v7.5.1 - TruffleHog in JS Recon, three agent fixes

Highlights

Added: JS Recon runs TruffleHog beside its own secret rules. On by default for new projects (JS Recon → Key Validation → "TruffleHog"). TruffleHog 3.96.0 scans local copies of the JavaScript JS Recon already analysed (bundles, source-map originals, uploads) in a hardened container with no network, or with only its own bridge when key validation is on; it never fetches from the target. Each key is one finding: a key both engines find keeps JS Recon's identity, so its mutes and verdicts stay attached, and is marked "also found by TruffleHog"; a key only TruffleHog finds becomes a new Secret (detection_method: trufflehog). TruffleHog checks a key with its provider only when key validation is on, and its "could not confirm" is unknown, never rejected. The 33 detectors whose check would connect to a host named in the JavaScript, or send the key to a third party, never run.

Added: four JS Recon secret rules: AWS session keys (ASIA…), Stripe webhook signing secrets (whsec_…), credentials in a URL (scheme://user:password@host; placeholder passwords stay silent) and JDBC URLs that carry a password.

Fixed: JS Recon reports fewer false secrets. A generic apiKey / token / secret / password match that holds a provider's key now folds into that provider's finding instead of being reported twice. A BEGIN … PRIVATE KEY marker reports only when key data follows it, so library templates and parser branches no longer read as critical keys. A certificate is info, a generic match whose value is a bare UUID is low, and webpack chunk ids, identifiers and hashes no longer pass for Yandex, Resend or Databricks keys. The GitHub secret hunter applies the same checks. Surviving findings keep their ids, so mutes, verdicts and fix items stay attached.

Fixed: three agent features that never ran now do.

• The agent learns when its progress claim was downgraded because the output was empty or a repeat (fireteam members too).
• Rules of Engagement timing warnings reach its prompt, checked on every message, so a session that runs past its testing window or its end date is told so.
• The chat says when a task is complete: the closing message, the last graph refresh and the transcript's completion entry were missing.

All three were state keys LangGraph dropped without an error. A unit test now checks every key an agent node writes against its graph's schema.

Changed: a Rules of Engagement document can only turn JS Recon key validation off. Validation sends every key found to its provider, so a document may forbid it but never require it. Turning it back on by hand counts as relaxing a safety control.

Note: existing projects keep TruffleHog off

./redamon.sh update adds the setting switched off to every project that already exists; only projects created afterwards start with it on. To turn it on for every project that runs JS Recon:

docker compose exec postgres psql -U "${POSTGRES_USER:-redamon}" -d "${POSTGRES_DB:-redamon}" \
  -c "UPDATE projects SET js_recon_trufflehog_enabled = true WHERE js_recon_enabled = true;"

Upgrade

./redamon.sh update

It rebuilds webapp, agent, the docker broker and the recon, vuln-scanner and GitHub hunter images, and restarts recon-orchestrator. The TruffleHog engine runs on redamon-trufflehog:latest, the Secret Multiscanner's image; if it is missing, ./redamon.sh up builds it. Databases, scan results, and reports are preserved (volumes are never deleted).

Coming from v6.14.1

This is the first GitHub release since v6.14.1. Three of the versions in between need action, described in full in their upgrade notes in the CHANGELOG:

• 7.0.0 requires Docker Engine 28.0.0 or newer (check with docker version --format '{{.Server.Version}}'). On an older engine the update stops right after its git pull. Upgrade Docker, then run ./redamon.sh update again to finish it.
• 7.2.0 and 7.4.0 change how some finding ids are keyed. Before the first scan on this release, after a Neo4j and Postgres backup and with agent, webapp and recon-orchestrator stopped, run tooling/scripts/dns_finding_rekey.py, netlas_finding_rekey.py and js_secret_rekey.py once each with --all --apply (without --apply they only list). This keeps mutes, verdicts and fix items on their findings. Each script's docstring has the container command.
• 7.2.0 tightens domain scopes. A project whose scope is a public suffix has its schedules paused until you edit the target list, and some projects need one full recon before partial recon, GVM or AI-attack starts are accepted again.

Full details in CHANGELOG.md.