summit v1.0.0 - first stable release

First stable release. Summit v1.0.0 ships with 50+ checks across 12 families, a YAML template engine, and pre-built binaries for 3 platforms.

Template engine (Nuclei-equivalence)

YAML templates let anyone write custom checks without Python. The loader enforces:

• confidence-rule field is mandatory for HIGH/CRITICAL templates - without it, the template won't load. This prevents custom templates from reintroducing the false-positive problems the core checks already solved.
• validate command: summit templates validate <file> checks confidence-rule presence, unrendered {{...}} placeholders, and matcher syntax.

12 starter templates shipped

• exposed-env-file, git-config-exposed (content signatures, not just 200)
• spring-actuator-exposed, exposed-docker-api, kubernetes-exposed (critical)
• graphql-introspection-tpl, exposed-source-map (confirmed)
• wordpress-json-user-enum (user enumeration)
• default-admin-panel (needs-manual - verify default credentials)
• exposed-backup-file, cve-2021-41773-apache-path-traversal

Complete feature list (v0.1.0 -> v1.0.0)

50+ checks across 12 families:

• Injection: SQLi (error/boolean/time), XSS, OS command, SSTI, CRLF, NoSQL, LDAP, format string
• Authorization: BOLA/IDOR, JWT (alg:none, HMAC), session fixation
• Discovery: hidden params (~120), JS endpoints, OpenAPI scanning
• Infrastructure: WAF fingerprinting + bypass, TLS audit, sensitive files, takeover (passive + CNAME)
• Intelligence: email enumeration, cacheable sensitive, CSRF, headers grade, CORS
• Link health: broken-link hijacking, dead domains, parked domains, private-target guard

Every finding carries: confidence label, CWE, CVE, impact statement, remediation, poc, verification_steps, complete untruncated evidence

Report formats: Console (colored), JSON, HTML, SARIF 2.1.0, JUnit XML

Engine: Phase-based (RECON -> FINGERPRINT -> VULNERABILITY), tech-aware prioritizer (35+ fingerprints), severity capping by confidence, WAF block detection, URL normalization, negative controls in CI

88 tests, ruff clean, evidence 22/22, CI green on all workflows.

Install

PyPI: pip install summit-scanner
From source: git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .
Binary: Download from releases - Linux amd64, Linux ARM64, Windows amd64.

Authorized testing only.