Skip to content

v2.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Nov 17:26
· 154 commits to main since this release
v2.2.0
a9bbcab
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Penthera now says what it read, what it fixed and what is left. A run that read nothing never reads as clean.

What changes for you

  • The fix loop says when it isn't done. penthera agent --loop exits 1 while a critical or high finding remains. It used to exit 0 once nothing fixable was left. It also says what it fixed and what is left.
  • Shorter scans. One exec in a six-route file is now one finding that lists the routes, not six criticals.
  • A CSP has to control scripts to count. A policy that names no script sources, or lets any host run them, now gets its own finding.
  • agents catches more: a password in a connection string, and instructions hidden in an HTML comment in a skill.
  • deps no longer stalls on big bundles under Node 22, and it says what it did not check.
  • fix --plan no longer prints a secret sitting beside a change.
  • The dashboard stops grading what it can't vouch for. A site it couldn't read gets no grade, and neither does a project with suppressed critical or high findings.

Upgrading from 2.1

Nine exit codes change, so a CI step can turn red or green. The full table is in the changelog. The ones you're most likely to meet:

  • agent --loop with a critical or high finding left: 0 is now 1.
  • agents with a password in a connection string, such as DATABASE_URL in an MCP server's env: 0 is now 1.
  • URL scan on a shared platform domain such as vercel.app, where the only high finding was the platform's mail record: 1 is now 0.

Two more things can move:

  • Findings from whole-file patterns have new titles, so a --baseline diff or memory shows them as fixed and new, once. With --baseline -q, that one run can exit 1.
  • The live check's score moves to scoreVersion 2. Scores of version 1 aren't comparable on CSP.

Known limits

  • penthera init writes a workflow pinned to v2.1.2, which still has the deps stall. If you see it, move the pin to v2.2.0.
  • The dashboard doesn't say which checks didn't run. The CLI, the brief, MCP and the Action do.
  • A firewall's challenge served with status 200 and no firewall header still gets a grade.
  • Real Windows and Safari are untested.

Try it

npx penthera@2.2.0 --repo .

Full changelog

Assets 6
Loading