SecureScope 2.0.1

A hardening release from reviewing the scanner's own attack surface: everything a hostile target can send is treated as data in every output, and the scanner cannot be steered or exhausted by the site it is scanning.

Security

• Console output could be crashed or styled by a hostile header (Server: [/]); all target-derived text is now escaped
• CSV formula injection neutralised (cells starting with = + - @ are quote-prefixed)
• Markdown output HTML-escapes target text; evidence stays inside code spans
• Redirects followed by hand, max 5 hops; a public target can no longer redirect the scanner into loopback/link-local/private address space
• Response bodies capped at 2 MB, evidence values at 1000 characters
• GitHub Action inputs passed via environment variables
• CodeQL (security-extended) and Dependabot enabled

Added

• target check: redirect chain facts, REDIRECT-HTTPS-TO-HTTP (medium), TARGET-REDIRECTED / RESPONSE-BODY-TRUNCATED (info), REDIRECT-TO-INTERNAL-ADDRESS (low)

Fixed

• CORS-NO-VARY-ORIGIN only when the origin is reflected
• Clear error for malformed --baseline files

Full notes: CHANGELOG.md · pip install -U securescope

What's Changed

• 2.0.1: harden the scanner against hostile targets by @mohamedmoatazsec in #3

Full Changelog: v2.0.0...v2.0.1