vigolium

No entries match these filters. Clear filters

1. v0.5.5 Oct 24, 2026 · issue 120

   vigolium v0.5.5 adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. fuzzing, new fingerprint/hosts/dns subcommands, TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. output, and JSON schemas across core commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.5 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.5.5

   └──▷ TRY IT
   Fuzz an endpoint over HTTP/3 first, falling back through HTTP/2HTTP/2The second major version of the HTTP protocol, standardized by the IETF, adding multiplexed streams, header compression, and binary framing over a single TCP connection to cut latency and reduce overhead. and HTTP/1.1, to test behaviour across protocol versions.
   copy

   $ vigolium fuzz --http3 -u https://target.example.com/FUZZ -w builtin:default --fields pace.protocol,status,length

   Collect deep per-origin host facts — TLS certs, banners, favicons — for a set of targets before a pen-test engagement.
   copy

   $ vigolium fingerprint --depth full -u https://target.example.com

   Dump all stored hosts with SAN data and soft-404 signatures in TSV for easy import into a spreadsheet or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
   copy

   $ vigolium hosts --sans --soft-404 --format tsv

   • Adds --http-version, --http3, and --http3-only flags to fuzz, multiplexing over HTTP/3 → HTTP/2 → HTTP/1.1 with protocol reported as pace.protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds vigolium fingerprint subcommand with --depth light|standard|full to store per-origin host facts, vigolium hosts subcommand with --sans and --soft-404 flags to read stored host facts, and vigolium dns subcommand to resolve and store DNS records, with dig and host shims routing to it.
   • Adds vigolium schema storage [table] subcommand to describe tables, columns, and row counts, a --usage flag on any command, vigolium schema flags <command> -j for machine-readable flag docs, and JSON schemas for fuzz, replay, ingest, traffic body/headers, hosts, dns, fingerprint, and schema storage/flags.
   • Adds --format tsv output option to traffic, finding, endpoints, params, hosts, and dns commands, and adds --fields, --compact, and --max-output-bytes flags to fuzz, replay, endpoints, params, log ls, hosts, and dns.
   • Adds traffic --fields matches_not_found and --exclude-not-found flags, plus new uuid_short and response_headers fields to the shared --fields system, with nearest-name suggestions on typos.

   +4 more show less

   • Adds ingest -j to list stored items and failure reasons, plus --keep-blocked to store WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. block pages.
   • Adds favicon mmh3 hash output (Shodan/FOFA compatible) alongside existing MD5 and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes, and pins each origin's discovered protocol in discovery.engine.protocol with a dedicated brute_force_concurrency pool.
   • Adds php2shell-version passive module flagging vulnerable PHP 8.2–8.5 banners.
   • Record UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. flags now accept a unique 8+ character prefix, returning ambiguous_id on collision.
   • Adds --http-version, --http3, and --http3-only flags to fuzz, multiplexing over HTTP/3 → HTTP/2 → HTTP/1.1 with protocol reported as pace.protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds vigolium fingerprint subcommand with --depth light|standard|full to store per-origin host facts, vigolium hosts subcommand with --sans and --soft-404 flags to read stored host facts, and vigolium dns subcommand to resolve and store DNS records, with dig and host shims routing to it.
   • Adds vigolium schema storage [table] subcommand to describe tables, columns, and row counts, a --usage flag on any command, vigolium schema flags <command> -j for machine-readable flag docs, and JSON schemas for fuzz, replay, ingest, traffic body/headers, hosts, dns, fingerprint, and schema storage/flags.
   • Adds php2shell-version passive module flagging vulnerable PHP 8.2–8.5 banners.

   5 more in Everything

2. v0.5.4 Oct 18, 2026 · issue 113

   Adds oast.fallback_to_default config key to auto-re-register against oast.pro when a custom OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.4 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.5.4

3. v0.5.3 Oct 10, 2026 · issue 101

   vigolium v0.5.3 adds agent budgets, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. sessions, multi-tab crawling, finding lifecycle commands, and a new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. v2 opt-in across 80+ new surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.3 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.5.3

   └──▷ TRY IT
   Cap an agent autopilot run by cost and commands so runaway scans don't blow a budget.
   copy

   $ vigolium agent autopilot --auth-file creds.yaml --max-commands 50 --token-budget 100000 --max-cost-usd 2.00 https://example.com

   Verify a finding is still exploitable and record the verdict before closing a ticket.
   copy

   $ vigolium finding verify <finding-uuid> && vigolium finding mark <finding-uuid> --verdict confirmed

   Emit machine-readable CI output in GitHub annotation format to surface findings inline on a pull request.
   copy

   $ vigolium scan https://staging.example.com --format github

   • Adds --max-commands, --token-budget, and --max-cost-usd flags to cap agent run budgets (exit code 5 when exhausted).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --auth-file to agent swarm and agent autopilot for supplying credentials to agentic runs.
   • Adds --preflight-timeout and --no-preflight flags to control agent provider ping behaviour.
   • Adds agent triage --no-write / --no-probe and an inconclusive verdict.
   • Adds scan --dry-run / run <phase> --dry-run to print the resolved scan plan without sending any traffic.

   +5 more show less

   • Adds fuzz -r/--rate-limit global request cap.
   • Adds fuzz --fuzz new-param, --suffix, and a builtin params wordlist.
   • Adds --discovery-extensions and --discovery-max-depth flags.
   • Adds --known-issue-scan-templates to run specific nuclei templates.
   • Adds --format csv, junit, and github report formats for CI pipelines.
   • Adds --max-commands, --token-budget, and --max-cost-usd flags to cap agent run budgets (exit code 5 when exhausted).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --preflight-timeout and --no-preflight flags to control agent provider ping behaviour.
   • Adds scan --dry-run / run <phase> --dry-run to print the resolved scan plan without sending any traffic.
   • Adds --known-issue-scan-templates to run specific nuclei templates.
   • Adds --format csv, junit, and github report formats for CI pipelines.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !schema_version is now 2; scan commands print one scan document under -j instead of the previous structure.
   • !-j on a scan no longer implies --format jsonl.
   • !A -j document's command field is always the cobra path.
   • !import and js now use the global --format instead of their own.
   • !Remaining read commands print the -j envelope; use --json-legacy-keys to restore old keys.
   • !-j output is compact by default; use --pretty to indent.
   • !Color is automatic (auto) instead of always on.
   • !replay and fuzz print a human view by default; -j is now one envelope.
   • !traffic -j with tree/markdown/raw/burp output exits 2.
   • !agent audit now requires --source.
   • !An --ext extension that fails to load stops the scan; use --ext-allow-failures to restore the old behavior.
   • !ext lint errors on missing handlers and exports.
   • !Extension header objects are now case-insensitive, exposing get/getAll/has/entries/raw instead of the previous structure.
   • !project use no longer auto-creates a project; pass --create explicitly.
   • !auth load exits 1 on a failed login and runs the full scan login flow.
   • !auth totp prints the bare code; JSON output is now behind -j.
   • !--fail-on, scan diff, and --new-since now ignore dismissed findings.
   • !scan <uuid> exits 2 as a mistyped subcommand.
   • !server binds to 127.0.0.1 by default; a non-loopback ingest proxy now requires a token or allow-list.
   • !-S on server and ingest is now a usage error.
   • !scan / run with no target require --all-records to rescan the database.
   • !scan-url / scan-request enforce scope without -S; the REST equivalent returns 422.
   • !A scan whose every target is out of scope exits 1 with no_targets_in_scope.
   • !A scan with no reachable targets exits 1 with no_targets_reachable.
   • !modules_run now counts modules that executed; modules_loaded holds the old number.
   • !vigolium update now updates in-process with signature verification.
   • !VIGOLIUM_AUTO_UPDATE only acts at an interactive terminal.
   • !db export --format csv now uses standard quoting and neutralizes formula injection.
   • !An unknown X-Project-UUID header now returns 404 instead of creating a project.
   • !doctor exits 1 when not_ready.
4. v0.5.2 Oct 3, 2026 · issue 094

   vigolium v0.5.2 adds scan completeness fields, new spidering config keys, auth-gating, and several new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.2 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.5.2

   └──▷ TRY IT
   Fail a scan immediately when the login step is unsuccessful, ensuring no anonymous crawl data is collected for authenticated targets.
   copy

   $ vigolium scan-url https://app.example.com --require-auth

   Recover the database from a failed session-based scan for post-mortem triage instead of having it deleted.
   copy

   $ vigolium scan-url https://app.example.com -S session.db --keep-db-on-error

   • Adds completeness, stop_reason, and phase_outcomes fields to the scan row, REST object, and --format jsonl output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reasons and limits fields on phase.finished and scan.finished events, plus stop_reason on the scan line.
   • Adds --require-auth flag and spidering.require_auth config key so a failed login is fatal for that target.
   • Adds --keep-db-on-error flag to preserve a failed -S run's database under ~/.vigolium/recovered/.
   • Adds --glob-strict flag for --glob-db reads, with glob_sources accounting naming every skipped file.

   +9 more show less

   • Adds --max-output-bytes (opt-in) flag on finding, traffic, and db ls commands.
   • Adds --json-legacy-keys flag to restore the per-command row arrays replaced by items.
   • Adds spidering.interaction.*, spidering.identity_email_domain, spidering.graph_include_values, and spidering.max_capture_body_bytes config keys.
   • Adds make test-browser-conformance target running a browser conformance suite with a launch precheck.
   • Enables the browser sandbox by default; --browser-insecure restores the previous posture.
   • Enables SIGTERM to cancel a scan the same way Ctrl-C does.
   • Makes --events ndjson own stdout exclusively, with events carrying a seq field and a terminal event written after finalization.
   • Exits 1 with error.code: "export_failed" when a requested output cannot be written, instead of warning.
   • Makes single-file -o outputs publish atomically, leaving the previous file intact on failure.
   • Adds completeness, stop_reason, and phase_outcomes fields to the scan row, REST object, and --format jsonl output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reasons and limits fields on phase.finished and scan.finished events, plus stop_reason on the scan line.
   • Adds --require-auth flag and spidering.require_auth config key so a failed login is fatal for that target.
   • Adds --keep-db-on-error flag to preserve a failed -S run's database under ~/.vigolium/recovered/.
   • Adds --glob-strict flag for --glob-db reads, with glob_sources accounting naming every skipped file.

   +3 more show less

   • Adds --json-legacy-keys flag to restore the per-command row arrays replaced by items.
   • Adds spidering.interaction.*, spidering.identity_email_domain, spidering.graph_include_values, and spidering.max_capture_body_bytes config keys.
   • Adds make test-browser-conformance target running a browser conformance suite with a launch precheck.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The browser crawler no longer creates accounts, uploads or downloads files, and now cancels confirm() dialogs by default; spidering.interaction.* restores each behaviour individually.
   • !Crawl graph filenames are now crawl-graph-<host>-<scan>-<seq>.json (redacted and owner-only); any glob targeting the old filename pattern must be updated.
   • !-j now emits one document per invocation with items as the only row array; scripts relying on the old per-command row array names must pass --json-legacy-keys or be updated.
5. v0.5.1 Sep 24, 2026 · issue 085

   vigolium v0.5.1 adds Claude 5 pricing, reasoning_effort: max, adaptive thinking, and prompt caching for Anthropic models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.1 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.5.1

   └──▷ USE IT
   Cap token usage at the provider default rather than a hard limit, letting Anthropic apply its 64k ceiling automatically.
   yaml copy

   agent.olium.max_tokens: 0

   Push Anthropic models to their highest reasoning depth for complex audit runs that benefit from extended chain-of-thoughtchain-of-thoughtIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens..
   yaml copy

   reasoning_effort: max

   • Adds reasoning_effort: max for Anthropic, extending effort-level control to every provider that supports it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds agent.olium.max_tokens config key, defaulting to 0 (provider default, 64000 on Anthropic); oversized values are ignored.
   • Adds Claude 5 family pricing (Fable 5.1/5, Opus 5.5/5, Sonnet 5) in audit cost estimates.
   • Enables adaptive thinking for Claude 4.6+ models.
   • Adds conversation-tail prompt caching on Anthropic, reducing input cost on long agent loops.

   +1 more show less

   • Surfaces skill allowed-tools to the model, with warnings for tools the run does not expose.
   • Adds reasoning_effort: max for Anthropic, extending effort-level control to every provider that supports it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds agent.olium.max_tokens config key, defaulting to 0 (provider default, 64000 on Anthropic); oversized values are ignored.
   • Enables adaptive thinking for Claude 4.6+ models.
   • Adds conversation-tail prompt caching on Anthropic, reducing input cost on long agent loops.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !agent.olium.max_tokens now defaults to 0 (provider default); previously set oversized values are silently ignored on upgrade.
6. v0.5.0 Sep 22, 2026 · issue 083

   vigolium v0.5.0 adds scratch cleanup, hygiene module controls, and scope-origin tracking across JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory., export, and REST⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.0 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.5.0

   └──▷ TRY IT
   Reclaim disk space from vigolium scratch directories left behind by killed or interrupted scans older than 2 hours.
   copy

   $ vigolium kit tmp-clean --max-age 2h

   Run hardening advisory checks (hygiene modules) on a target without needing full deep intensity — useful for a focused advisory-only sweep in CI.
   copy

   $ vigolium scan -t example.com --module-tag hygiene

   Force hygiene hardening advisories on at a non-deep intensity level, or suppress them entirely even at deep, via the config key.
   yaml copy

   dynamic-assessment:
     hygiene_modules: true

   • Adds vigolium kit tmp-clean subcommand to collect abandoned vigolium scratch from the system temp directory left by interrupted runs, with --max-age (default 6h) controlling what counts as abandoned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --module-tag hygiene and --module-id <id> selectors to target the new hygiene module tag.
   • Adds dynamic-assessment.hygiene_modules config key to force hardening advisories on at any intensity or off even at deep.
   • Adds scans.scope_origin_mode field, carrying the resolved host-scope mode through --format jsonl, vigolium export, and the REST scan object.
   • Adds config.ResolveCLIOriginMode as the single fallback chain read by the matcher, banner, summary, snapshot, and scan row.

   +4 more show less

   • Adds a Host scope reference section documenting how --scope-origin also selects stored records.
   • The 14 hygiene-tagged hardening advisories no longer run at the default intensity; they now require --intensity deep, --module-tag hygiene, or the dynamic-assessment.hygiene_modules config key.
   • A single-phase stateless scan (run probe -t <host> -S) is several times faster (~0.78 s to ~0.12 s) due to bounded in-memory dedup tiers and executor drain improvements.
   • Startup is approximately 20 ms faster following the go-runewidth v0.0.27 to v0.0.30 upgrade.
   • Adds vigolium kit tmp-clean subcommand to collect abandoned vigolium scratch from the system temp directory left by interrupted runs, with --max-age (default 6h) controlling what counts as abandoned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --module-tag hygiene and --module-id <id> selectors to target the new hygiene module tag.
   • Adds dynamic-assessment.hygiene_modules config key to force hardening advisories on at any intensity or off even at deep.
   • Adds scans.scope_origin_mode field, carrying the resolved host-scope mode through --format jsonl, vigolium export, and the REST scan object.
   • Adds config.ResolveCLIOriginMode as the single fallback chain read by the matcher, banner, summary, snapshot, and scan row.

   +1 more show less

   • Adds a Host scope reference section documenting how --scope-origin also selects stored records.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The 14 hygiene-tagged hardening advisories (including express-session-audit) no longer fire at the default intensity — scans relying on these findings at default intensity will no longer produce them without adding --intensity deep, --module-tag hygiene, or configuring dynamic-assessment.hygiene_modules.
7. v0.4.9 Sep 20, 2026 · issue 083

   vigolium v0.4.9 adds source-map ingestion, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-wall redirect halting, new HTTP record fields, and major kit js-beautify flag expansion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.4.9 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.4.9

   └──▷ TRY IT
   Beautify and unpack a large bundled JS file with an increased ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. node budget and a time deadline to prevent runaway scans.
   copy

   $ vigolium kit js-beautify -o output.js --unpack-modules --max-ast-nodes 500000 --max-input-mb 50 --deadline 60s bundle.js

   • Adds sourcemap-ingest active module that fetches exposed source maps, secret-scans the recovered originals, and ingests their routes into the scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds http_records.target, root_uuid, and chain_truncated fields — exposing the submitted target, O(1) chain-root lookup, and whether a redirect chain stopped short.
   • Adds -o, --modules, --profile, --unpack-modules, --max-ast-nodes, --max-input-mb, and --deadline flags to kit js-beautify; -j output gains status, diagnostics, and per-endpoint provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
   • Adds max_unpack_input_mb (default 16 MiB) to bound the source-level unpack pass independently of the AST node ceiling.
   • Adds shared jstangle/sourcemap package providing a single canonical definition of a map reference, sibling candidate, and parsed map.

   +3 more show less

   • Extends source-map detection to cover CSS, eval strings, SourceMap/X-SourceMap response headers, and unreferenced <bundle>.map sibling files.
   • Redirects now halt at a login/SSO wall under every --redirect-mode, with each phase reporting the walls it hit and an example target.
   • Raises maxBundleModules default from 64 to 512, orders modules by endpoint likelihood before the cap, and gives each sub-scan its own AST node budget.
   • Adds sourcemap-ingest active module that fetches exposed source maps, secret-scans the recovered originals, and ingests their routes into the scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds http_records.target, root_uuid, and chain_truncated fields — exposing the submitted target, O(1) chain-root lookup, and whether a redirect chain stopped short.
   • Adds max_unpack_input_mb (default 16 MiB) to bound the source-level unpack pass independently of the AST node ceiling.
   • Adds shared jstangle/sourcemap package providing a single canonical definition of a map reference, sibling candidate, and parsed map.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !pkg/spitolas/loginsig has moved to pkg/authsig — any code importing the old path will break.
   • !--record-redirect-chain no longer gates request/response re-pairing, only hop rows — setups that relied on this flag to suppress re-pairing will behave differently.
8. v0.4.7 Sep 18, 2026 · issue 083

   vigolium v0.4.7 adds targeted traffic body/header extraction, per-command file output, and exact URL filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.4.7 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.4.7

   └──▷ TRY IT
   Dump a filtered traffic listing to a JSON file in CI — the file gets the result document while the terminal gets a short receipt.
   copy

   $ vigolium traffic -j --url https://api.example.com/v1/login --url https://api.example.com/v1/token -o traffic_matches.json

   Narrow a db ls query to two exact endpoints and save results to a file for further processing.
   copy

   $ vigolium db ls -j --url https://api.example.com/auth --url https://api.example.com/session -o db_export.json

   • Adds vigolium traffic body and vigolium traffic headers subcommands to extract one side of a stored exchange to stdout or a file without re-sending the request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -o/--output flag to traffic -j, finding -j, and db ls -j to write the result document to a file and print a receipt to stdout.
   • Adds --url flag to traffic and db ls for exact URL selection, repeatable and OR-ed, applied before pagination.
   • db stats now reports path and size fields for the source path and on-disk size.
   • Adds vigolium traffic body and vigolium traffic headers subcommands to extract one side of a stored exchange to stdout or a file without re-sending the request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Pointing a read command at a missing --db/$VIGOLIUM_DB_PATH path no longer creates the database and returns total: 0 — it now exits with source_missing. A foreign SQLite file that previously gained vigolium's tables now exits with source_incompatible instead.
   • !Default concurrency is now 25 everywhere; previously the CLI, pace config, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and discovery source used inconsistent values of 50, 40, 50, and 50.
9. v0.4.6 Sep 13, 2026 · issue 083

   vigolium v0.4.6 adds run probe host sweeps, TLS fingerprinting, redirect-chain tracking, and a deterministic surface_score on every record.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.4.6 https://github.com/vigolium/vigolium.git
   # already have the repo? check out this version:
   $ git checkout v0.4.6

   └──▷ TRY IT
   Sweep thousands of hosts from a recon list with passive TLS fingerprinting and no fuzzing budget consumed.
   copy

   $ vigolium run probe -T hosts.txt -c 20 --tls-probe -j

   After a sweep, rank hosts by attack-surface score to prioritise which ones deserve a full scan.
   copy

   $ vigolium db ls --sort surface_score --min-surface 40

   Group sweep traffic by status code to quickly triage redirect vs. live vs. dead targets in a project.
   copy

   $ vigolium traffic --source probe --group-by status_code --group-limit 20

   • Adds vigolium run probe (aliases: probing, httpx, alive, sweep) for passive-only host sweeps — one request per target, no fuzzing, enabling -T hosts.txt -c 20 to reach thousands of hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --tls-probe to complete a TLS handshake per HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint and report negotiated version/cipher plus leaf certificate details (subject/CN, SANs, issuer, validity window, serial, MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications./SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. fingerprints) under a tls key.
   • Adds --redirect-mode off|same-host|same-apex|any (default any) to control redirect-following scope, replacing the former FollowRedirects/FollowHostRedirects bool pair.
   • Adds --record-redirect-chain to store each followed redirect hop as its own http_records row chained through parent_uuid (on by default under run probe).
   • Adds http_records.response_location column storing a 3xx Location header verbatim, enabling traffic --tree to display redirect destinations without re-parsing stored response bytes.

   +11 more show less

   • Adds http_records.surface_score — a deterministic, absolute percentage of 17 attack-surface signals (auth boundary, non-standard port, dynamic origin, permissive CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript., leaked internals, API surface, input surface, etc.) written by the new surface-scoring passive module.
   • Adds db ls --min-surface, --sort surface_score, and a SURFACE column to db ls; exposes min_surface/min_surface_score on the records APIs and in -j/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory., CSV export, and inspect_record.
   • Adds --export-only on scan/run to limit --format jsonl output to chosen record types, reusing the export --only vocabulary.
   • Adds traffic --group-by <field> to count matched records by host, method, status_code, response_content_type, source, scan_uuid, ip, or is_authenticated, bounded by --group-limit.
   • Adds --no-response as an alias for --omit-response to skip storing response bodies on sweep runs.
   • Populates http_records.technology during a scan via the surface-scoring flush, which writes the full fingerprint-module stack onto every record for a host.
   • Adds error.code: "source_incompatible" for a valid SQLite file that is not a vigolium store, replacing the generic failed error.
   • Adds spa to the known tech tags so modules can gate logic on client-side-routing detection.
   • Adds --json-legacy-keys flag (and VIGOLIUM_JSON_LEGACY_KEYS=1 env var) to restore the deprecated records/findings/scans/rows/stats envelope keys for callers still migrating.
   • Probe rows are labelled probe and filterable via traffic --source probe, making sweeps separable from full scans within the same project.
   • Registry grows to 207 active and 117 passive modules.
   • Adds vigolium run probe (aliases: probing, httpx, alive, sweep) for passive-only host sweeps — one request per target, no fuzzing, enabling -T hosts.txt -c 20 to reach thousands of hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --tls-probe to complete a TLS handshake per HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint and report negotiated version/cipher plus leaf certificate details (subject/CN, SANs, issuer, validity window, serial, MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications./SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. fingerprints) under a tls key.
   • Adds --redirect-mode off|same-host|same-apex|any (default any) to control redirect-following scope, replacing the former FollowRedirects/FollowHostRedirects bool pair.
   • Adds --record-redirect-chain to store each followed redirect hop as its own http_records row chained through parent_uuid (on by default under run probe).
   • Adds http_records.response_location column storing a 3xx Location header verbatim, enabling traffic --tree to display redirect destinations without re-parsing stored response bytes.

   +6 more show less

   • Adds http_records.surface_score — a deterministic, absolute percentage of 17 attack-surface signals (auth boundary, non-standard port, dynamic origin, permissive CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript., leaked internals, API surface, input surface, etc.) written by the new surface-scoring passive module.
   • Adds --export-only on scan/run to limit --format jsonl output to chosen record types, reusing the export --only vocabulary.
   • Adds traffic --group-by <field> to count matched records by host, method, status_code, response_content_type, source, scan_uuid, ip, or is_authenticated, bounded by --group-limit.
   • Adds spa to the known tech tags so modules can gate logic on client-side-routing detection.
   • Adds --json-legacy-keys flag (and VIGOLIUM_JSON_LEGACY_KEYS=1 env var) to restore the deprecated records/findings/scans/rows/stats envelope keys for callers still migrating.
   • Probe rows are labelled probe and filterable via traffic --source probe, making sweeps separable from full scans within the same project.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !surface_score is now a percentage of the 17-signal set rather than a 10-point-per-signal scheme; scores from earlier scans are not comparable to new ones.
   • !The -j/JSONL envelope no longer emits the legacy records/findings/scans/rows/stats keys by default; callers must pass --json-legacy-keys or set VIGOLIUM_JSON_LEGACY_KEYS=1 to restore them.
10. v0.4.5 Sep 4, 2026 · issue 083

    vigolium v0.4.5 adds NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. event streams, tool shims, batch ingest, and a stable machine-output envelope across all commands⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.5 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.4.5

    └──▷ TRY IT
    Stream structured scan events to a monitoring process in CI while keeping the human-readable log on stderr.
    copy

    $ vigolium scan https://example.com --events ndjson 2>scan.log | jq 'select(.event == "finding.new")'

    Assert that the vigolium schema version matches what your driver expects before starting a long scan pipeline.
    copy

    $ vigolium version --json | jq -e '.schema_version == "expected-version" and .db_schema_version == "expected-db-version"'

    Cap only the nuclei-backed known-issue phase to 20 req/s without throttling native modules when scanning a rate-sensitive target.
    copy

    $ vigolium scan https://example.com --rate-limit known-issue-scan=20

    • Adds --events ndjson to scan/run/scan-url/scan-request for a live NDJSON event stream on stdout emitting scan.started, phase.started|progress|finished, waf.block, waf.pacing, finding.new, error, and scan.finished events while the human console remains on stderr.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a repeatable phase qualifier to the pace dials — e.g. --rate-limit known-issue-scan=20 — so individual phases can be capped independently without affecting other modules.
    • Adds vigolium ffuf|nuclei|katana|gau|arjun tool shims that accept each tool's own argv, print the translation, and run the native phase into the pinned database.
    • Adds batch ingest: -i is now repeatable and --dir/--dir-glob walk a directory, so N specs cost one process instead of N invocations.
    • Adds vigolium version --json, which reports schema_version and db_schema_version so a consumer can detect contract drift at startup.

    +6 more show less

    • Adds filter flags --host, --path, --method, --status, --search, --from/--to, -n, --all-hosts, and --yes to import -B, matching the filter set traffic -B already had.
    • Standardises exit codes across all commands: 0 success, 1 error, 2 usage error, 3 fuzz --fail-on-match, 4 --fail-on gate tripped.
    • Unifies machine output under one -j envelope — {schema_version, command, project_uuid, db_path, total, offset, limit, items, query} — for every command, with each command's old row key kept as a deprecated alias; db stats -j is no longer an exception.
    • Renames --fuzz-wordlist to --discovery-wordlist (old spelling kept as a deprecated alias) to eliminate collision with vigolium fuzz -w.
    • Adds --templates-dir flag to pin the nuclei-templates directory per run.
    • Enables finding --push-to-burp and --to-repeater to compose rather than being mutually exclusive, matching replay behaviour.
    • Adds --events ndjson to scan/run/scan-url/scan-request for a live NDJSON event stream on stdout emitting scan.started, phase.started|progress|finished, waf.block, waf.pacing, finding.new, error, and scan.finished events while the human console remains on stderr.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds vigolium ffuf|nuclei|katana|gau|arjun tool shims that accept each tool's own argv, print the translation, and run the native phase into the pinned database.

    9 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Exit code 1 previously meant both scan crashed and scan found something; it now means only error. Automation that tested exit == 1 to detect findings must switch to exit == 4 (for --fail-on gates) or exit == 3 (for fuzz --fail-on-match).
    • !The -j envelope schema changed for every command: each command's payload is now under a unified {schema_version, command, project_uuid, db_path, total, offset, limit, items, query} structure; drivers that read the old per-command row key must migrate (the old key is retained only as a deprecated alias).
    • !Machine-output timestamps now carry exactly three fractional digits plus an epoch-millisecond sibling; consumers relying on microsecond-precision fractional timestamps will see a change in format.
    • !--fuzz-wordlist is renamed to --discovery-wordlist; the old spelling is kept as a deprecated alias, so scripts using --fuzz-wordlist will still run but should be updated.
    • !-S is now --stateless everywhere; on server/ingest the old meaning of --scan-on-receive is now a deprecated alias that emits a warning.
    • !An unfiltered import -B is now refused unless --all-hosts is explicitly passed; existing scripts that called import -B without host filters will fail with a pre-flight count prompt.
11. v0.4.4 Aug 30, 2026 · release notes

    vigolium v0.4.4 adds --raw/--burp/--markdown evidence fetch by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and streaming export to reduce memory for large result sets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.4 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.4.4

    • finding output now omits the full record corpus and instead requires a separate fetch of the evidence payload (available via --raw, --burp, --markdown, --with-records, --push-to-burp, or --to-repeater) by UUID.
    • A new single-format export command streams envelope data rather than materializing the entire result set in memory, accumulating summary statistics on the fly.
    • Scratch databases left behind from a killed run are automatically reaped (age-based) when the next database session is opened.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !finding output no longer includes the full record corpus; users must now explicitly fetch evidence using flags like --raw, --burp, or --with-records.
12. v0.4.3 Aug 19, 2026 · release notes

    Windows support added: new builds, platform-aware discovery, and updated environment variables for v0.4.3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.3 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.4.3

    • Adds windows/amd64 builds shipped as .zip via make public-release and the npm package.
    • Adds VIGOLIUM_PROJECT_UUID and VIGOLIUM_PROJECT_NAME environment variables to replace the removed VIGOLIUM_PROJECT.
    • New CLI flags --project-uuid and --project-name take precedence for project identification.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The VIGOLIUM_PROJECT environment variable is removed; users must use VIGOLIUM_PROJECT_UUID or VIGOLIUM_PROJECT_NAME.
13. v0.4.2 Aug 15, 2026 · release notes

    Adds X-Author response header and caps POST /api/scan-records record_uuids at 10,000

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.2 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.4.2

    • X-Author response header added alongside the Server: banner.

    1 detail in Everything

14. v0.4.1 Aug 13, 2026 · release notes

    Adds vigolium kit CLI for standalone secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. callbacks, and payload generation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.1 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.4.1

    └──▷ USE IT
    Scan a directory for leaked secrets without running a full scan.
    shell copy

    vigolium kit secret-scan ./src

    Mint an OAST callback URL for testing blind vulnerabilities.
    shell copy

    vigolium kit oast new

    Unminify a JavaScript file to aid manual review of bundled code.
    shell copy

    vigolium kit js-beautify -i bundle.min.js > bundle.source.js

    • Adds vigolium kit command to expose scanner primitives as one-shot tools.
    • Adds kit secret-scan subcommand to scan files, dirs, or stdin for leaked credentials using the built-in secret catalog.
    • Adds kit js-beautify subcommand to unminify JavaScript bundles from file, URL, or stdin.
    • Adds kit oast new and kit oast poll subcommands to mint OOB/OAST callback URLs and drain received interactions.
    • Adds kit harvest subcommand to collect known URLs for a domain from public archives and indexes.

    +3 more show less

    • Adds kit jwt-crack subcommand to recover a JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.'s HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. signing secret from a wordlist.
    • Adds kit wordlist subcommand to list built-in wordlists or print one to stdout.
    • Adds kit payload subcommand to emit built-in payload sets by vulnerability class.

    8 details in Everything

15. v0.3.12 Aug 10, 2026 · release notes

    Adds SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. output format and Caido proxy bridge support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.12 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.12

    └──▷ USE IT
    Connect to the Caido proxy bridge using the new alias flag.
    shell copy

    vigolium scan --target https://example.com --caido-bridge-url http://localhost:8080

    Ingest HTTP traffic from a client declaring itself as caido via the new header.
    shell copy

    curl -X POST https://vigolium.example.com/api/ingest-http -H 'Content-Type: application/json' -H 'X-Vigolium-Source: caido' -d '{"records": [...]}'

    • Adds sarif output format to scan, scan-url, scan-request, run, export, and import --format commands, emitting SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. 2.1.0 logs compatible with GitHub code scanning and DefectDojo.
    • Adds --caido-bridge-url (alias -B) to replace or supplement --burp-bridge-url for connecting to the Caido proxy bridge.
    • Adds vendor identity labeling in bridge traffic: listeners report implementation via /health, /search, and /inspect, mapping to traffic.source.
    • Adds X-Vigolium-Source header support on POST /api/ingest-http to allow clients (e.g., Caido plugin) to declare their vendor (burp, caido) during ingest.
    • Adds X-Vigolium-Bridge-Source response header on GET /api/http-records to identify the vendor that answered the request.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Listener predating this release is read as Burp silently; rows imported from Caido before this release stay labelled burp and cannot be reclassified after the fact.
16. v0.3.11 Aug 9, 2026 · release notes

    vigolium v0.3.11 adds keyless arquivo source and body mining for wayback/commoncrawl archives

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.11 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.11

    • arquivo source — keyless web-archive index, added to the default source set.
    • wayback body mining — replays captures via /web/<ts>id_/ and walks each host's robots.txt history to recover paths no index holds.
    • commoncrawl body mining — range-fetches each index row's WARC record (one small gzip member) and extracts in-scope URLs from the body.
    • urlscan task.url — also collects the originally-submitted URL, not only the final loaded one.

    4 details in Everything

17. v0.3.10 Aug 7, 2026 · release notes

    Adds WSDL/SOAP scanning with -I wsdl, auto-detection, and live endpoint discovery

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.10 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.10

    └──▷ USE IT
    Scan a local WSDL file to generate SOAP POST traffic for active modules.
    shell copy

    vigolium -I wsdl ./service.wsdl

    Scan a live SOAP service endpoint by letting the tool auto-discover and fetch its WSDL.
    shell copy

    vigolium -I svc https://example.com/service.svc?singleWsdl

    • -I wsdl (aliases soap/svc) for parsing WSDL 1.1 / SOAP descriptions into scan traffic
    • Content-sniff auto-detection of .wsdl files without explicit -I flag
    • .svc and .asmx URL support to auto-fetch WSDL via ?singleWsdl or ?WSDL parameters

    3 details in Everything

18. v0.3.9 Aug 7, 2026 · release notes

    Adds multi-format exports, stateless autopilot mode, prompt-file support, and VIGOLIUM_DB_PATH env var

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.9 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.9

    └──▷ TRY IT
    Export findings in HTML, Markdown, and a bundle simultaneously to a single directory without re-scanning the database
    copy

    $ vigolium export --format html,markdown,bundle -o ./exports/run1

    Run a stateless autopilot session using guidance from a file without modifying the persistent database
    copy

    $ vigolium agent autopilot -S --prompt-file tasks.md

    • export --format accepts a comma-separated list (e.g. html,markdown,bundle) to produce multiple outputs from a single database read
    • agent autopilot -S/--stateless runs the agent into a throwaway database, mirroring vigolium scan -S for ephemeral runs
    • agent autopilot and swarm now support --prompt-file to load task guidance from a file instead of shell escaping

    3 details in Everything

19. v0.3.8 Aug 6, 2026 · release notes

    vigolium v0.3.8 adds six new detection modules (SSI/JS injection, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. header, RPO, etc) and unified date filtering across read commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.8 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.8

    └──▷ TRY IT
    Filter findings to only include those from the last 2 days using relative offset syntax.
    copy

    $ vigolium finding --from 2d

    Import seed URLs from a Burp Suite scope export file to start a new scan.
    copy

    $ vigolium find -i burpscope:scope.txt

    Limit spider depth and output the crawl graph to a specific directory for analysis.
    copy

    $ vigolium find --max_depth 3 --graph_output_dir ./graph_out

    • Adds ssi-injection module for Server-Side Includes injection detection
    • Adds server-side-js-injection module for server-side JavaScript (Node) injection detection
    • Adds smtp-header-injection module for SMTP header injection via email-bearing parameters
    • Adds react-rsc-rce module for React Server Components RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. probe
    • Adds dependent-response module to detect responses that change based on a spoofable request header

    +6 more show less

    • Adds path-relative-stylesheet module to detect path-relative stylesheet import (RPO) exposure
    • Adds --from/--to date filtering to finding, traffic, db ls, db export, and replay commands
    • Adds burpscope input mode to parse a Burp Suite scope export for seed URLs
    • Enables Frontier seeding from robots.txt and sitemap.xml by default
    • Enables speculative link scraping from inline scripts and HTML comments by default
    • Adds spidering knobs max_depth, max_states, self_register, and graph_output_dir

    11 details in Everything

20. v0.3.7 Aug 4, 2026 · release notes

    New fuzz attack modes, anomaly scoring, curl parity and replay filters in v0.3.7

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.7 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.7

    └──▷ TRY IT
    Scan a target using the new clusterbomb mode with anomaly scoring to filter out normal status variations.
    copy

    $ vigolium fuzz --mode clusterbomb -a --target <url> -F FUZZ

    Replay traffic using browser context and existing traffic filters for a complete reconstruction.
    copy

    $ vigolium replay --with-browser --filters <traffic_filter_rules>

    Test --form data handling in the new fuzz module to ensure it matches curl's behavior exactly.
    copy

    $ vigolium fuzz --form "field=value" --target <url>

    • Adds fuzz support for curl long-form flags with shared body assembly so --data-urlencode and --form behave identically to raw curl commands
    • Adds -a/--anomaly flag to fuzz that scores responses against the run population to reduce false positives on status changes
    • Adds sniper, batteringram, pitchfork, and clusterbomb attack modes for the fuzz command with numbered FUZZ markers
    • Adds comparison-predicate matcher grammar (N-M, >N, !N) to the fuzz attack modes
    • Adds --with-browser flag to replay bulk pattern search which emits a browser object for navigation context

    +2 more show less

    • Reuses traffic filters verbatim in replay bulk pattern search for consistent traffic analysis
    • Implements adaptive per-host concurrency ramps above MaxPerHost (2× headroom) with WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. auto-arm protection

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The four costliest probes are now tagged heavy instead of moderate, which changes their behavior under --intensity quick
21. v0.3.5 Jul 28, 2026 · release notes

    vigolium v0.3.5 adds modkit.EndpointVolatile, bulk traffic search in replay, and removes --mutate

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.5 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.5

    • vigolium replay <term> now supports traffic-style bulk selection with --search, --exclude-search, --from, --to, and pagination flags.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !vigolium replay --mutate flag removed; payload fuzzing is now exclusively in vigolium fuzz
22. v0.3.4 Jul 21, 2026 · release notes

    Adds --send-via-burp, --to-repeater, and --to-organizer flags to replay/fuzz/finding for Burp integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.4 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.4

    └──▷ USE IT
    Replay a mutated request through Burp's HTTP engine to preserve unusual headers like Content-Length for desync testing.
    shell copy

    vigolium replay --send-via-burp --http-mode http1 --burp-bridge-url http://127.0.0.1:8081 <target>

    Stage a fuzzing match into Burp's Organizer for manual triage of anomalies.
    shell copy

    vigolium fuzz --matches-to-organizer --burp-bridge-url http://127.0.0.1:8081 <target>

    Send a finding's evidence to Burp Repeater for manual confirmation and replay.
    shell copy

    vigolium finding --push-to-burp --to-repeater --send-via-burp --burp-bridge-url http://127.0.0.1:8081 <finding_id>

    • replay gains --send-via-burp, --to-repeater, and --to-organizer flags to route mutated requests through Burp's HTTP engine or stage them in the Repeater/Organizer.
    • fuzz supports --send-via-burp for byte-for-byte payload delivery and --matches-to-organizer to push matched anomalies into Burp Organizer.
    • finding gains --push-to-burp (with --to-repeater and --send-via-burp) to send evidence requests to Burp Organizer or Repeater for manual triage.
    • New pkg/burpbridge client methods (Send, SendToRepeater, SendToOrganizer, Health) expose /api/burp-bridge/{send,repeater,organizer} endpoints and require --burp-bridge-url.

    4 details in Everything

23. v0.3.1 Jul 14, 2026 · release notes

    New agent autopilot mode with durable state, context rotation, verify-before-promote verification, and resumption via --resume

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

    └──▷ TRY IT
    Resume a previously interrupted durable autopilot run using its persisted session state.
    copy

    $ vigolium agent autopilot --resume <agentic-scan-uuid> --session-dir /tmp/vigolium-run

    • Adds the agent.olium.autopilot_mode config key (shadow, enforced) to enable a bounded-section operator with context rotation instead of unbounded history accumulation
    • Adds --resume <agentic-scan-uuid> flag to restart an autopilot run from persisted agent_sections and agent_finding_candidates state
    • Adds --knowledge-base <file|dir> / --knowledge-base-raw flags for read-on-demand operator reference docs that produce a cached <session-dir>/knowledge-base-brief.md on resume
    • Adds --prior-context auto|summary|off flag to mine prior traffic/findings from the project DB before the run's pre-scan phase

    4 details in Everything

24. v0.3.0 Jul 12, 2026 · release notes

    v0.3.0 adds Burp Suite live bridge integration, jstangle ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based JS analysis engine, and in-process secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    └──▷ USE IT
    Sync live Burp Proxy traffic into Vigolium for analysis using the loopback bridge.
    shell copy

    vigolium traffic --burp-bridge-url http://127.0.0.1:9009

    • Adds --burp-bridge-url CLI flag and VIGOLIUM_BURP_BRIDGE_URL env var to sync traffic with Burp Suite via loopback listener on http://127.0.0.1:9009.
    • Adds POST /api/burp/sitemap/snapshot endpoint for ingesting Target Site map snapshots from the burp-vigolium extension.
    • Introduces jstangle, a rebuilt AST-based JavaScript intelligence engine replacing the previous regex-based jsscan.
    • Adds in-process secret scanning via pkg/secretscan driven by wasilibs/go-re2, eliminating the dependency on the external kingfisher binary.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The config key jsscan: is renamed to jstangle:.
    • !The config key disable_kingfisher and its associated DisableKingfisher field are renamed to disable_secret_scan and DisableSecretScan respectively.
25. v0.2.4 Jul 9, 2026 · release notes

    vigolium v0.2.4 adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. block warnings, doctor browser smoke-test, and auto-skips known-issue scans for targeted modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.4 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.2.4

    └──▷ TRY IT
    Fix a broken system browser by downloading a working alternative automatically via the doctor command.
    copy

    $ vigolium doctor --fix --only chrome

    Run only specific modules for a targeted scan, which automatically skips the broad known-issue-scan pass to reduce output noise.
    copy

    $ vigolium scan --module-id aspnet_blazor_exposure,php_debug_exposure https://target.com

    • Prints [waf-block-detected] warning when edge filtering blocks scan traffic across all phases
    • Expands WAF/CDN + bot-management detection to include Azure Front Door, FortiWeb, DataDome, PerimeterX, and others via updated pkg/deparos/waf fingerprints
    • doctor command now performs a real Chromium headless smoke-test via pkg/browserprobe instead of trusting the --version banner
    • Narrowing a scan with --module-id or -m/--modules auto-appends --skip known-issue-scan to reduce noise in targeted scans
    • scan-url and scan-request commands now surface WAF/CDN block warnings for direct HTTP requests

    +1 more show less

    • Finding tree leaves now display (confidence, active|passive) tags with color-coded module type labels

    6 details in Everything

26. v0.2.3 Jul 7, 2026 · release notes

    Adds --exclude-search/header/body flags for filtering findings by term and expands search scope to full request/response corpus

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.3 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.2.3

    • --exclude-search, --exclude-header, --exclude-body on finding, traffic, db ls to drop rows matching specific terms
    • --search / --header / --body now scan the full request/response corpus (URL, path, headers, body) instead of just URL/path

    2 details in Everything

27. v0.2.2 Jul 7, 2026 · release notes

    Adds severity filtering and per-source attribution to finding/db list commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.2 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.2.2

    • --severity / --sev filter on finding and db list allows comma-separated severity lists with single-letter shorthands and unambiguous prefixes.
    • finding and traffic listings now show a "Filtered by:" summary line echoing active conditions like severity and host, suppressing for JSON output.
    • --glob-db merged reads now attribute findings to their source database path, showing one db-path root per source file in finding/traffic trees.

    3 details in Everything

28. v0.2.1 Jul 6, 2026 · release notes

    v0.2.1 adds 11 new detection modules (XPath, OOB SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. fingerprinting), three agent providers (OpenAI Responses, Claude bridge, Anthropic proxy), and traffic dump capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.1 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.2.1

    └──▷ USE IT
    Run a scan and dump the raw HTTP traffic for inspection.
    shell copy

    vigolium scan --url <target> --print-traffic

    Configure the agent to use a specific binary for the Claude SDK bridge provider.
    yaml copy

    agent:
      olum:
        bridge_binary: '/usr/local/bin/vigolium-audit'

    List findings and select only results at positions 2 through 4.
    shell copy

    vigolium finding --pick 2-4

    • xpath-injection active module for XPath injection detection
    • sqli-out-of-band active module detecting blind SQLi via OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. callbacks on per-payload subdomains
    • unauth-service-exposure active module identifying unauthenticated backend admin/data services
    • tls-protocol-cipher-audit active module auditing weak TLS protocol and cipher-suite configurations
    • llm-endpoint-fingerprint passive module detecting LLM/AI API endpoints using the new infra/llmsig catalog

    +16 more show less

    • payment-integration-audit passive module flagging Stripe, PayPal, Braintree, Square, Adyen, Razorpay, and Checkout.com surfaces
    • css-injection-detect passive module detecting input reflected into CSS contexts
    • dom-clobbering passive module identifying JavaScript sinks fed from named globals
    • cross-origin-isolation-audit passive module flagging missing COOP/COEP/CORP headers
    • reverse-tabnabbing-detect passive module identifying target=_blank links without rel=noopener
    • New vigolium skills subcommand to list, get, and install coding-agent skills from the registry
    • New openai-responses provider for the public OpenAI Responses API (POST https://api.openai.com/v1/responses) with default model gpt-5.5
    • New anthropic-claude-sdk-bridge provider using a vigolium-audit bridge sidecar, controlled via agent.olium.bridge_binary or --bridge-bin
    • New anthropic-compatible provider for custom /v1/messages-compatible endpoints at agent.olium.custom_provider.base_url
    • scan --print-traffic and --print-traffic-tree flags to dump HTTP request/response pairs or host/path hierarchies after a scan
    • finding --tree view collapsing findings by title into a host/path hierarchy with recurrence counts
    • finding --pick positional selector for narrowing result pages to specific 1-based positions (e.g., --pick 2-4)
    • Repeatable AND-combined --search on finding and traffic commands to further narrow matches
    • JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. scanner gains jku/x5u forgery legs pointing at OAST URLs and kid path-traversal token testing
    • XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery. scanner gains blind/out-of-band detection via per-payload external-entity DTD templates referencing unique OAST URLs
    • Sensitive-file discovery adds signatures for walkable .git trees, Terraform state files (*.tfstate), and docker-compose files

    21 details in Everything

29. v0.2.0 Jul 5, 2026 · release notes

    vigolium v0.2.0 stable release adds GraphQL, AEM, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. detection modules plus import/replay enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    • Adds the graphql_scan module with operation-name expansion, introspection, query batching, field-level authorization (IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data.), reflected-XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.-in-errors, boolean-based SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., and DoS detection via a new pkg/graphqlx library
    • Adds aem_* active modules (11) and passive module for Adobe Experience Manager with discovery and RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. detection gated by the infra/aem ConfirmAEM gate
    • Adds SaaS data-exposure detection modules for Salesforce, ServiceNow, and Power Pages via the infra/saasprobe gate
    • Adds iis-shortname-discovery, iis-cookieless-source-disclosure, and iis-extension-confusion-bypass modules for IIS ASPX environments
    • Adds mcp-tool-definition-drift and mcp-dos-amplification active modules and the mcp-dangerous-tool-exposure passive module to extend Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. auditing

    +7 more show less

    • Adds dependency-confusion passive module that extracts scoped npm import specifiers from first-party JS responses and flags unclaimed packages on registry.npmjs.org
    • Adds js_beautify passive module that unpacks minified scripts via an embedded webcrack subprocess, rewriting stored record bodies for improved link analysis
    • Adds the vigolium import subcommand to merge another vigolium SQLite result database into a destination database
    • Adds the --passive-only flag to vigolium server to restrict scanning to passive modules on ingested requests
    • Adds bulk replay capability to vigolium replay via --all or filter flags (--host, --method, etc.) to replay multiple stored records at once
    • Adds --stateless and --db <file> support to vigolium replay for reading baselines from standalone exports without project scoping
    • Secret findings are now labeled by credential family (e.g., JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store., Google API key) in the meta.pattern field and with leading brackets in output

    12 details in Everything

30. v0.1.43-beta Prerelease Jun 30, 2026 · release notes

    Adds bare vigolium scan --resume, --format fs export, and server --mirror-fs in v0.1.43-beta

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.43-beta https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.1.43-beta

    └──▷ TRY IT
    Mirror live scan results to a local filesystem directory as they are recorded.
    copy

    $ vigolium server --mirror-fs /path/to/mirror

    • Adds bare vigolium scan --resume to auto-rebuild and relaunch parallel scans from a .progress.json manifest
    • Adds --format fs for flat, browsable export of traffic and findings with no DB needed
    • Adds vigolium server --mirror-fs <dir> to mirror records/findings to a live filesystem tree

    3 details in Everything

31. v0.1.35-beta Prerelease Jun 17, 2026 · release notes

    vigolium v0.1.35-beta adds -T target files, sqlite output, stateless scans, and intensity-driven scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.35-beta https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.1.35-beta

    └──▷ USE IT
    Scan targets from multiple files simultaneously using the new repeatable -T flag.
    shell copy

    vigolium scan -T urls1.txt -T urls2.txt --intensity deep

    Export findings to a SQLite database for downstream analysis using the new sqlite format.
    shell copy

    vigolium scan -o results.db --format sqlite

    Run a stateless audit directly from an existing SQLite database for quick reporting.
    shell copy

    vigolium finding -S --db past_scan.db -m

    • -T/--target-file repeats to merge multiple URL lists into a single scan run
    • --format sqlite exports findings to SQLite (requires -S and -o flags)
    • -S/--stateless enables stateless mode for finding and traffic commands, reading directly from a .sqlite database
    • --intensity flag controls module grouping with tiers: light, moderate, heavy, intrusive, balanced, quick, and deep
    • vigolium audit provides a top-level alias for stateless audits that auto-render an HTML report

    +2 more show less

    • -m/--markdown renders findings and traffic records as Markdown output
    • --follow-subdomains feeds in-scope subdomains extracted from JS bundles back into the scan (automatically enabled at --intensity deep)

    7 details in Everything

32. v0.1.25-beta Prerelease Jun 7, 2026 · release notes

    Vigolium v0.1.25-beta adds SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly./OS injection detections, --ingest-proxy-port, --skill overrides, and /api/agent/scans/:uuid/cancel endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.25-beta https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.1.25-beta

    └──▷ USE IT
    Cancel a running agentic scan via the API using its UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.
    shell copy

    curl -X POST https://vigolium-api:8080/api/agent/scans/550e8400-e29b-41d4-a716-446655440000/cancel

    Start an HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-intercepting ingest proxy on port 8443 with MITM capabilities
    shell copy

    vigolium server --ingest-proxy-port 8443 --proxy-mitm

    • http.Options.RawRequestTarget request-line primitive for raw HTTP request construction in detection modules
    • New routing-based SSRF detection modules (routing-ssrf, upgrade-routing-ssrf) with OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. header fan-out via oast-probe
    • Three new OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. detection modules: results-based, out-of-band, and time-based blind
    • SSRF/proxy-confusion detection family: ssrf-filter-bypass, ssrf-protocol-smuggling, open-redirect-confusion, reverse-proxy-path-confusion, cache-poisoned-dos
    • vigolium server --ingest-proxy-port N --proxy-mitm for HTTPS-intercepting ingest proxy with auto-generated CA

    +5 more show less

    • --skill, --skill-tag, --no-skill-filter CLI flags for overriding attack-vector skill selection in agentic scans
    • Attack-vector skill playbooks (xss-browser-confirm, idor-blast-radius) materialized to ~/.vigolium/skills
    • Runtime agent configuration reload without server restart
    • OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. provider_routing knob + extra_body passthrough for OpenAI-compatible backends
    • -P/--parallel multi-target fan-out with isolated child processes, paired with --split-by-host or --db-isolate

    10 details in Everything

33. v0.1.13-beta Prerelease May 24, 2026 · release notes

    Vigolium v0.1.13-beta introduces autonomous AI agent modes, source-aware auditing, multi-tenancy and flexible input formats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.13-beta https://github.com/vigolium/vigolium.git
    # already have the repo? check out this version:
    $ git checkout v0.1.13-beta

    └──▷ USE IT
    Run an autonomous AI-guided scan on a specific source code tree using the new agent mode.
    shell copy

    vigolium scan --mode swarm --source ./my-app

    Run a deep static security audit with detailed source analysis on a directory.
    shell copy

    vigolium scan --mode audit --source /path/to/tree --output jsonl

    Run a scan scoped to a specific project for multi-tenant isolation.
    shell copy

    vigolium scan --project_uuid 12345 --source https://api.example.com

    • Adds autopilot, swarm, query, and audit AI agent modes with in-process olium runtime
    • Supports --source flag on agent modes for filesystem-level code analysis and deep static security audits
    • Introduces multi-tenancy via project_uuid with config merging (global → project → profile → CLI)
    • Enables flexible inputs including OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., Swagger, Postman, Burp XML, cURL, HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session., Nuclei, and stdin piping
    • Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. server deployment shape with Fiber and Swagger UI alongside CLI and ingestor client

    +3 more show less

    • Supports SQLite (default) and PostgreSQL via Bun ORM for storage
    • Provides console, jsonl, and html output formats plus embedded ag-grid HTML report
    • Allows custom active/passive modules in JavaScript via Sobek engine and vigolium.* API

    8 details in Everything