v1.10.1 — Actionable run summary

What changed

The end-of-run summary now surfaces every takeover candidate with enough context to act without opening a file.

Unclassified dangling CNAMEs — before

  Unclassified dangling CNAMEs : 2  (see takeover_candidates.txt)

Unclassified dangling CNAMEs — after

  Unclassified dangling CNAMEs (2) — investigate manually
    [?] accend.example.com
          CNAME target : k8s-prod-1234.ap-southeast-1.elb.amazonaws.com.
          Risk         : Target does not resolve — if it can be claimed,
                         an attacker can serve content from accend.example.com
          Action       : Verify this CNAME is intentional; remove it if not

NS Takeover — after

  NS Takeover candidates (1)
    vuln.example.com -> NS: ns1.orphaned-registrar.com
          Why    : Nameserver does not resolve — registering it gives
                   an attacker DNS control over vuln.example.com and all its subdomains

The alert banner also now reads REVIEW IMMEDIATELY to make urgency explicit.

Note: the run shown in this release used pre-v1.9.2 code. With current code, accend.example.com → *.elb.amazonaws.com CNAMEs are classified as aws_elb and shown under the classified section with the ELB-specific takeover recommendation.