Skip to content

RedDock v0.8.2

Latest
Latest

Choose a tag to compare

View all tags
@chriswayneh chriswayneh released this 21 Oct 20:02
· 1 commit to master since this release
v0.8.2
234aa5b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

RedDock v0.8.2 is a Phase 8 maintenance release. It is still a local, single-operator tool and not production-ready.

Added

  • Guided local walkthrough: Start local walkthrough creates one workspace scoped to RedDock's own Compose proxy and leads through scope, discovery, detection, findings, and reports. Nothing scans automatically.
  • Check coverage: findings, the assessment guide, and new reports separate reviewed observations from those awaiting detection and checks not performed. Coverage is not proof of security.
  • Report schema 3: new snapshots include check coverage. Existing report downloads remain available.

Changed

  • Orderly discovery shutdown: accepted discovery work finishes before the database closes. Compose allows up to 12 minutes, and a forced interruption is recorded on restart.
  • Private request logs: Uvicorn access logs are off, and the proxy records fixed categories and metrics without raw URLs, headers, or client addresses.
  • Dormant OIDC sign-in, browser session, and team admin code is in the source but is not registered or enabled. Server mode still fails startup.

Fixed

  • HTTP security-header findings are no longer closed by a response that could not evaluate them (server error, redirect, or header not examined).
  • Framing protection requires X-Frame-Options DENY or SAMEORIGIN, or a real CSP frame-ancestors directive other than a bare *, in both detection and validation.
  • A new service identification replaces the stored name, product, and version together.
  • TLS-wrapped services (Nmap tunnel="ssl") are recorded as ssl/<name> and are no longer reported as cleartext Telnet or FTP.
  • IPv6 targets are scanned with Nmap -6. Mixed IPv4/IPv6 runs are refused, and exclusions are limited to the scanned family.
  • Discovery checks scope again before saving results, and discards them if scope was revoked or narrowed during the scan.
  • A discovery run that fails before it starts is marked failed instead of staying pending.
  • Two concurrent requests can no longer both start a detection run for the same Dockyard.

Upgrade: git clone --branch v0.8.2 --depth 1 https://github.com/chriswayneh/RedDock.git, then docker compose up --build. No new settings are required, and RedDock's safety guardrails are unchanged.

Assets 2
Loading