` binary is installed (default `~/.hawk/bin`). • Adds organization-level secret resolution so `${VARIABLE}` references in scan configuration now resolve against org-shared secrets, not only per-user secrets; personal secrets still take precedence, and unresolved names now emit a named warning instead of silently resolving to an empty value. • Adds clear error messaging when the HawkScan CLI version is below the platform-enforced minimum, reporting the minimum supported version, upgrade location, and exiting non-zero instead of emitting a generic HTTP error; deprecated-but-not-blocked versions log an advisory once per scan rather than on every platform call. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/openapi.json https://docs.stackhawk.com/openapi.json Mon, 14 Sep 2026 14:38:41 GMT API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/openapi.json https://docs.stackhawk.com/openapi.json Fri, 11 Sep 2026 14:46:11 GMT API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Mon, 07 Sep 2026 07:33:07 GMT StackHawk adds native OS certificate trust for transparent TLS proxies and a non-interactive browser auth flow for hawk init. • Adds native OS certificate trust store support so Zscaler, Netskope, and corporate CA proxies work with zero configuration; disable with `--no-native-truststore` or `USE_NATIVE_TRUSTSTORE=false`. • Adds `--browser` flag to `hawk init` for non-interactive device-flow authentication, skipping TTY prompts and the manual key-entry menu. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Sun, 23 Aug 2026 17:00:33 GMT StackHawk 6.4.0 adds multi-profile scan mode control, a new auth-bypass scan rule, and team ownership management for applications. • Adds `PUT /api/v1/org/{orgId}/team/{teamId}/application` endpoint behavior correction — Team assignments made through the API now persist correctly; previously the endpoint returned success without saving. • Applications table now shows Team ownership for each application and supports inline reassignment; applications without a Team are labeled `Unassigned`. • Team ownership field is also available in `Application Settings > General`, with `Unassigned` at the top of the list. • Members and View Only users can now view Teams pages: Members can open Teams they belong to, View Only users can review every Team in the organization. • Team management controls (Create a Team, Add Members, Add Applications, rename, Delete) now appear as disabled rather than hidden for users without permission. • Users who cannot manage Teams and belong to at least one Team must now assign a newly created application to one of their Teams in the Create Application flow. Breaking changes: • `hawk validate config` previously exited `0` even on hard validation errors and missing configuration files; it now exits non-zero on those conditions. CI pipelines relying on the always-zero exit behavior (e.g., `hawk validate config stackhawk.yml && ./deploy.sh`) will now correctly fail when the configuration is invalid. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Fri, 21 Aug 2026 08:59:53 GMT HawkScan 6.4.0 adds multi-profile scan mode control, a new auth-bypass scan rule, and improved CI validation exit codes. • Adds `--profile-scan-mode` flag (env: `PROFILE_SCAN_MODE`) with three modes — `business-logic` (default), `primary-full`, and `all-full` — giving explicit control over whether full scan policy runs against one or all authentication profiles in multi-profile scans. • Adds `--full-scan-profile` flag (env: `FULL_SCAN_PROFILE`) to designate which profile receives the full policy when using `primary-full` mode; defaults to the first profile declared in configuration. • New active scan rule (plugin `40059`) tests HTTP Header Authentication Bypass by injecting headers such as `X-Forwarded-For`, `X-Original-URL`, and `X-Rewrite-URL`; off by default, enabled via policy management. • Findings from multi-profile scans now carry a `[profile=<name>]` prefix on their evidence, identifying which identity a vulnerability was discovered under. • `hawk validate config` now exits non-zero on hard validation errors and missing configuration files, making it usable as a real CI gate; warnings (unknown-property, lint) continue to exit 0. Breaking changes: • `hawk validate config` previously exited 0 even on hard validation errors; it now exits non-zero for hard errors and missing configuration files. Pipelines relying on the always-zero exit code will now correctly fail on a broken configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/openapi.json https://docs.stackhawk.com/openapi.json Thu, 20 Aug 2026 14:16:03 GMT API surface changed: +2 endpoints • New endpoint GET /api/v1/org/{orgId}/teams/available/applications • New endpoint GET /api/v1/org/{orgId}/teams/available/users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Wed, 19 Aug 2026 23:46:17 GMT StackHawk adds inline Team ownership for applications, Team visibility for Members and View Only users, and required Team assignment on app creation. • Adds a Team ownership column to the Applications table, letting users change a Team assignment in place; applications without a Team are marked 'Unassigned' and can be searched and assigned from the same row. • Adds a Team field to Application Settings > General, with 'Unassigned' at the top so clearing ownership works the same way as changing it. • Enables Members to view the Teams they belong to, and View Only users to review every Team in the organization, without requiring Team management permissions. • Makes Team management controls (Create a Team, Add Members, Add Applications, rename, Delete Team) visible-but-disabled for users without manage permissions, rather than hidden. • Requires users who cannot manage Teams and belong to at least one Team to assign a new application to one of their Teams during the Create Application flow. Breaking changes: • The `PUT /api/v1/org/{orgId}/team/{teamId}/application` endpoint previously returned a success response without saving the Team assignment; assignments made through this endpoint were silently dropped and must be re-submitted to take effect. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/openapi.json https://docs.stackhawk.com/openapi.json Sat, 08 Aug 2026 05:32:34 GMT API surface changed: 1 modified • GET /api/v1/org/{orgId}/audit: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Sat, 08 Aug 2026 04:43:42 GMT HawkScan 6.3.0 adds crash detection, faster rescans via request replay, and seedPaths validation. • Adds `hawk.scan.crashDetection` config block to abort, warn, or disable scanning when a target crashes mid-scan; configure `action: ABORT` (default), `WARN`, or `DISABLED`, and tune the trigger with `maxTimeouts` (defaults to 5× `concurrentRequests`). • `hawk rescan` now replays the exact requests that produced findings — fetched from the platform — instead of re-crawling the app, skipping all discovery (OpenAPI, SOAP, GraphQL, HAR) for substantially faster, tightly scoped retests. • Adds `hawk.spider.seedPaths` validation at parse time (run by both `hawk scan` and `hawk validate config`): entries over 200 characters or with more than 12 path segments emit a warning; entries over 1,000 characters fail validation outright. • `hawk op` now reads API key, API host, and organization from the same sources as `hawk` itself (environment variables and `~/.hawk/hawk.properties`), eliminating the need to maintain a separate `~/.hawkop/config.yaml`. Breaking changes: • The separate `~/.hawkop/config.yaml` credential file is no longer used by `hawk op`; credentials are now read exclusively from the environment and `~/.hawk/hawk.properties`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Wed, 15 Jul 2026 22:57:42 GMT StackHawk adds self-upgrade, scan drill-down commands, standalone binary, AI skills status, and org-wide Findings page. • New `hawk upgrade` command updates HawkScan CLI in place, detecting install method (Homebrew, binary, MSI, PKG, Docker) and printing the exact command when direct upgrade isn't possible; `--check` previews available versions and `--version <x.y.z>` pins to a specific release. • New `hawk skills status` command reports which StackHawk AI agent skills (Claude Code, Codex, Copilot) are installed and whether they are current, fetching latest published versions live. • New `hawk op scan config` retrieves the exact effective configuration a completed scan ran with; `hawk op scan uris` lists the full attack surface including GraphQL operations and JSON-RPC methods. • `--app` flag on all `hawk op` commands now accepts either an application name or a UUID, eliminating the need to look up UUIDs separately. • New `hawk validate script` command runs HawkScript auth logic against a single target URL without a full scan; `--watch` enables daemon mode that re-executes on every file save. • HawkScan 6.0.0 ships as a self-contained native binary for macOS (Apple Silicon/Intel), Linux (x86_64/arm64), and Windows (x64/arm64) — no JDK or JRE required. • `hawk op` is now fully integrated into the `hawk` binary, eliminating the separately installed `hawkop` binary for platform operations. • HawkScan 6.0.0 automatically trusts the OS native certificate store (macOS Keychain, Windows Certificate Store, Linux system PEM bundle), enabling transparent TLS-intercepting proxies (Zscaler, Netskope, corporate CAs) with zero configuration; disable with `--no-native-truststore`. • New `--browser` flag for `hawk init` skips all TTY prompts, opens the browser immediately, and always prints the authentication URL to stdout — designed for AI coding agents. • New `hawk flightpath` command runs the auth-authoring loop entirely locally, driving a browser-based login to produce a validated `stackhawk-auth.yml` without cloud infrastructure. • New `hawk config` subcommands (`hawk config list`, `hawk config show <path>`, `hawk config recipe <path>`) surface HawkScan's full configuration reference from the CLI; `--text` outputs raw markdown. • Primary-host matching is now exact (normalized scheme, default ports stripped), and hosted-scanner HAR uploads are scoped to the primary host only, excluding CDN and third-party traffic by default. • New StackHawk Storage Domains (`scan-results.prod.stackhawk.com` and `hosted-assets.prod.stackhawk.com`) front platform object storage via CloudFront with short-lived presigned URLs. • New Findings page provides a single org-wide table to view, sort, and filter all open findings across every app and environment, refreshed automatically after each scan. • New Service Keys provide long-lived, organization-owned API keys for CI/CD scanning with a Scan Only role, managed under Settings → Service Keys. • FlightPath (private preview) automatically generates authenticated scan configurations by capturing an interactive browser login session using an AI agent — no YAML required. • StackHawk CircleCI Orb v2.0.0 upgrades to orb-tools v12 build tooling. Breaking changes: • The `hawk-{version}.zip` download format is removed; pipelines downloading the ZIP must migrate to the OS/architecture-specific binary at `https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk` (Windows: `hawk.exe`). • StackHawk CircleCI Orb v2.0.0: job and parameter names are renamed to snake_case — e.g., `stackhawk/hawkscan-local` becomes `stackhawk/hawkscan_local` and `app-id` becomes `app_id`. Pipelines pinned to a 1.x version are unaffected until upgraded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/ https://docs.stackhawk.com/changelog/ Mon, 13 Jul 2026 10:07:00 GMT StackHawk adds standalone native binary, script validation daemon, org-wide findings table, service keys, and FlightPath AI auth config. • Adds `hawk validate script` command to test active and passive HawkScripts against a live URL without running a full scan; pass `--watch` for daemon mode that re-executes on every file save. • Adds standalone native HawkScan binary (macOS, Linux, Windows) with bundled JRE — no Java installation required in CI or on developer machines. • Integrates `hawk op` directly into the `hawk` binary, eliminating the need for a separately installed `hawkop` binary for platform operations. • Adds OS-native certificate trust (macOS Keychain, Windows Certificate Store, Linux PEM bundle) for zero-config support of transparent TLS-intercepting proxies (Zscaler, Netskope, corporate CAs); disable with `--no-native-truststore`. • Adds `--browser` flag to `hawk init` for non-interactive device-flow authentication — opens the browser immediately and prints the auth URL to stdout, designed for AI coding agents. • Removes ZIP distribution format; pipelines must migrate to architecture-specific binary downloads from `https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk`. • Adds `hawk flightpath` command for running the auth-authoring loop entirely locally — no cloud infrastructure required — producing a validated `stackhawk-auth.yml`. • Upgrades StackHawk CircleCI Orb to v2.0.0 with snake_case job and parameter names (breaking change; e.g., `stackhawk/hawkscan-local` → `stackhawk/hawkscan_local`, `app-id` → `app_id`). • Adds `hawk config` subcommands (`list`, `show <path>`, `recipe <path>`) to browse and inspect HawkScan configuration schema from the CLI; `--text` flag outputs raw markdown. • Scopes primary-host matching to exact lowercase host with normalized default ports, excluding CDN and third-party traffic from hosted-scanner HAR uploads by default. • Adds two new CloudFront-fronted storage domains (`scan-results.prod.stackhawk.com`, `hosted-assets.prod.stackhawk.com`) for scan results and hosted assets (available on request). • Adds org-wide Findings page to view, sort, and filter all open findings across every app and environment in a single table, refreshed automatically after each scan. • Adds Service Keys — long-lived, organization-owned API keys with Scan Only role for CI/CD scanning, managed under Settings → Service Keys. • Adds FlightPath (private preview for Enterprise/Scale) — AI agent that captures auth flows via a built-in browser and auto-generates complete scan configurations without YAML. • Adds Organization IP Allow List to restrict inbound platform access to approved IPv4 CIDR ranges, covering UI logins, API key requests, and scan uploads (available on request). • Adds Test Config button in the Scan Config Drawer to validate `stackhawk.yml` with field-level feedback and execute the auth login flow against a live application before running a full scan. Breaking changes: • The `hawk-{version}.zip` download format is no longer available; pipelines or scripts that download the ZIP directly must migrate to the OS- and architecture-specific binary download at `https://download.stackhawk.com/hawk/{VERSION}/{PLATFORM}/hawk` (Windows: `hawk.exe`). • The StackHawk CircleCI Orb v2.0.0 renames jobs and parameters from kebab-case to snake_case (e.g., `stackhawk/hawkscan-local` → `stackhawk/hawkscan_local`, `app-id` → `app_id`); existing pipelines must update job and parameter names when upgrading to v2.0.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#june-10th%2C-2026 https://docs.stackhawk.com/changelog/#june-10th%2C-2026 Wed, 10 Jun 2026 00:00:00 GMT HawkScan 5.7.0 adds `hawk flightpath` command for local browser-based auth-authoring • Added `hawk flightpath` subcommand to run the auth-authoring loop entirely locally without cloud infrastructure, producing a validated `stackhawk-auth.yml` file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#may-27th%2C-2026 https://docs.stackhawk.com/changelog/#may-27th%2C-2026 Wed, 27 May 2026 00:00:00 GMT StackHawk CircleCI Orb v2.0.0 released with snake_case job and parameter names. • Releases the StackHawk CircleCI Orb as v2.0.0 built on orb-tools v12 • Adopts snake_case for all orb jobs and parameters (e.g., `hawkscan-local` becomes `hawkscan_local`, `app-id` becomes `app_id`) Breaking changes: • The `stackhawk/hawkscan-local` job is now named `stackhawk/hawkscan_local` • The `app-id` parameter is now named `app_id` • All existing orb jobs and parameters must be updated to use snake_case naming convention Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#may-20th%2C-2026 https://docs.stackhawk.com/changelog/#may-20th%2C-2026 Wed, 20 May 2026 00:00:00 GMT StackHawk HawkScan 5.6.0 adds `hawk config` CLI surface and tighter primary-host scoping for scans. • Adds the `hawk config` subcommands to expose configuration knowledge from the command line • Adds support for the `--text` flag on `hawk config` commands to output raw markdown • Improves primary-host exact match logic and scopes HAR uploads to the configured app.host Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#april-29th%2C-2026 https://docs.stackhawk.com/changelog/#april-29th%2C-2026 Wed, 29 Apr 2026 00:00:00 GMT StackHawk adds org-wide findings table, Service Keys for CI/CD, and FlightPath auto-config generation. • Added `Settings → Service Keys` menu for managing long-lived, organization-owned API keys with Scan Only role • Adds `Read / Write / Delete Service Account` permissions to control access to Service Keys • Added global Findings page to view, sort, and filter open findings across every app and environment in a single table • Added FlightPath feature for automated authenticated scan configuration generation via built-in browser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#april-22nd%2C-2026 https://docs.stackhawk.com/changelog/#april-22nd%2C-2026 Wed, 22 Apr 2026 00:00:00 GMT StackHawk adds Organization IP Allow List to restrict platform access to approved IPv4 CIDR ranges • Adds Organization IP Allow List to restrict inbound traffic to approved IPv4 CIDR ranges for UI logins, API key requests, and HawkScan uploads Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#april-6th%2C-2026 https://docs.stackhawk.com/changelog/#april-6th%2C-2026 Mon, 06 Apr 2026 00:00:00 GMT HawkScan 5.4.0 adds `--json-output`, MCP server scanning, blind SQLi detection, and strict YAML validation • `hawk scan --json-output` flag outputs structured JSON to stdout with console suppression for programmatic parsing • `hawk create app --yaml` flag outputs a stackhawk.yml configuration stub to stdout after app creation • MCP (Model Context Protocol) server scanning via `app.jsonRpcConf.mcp` configuration key for injection, SSRF, and path traversal testing • New blind SQL injection scan rule 400021 running after boolean-based check 400030 with distinct payloads • `hawk.jsonRpc.path` config key enables automatic OpenRPC method discovery for JSON-RPC scanning Breaking changes: • The `stackhawk.yml` schema validator is now strict: unknown properties produce warnings instead of being silently ignored Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#february-17th%2C-2026 https://docs.stackhawk.com/changelog/#february-17th%2C-2026 Tue, 17 Feb 2026 00:00:00 GMT StackHawk v5.3.0 adds JSON-RPC/gRPC support, modern AJAX spider, and DOM XSS detection • `app.jsonRpcConf` section in `hawk-config.yaml` enables security testing of JSON-RPC 2.0 APIs • New authentication types `JSON_RPC` and `GRPC` in `app.authentication` allow native auth for respective protocols • Rewritten AJAX Spider with multi-pass discovery automatically detects Angular, React, Vue, and Next.js to extract routes from framework routers and JS bundles • DOM XSS sink detection instruments dangerous DOM APIs during crawling to identify real-time vulnerabilities Breaking changes: • Firefox browser support is removed; `FIREFOX_HEADLESS` and `FIREFOX` options for `hawk.spider.ajaxBrowser` are deprecated and defaulting to `CHROME_HEADLESS` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#december-17th%2C-2025 https://docs.stackhawk.com/changelog/#december-17th%2C-2025 Wed, 17 Dec 2025 00:00:00 GMT HawkScan 5.1.0 adds React2Shell RCE detection and fixes smart crawl path filtering • Enables fuzzing of endpoints discovered by the smart crawl plan via the active scanner Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#december-13th%2C-2025 https://docs.stackhawk.com/changelog/#december-13th%2C-2025 Sat, 13 Dec 2025 00:00:00 GMT HawkScan 5.0 adds multi-profile business logic testing, OpenAPI smart crawl plans, and sensitive data detection plugins. • Adds multi-profile scanning for business logic testing, enabling automated detection of BOLA and BFLA vulnerabilities by configuring multiple authentication profiles • Adds a smart crawl plan that automatically generates crawling strategies based on configured OpenAPI specifications to understand API structure and data relationships • Adds new passive scan plugins for sensitive data exposure: Credit Card Numbers (100008), Email Addresses (100009), HTML Comments (100011), and IBAN Numbers (100012) • Adds evidence chains to BOLA and BFLA alerts showing cross-profile access attempts and responses • Improves OpenAPI support by merging multiple specification files into a unified API definition Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#november-13th%2C-2025 https://docs.stackhawk.com/changelog/#november-13th%2C-2025 Thu, 13 Nov 2025 00:00:00 GMT StackHawk adds automated testing for five OWASP LLM Top 10 risks (Prompt Injection, Output Handling, etc.) • `Tests` now includes coverage for five OWASP LLM Top 10 risks: LLM01 Prompt Injection, LLM02 Improper Output Handling, LLM04 Unbound Consumption, LLM06 Sensitive Data Disclosure, and LLM09 System Prompt Leakage Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk https://docs.stackhawk.com/changelog/#october-23rd%2C-2025 https://docs.stackhawk.com/changelog/#october-23rd%2C-2025 Thu, 23 Oct 2025 00:00:00 GMT StackHawk adds official Semgrep integration for correlating DAST and SAST findings • Adds `Semgrep` integration to correlate StackHawk DAST findings with Semgrep SAST results and auto-link duplicate vulnerabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/stackhawk