Skip to content

v1.5.0 - Truthful scans and a source catalog

Choose a tag to compare

View all tags
@WhiteMuush WhiteMuush released this 13 Oct 08:51
· 162 commits to main since this release
v1.5.0
b77fc88
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Scans now tell the truth about what they checked, breach data can no longer
inject content into alerts, and the data sources page becomes a catalog that
helps choose which sources to pay for.

Upgrading

One migration runs on start: 20261012124727_track_scan_checks adds a
ScanCheck table and a nullable ApiCredential.rateLimitPerMinute column.
It only adds, so rolling back to 1.4.0 still works. Nothing to do by hand.

Environment variables, port and the Alpine image base are unchanged.

Security

Breach data is escaped before it reaches an alert. Breach names and fields
come from third-party sources; they were inserted as-is into email HTML,
Slack and Teams messages, CEF headers and syslog structured data. A crafted
value could inject markup or forge log fields. Each channel now escapes them
for its own format.

Fixes

  • No more silent "no exposure". A source that failed (rate limit, rejected
    key, outage) used to count as checked. Every check is now recorded per
    employee and source, failures are retried with backoff, each source keeps to
    its rate limit, and the remaining gaps are shown with the steps to fix them.
  • LDAP: employees with several mail values were synced with one invalid,
    joined address, so they were never matched. The connection is also closed
    when a search fails.
  • AWS Identity Store: a user without an email was stored with its user
    name as the address. It is now kept only when it is a valid email.

Features

  • Data sources catalog: each source shows a recommendation level, its
    health, its pricing and its logo, with a drawer to connect it, set its rate
    limit, or fix it.
  • Dismissible scan banner: the incomplete-scan banner can be closed, and
    comes back when the situation changes.

Quality

  • npm run check runs every gate before each push and in CI: lint, Prettier,
    types, unit tests with a coverage floor (now 56%), knip, a 200-line cap per
    file, version consistency, licenses, production audit.
  • The Entra ID, Google Workspace, LDAP and AWS connectors now have unit tests.
  • SECURITY.md states which versions receive security fixes.
Assets 2
Loading