Skip to content

ShakerScan v2.7.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Oct 03:56
v2.7.1
d1b2075
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ShakerScan 2.7.1

Status: candidate prepared 2026-10-05. Publication and stable-channel promotion are pending.

This patch release fixes defects found after 2.7.0 shipped: in a post-release audit and while
testing 2.7.0 behind an Enterprise gateway. It ships with client 0.7.5.

Proof and evidence

  • Authentication-bypass proof reads the whole response the transport accepted and returns no
    token signal when the JSON does not parse or part of the document lies beyond the bounded
    inspection walk. A rejection hidden past those limits can no longer become verified proof; the
    candidate stays an observation. Managed login is unchanged. (#327)
  • Purging a scan's HTTP archive covers the same child scans its export shows, clears their
    archive statistics and reports the owner ids it covered. Clearing a parallel or discovery run
    no longer reports 0 while leaving child traffic behind. (#327)
  • In-process scan capabilities are archived under their own capability name, and the archive
    separates external scanner traffic (relayed through an opaque pinned tunnel) from engine
    capabilities that recorded no calls. (#328)

Scans and findings

  • The scanner image bakes the nuclei template index, and workers rebuild it before taking jobs
    when it is missing. The first scan after a worker start no longer spends its passive-template
    budget indexing templates and finishing with no template findings. (#328)
  • A target with no published spec reports source_not_published instead of
    output_truncated. A scan that selects XSS or SQL injection but derives no candidates explains
    why, for example that JSON body APIs need state-changing HTTP permission. (#328)
  • Fix guidance is kept from the producing check and covers Git credential and configuration
    exposure, SSH password authentication and the connected-device checks. (#328)

Connected devices and Hunt

  • Connected-device scans and probes apply SHAKERSCAN_PRIVATE_NETWORK_TARGETS at submission and
    again in the device worker. The default still allows private networks; Lab environments keep
    their allowance. (#328)
  • A privileged Hunt start on a target whose scope is blocked reports the scope refusal and its
    reason first, instead of asking for an authorization receipt that could not be recorded. (#328)
  • Asset and Connected Devices views list confirmed open ports as discovered services; UDP probes
    with no response are shown separately as unconfirmed. (#328)

Install and upgrade

  • A root start after a non-root install moves the operator's files under results/ to the root
    API identity, so existing private archive payloads stay readable. Returning to a non-root start
    needs the manual chown described in docs/upgrade-and-rollback.md. (#327)

Delivery and validation

This note records the prepared scope, not a completed release certification. Exact-candidate
certification, immutable version publication, public installer smoke and the stable-channel PR
must succeed before the hosted installer advances.

Build provenance

  • Candidate commit: d1b20759f28c151c271a5de4c60e1cfad287c74d
  • Candidate workflow: https://github.com/andriyze/shakerscan/actions/runs/37403917065
  • Runtime manifest: 1c600c8bcaa489958d0ba8496d31c2b37d30a936a55cc4d5c57ea8c129f94367
  • Certified receipt: attached as release-candidate-receipt.json
  • SBOMs: per-image/per-platform SPDX files, sbom-index.json, checksums and signature bundle attached. Scope and verification: docs/sbom.md.
  • Stable installer and latest are promoted separately after public smoke.
Assets 63
Loading