WebScan v2.3.0

WebScan v2.3.0 — 37 plugins, Web Cache Deception detection

🆕 New Plugin (36 → 37)

web_cache_deception (active, content-verified)

Appends static-asset extensions (.css, .js, .png, .svg, .woff, .pdf, .txt) to dynamic URLs. If the server returns the same dynamic page (not a 404), a CDN might cache it — leaking sensitive data to other users.

• HIGH (FIRM): response contains sensitive markers (email, api_key, session, password, token, balance) AND Content-Type doesn't match the extension
• MEDIUM (TENTATIVE): dynamic page served at extension, no sensitive markers found, similarity ≥ 0.85 to baseline
• 15 cacheable extensions tested
• Soft-404 calibration
• Content-Type mismatch detection

📊 Numbers

• 37 plugins (was 36)
• 671 tests (was 654)
• 95% coverage
• 58 source files
• ruff clean, mypy --strict clean
• 0 false positives

🔗 Links

• Full CHANGELOG
• pip install webscan-security