v0.2.9

Highlights

• Make hidden-parameter discovery substantially more selective by grouping equivalent routes, retaining already-observed names without probing them again, and applying an independent endpoint/probe budget.
• Restrict Server-Side JavaScript Injection to Node.js and likely code-evaluation surfaces, reuse observed baselines, deduplicate route variants, and cap targets per origin.
• Feed persisted technology fingerprints into module planning so framework-, web-server-, protocol-, and platform-specific checks avoid irrelevant targets.
• Eliminate status-only HTTP request-smuggling confirmations: two independent attempts must each produce their own queued canary response.

Accuracy and evidence

• Suppress generic parser failures such as 400 Invalid Header, malformed requests, invalid transfer encodings and infrastructure errors as request-smuggling findings.
• Preserve the exact raw request bytes used by protocol-level smuggling evidence and omit misleading cURL reconstructions that cannot reproduce a desynchronized connection.
• Keep unrelated query or header parameter labels off host/path-level request-smuggling findings.
• Prefer Next.js and Nuxt fingerprints before the generic React signature so dedicated checks remain correctly scheduled.
• Group hidden-parameter network failures by cause, emit explicit coverage gaps, and fail the phase only when every selected endpoint fails.

Scan efficiency and observability

• Apply deterministic module preconditions before work enters adaptive budgeting or worker queues.
• Add hard per-origin request limits and cache-aware accounting to IIS short-name, Nginx alias and Next.js testing.
• Reduce low-yield enumeration candidates and stop expensive checks after repeated blocking or infrastructure failures.
• Show crawled pages, discovered endpoints and sent requests as separate live counters.

Install with Go

The engine/v0.2.9 module tag makes both commands install this release:

go install github.com/akha-security/akca/engine/cmd/akca@v0.2.9
go install github.com/akha-security/akca/engine/cmd/akca@latest

Downloads

• akca-windows-amd64.exe - Windows x64
• akca-linux-amd64 - Linux x64
• akca-linux-arm64 - Linux ARM64
• akca-darwin-amd64 - macOS Intel
• akca-darwin-arm64 - macOS Apple Silicon
• SHA256SUMS.txt - SHA-256 verification manifest

Release binaries include GitHub build-provenance attestations and can be verified with gh attestation verify <binary> -R akha-security/akca.

Browser-backed checks require Chrome, Chromium, or Edge. Use AKCA only against systems you own or are explicitly authorized to test.

Full changelog: v0.2.8...v0.2.9