v7.8.0 - Project sharing, the IAM console, RBAC on by default

Highlights

RedAmon is now multi-user. This release adds identity and access management: a confirmed Root, named permissions, project sharing and an IAM console. Its five RBAC switches are on by default, and the update turns them on unless your .env already sets them. No project is shared until Root turns on the sharing policy, which stays off.

Added: project sharing at Read and at Read + Write.

• Share a project from its card or the header with an exact email at Viewer (Read) or Analyst (Read + Raw data & files), with an optional end date and a note. Shared with me on the Projects page lists what others shared with you, and Leave gives a share up.
• A collaborator at Read sees the owner's graph, Insights, attack chains, reports, versions, Priority Board, findings and schedules, and changes nothing. The owner's secrets in the project settings (tokens, the Rules of Engagement contacts and document, custom request headers) never reach a collaborator.
• Read + Write adds the owner's consent, conversation sharing, and ownership transfer: both people confirm with their password, and the graph, the settings and the history move together or not at all. Deleting a user who owns shared projects goes through a wizard.
• One person writes a shared project at a time: a second scan or agent run is refused and names whoever holds it. Losing access stops your live work on that project at once.
• Admins holding projects:oversee (Full admin, Security auditor) can open any project read-only once sharing is in force. Each read is audited and shown to the owner. Only Root has break-glass.

Added: the IAM console. IAM in the header (it replaces Users) opens /admin, which includes:

• users, with a page per account (permissions, projects and shares, MCP tokens, device sessions, quota, recent audit rows)
• permission sets and admin profiles
• every project and share
• quotas and per-plugin allowlists
• instance LLM providers
• Root's instance settings: the sharing policy and audit retention
• the audit log

New accounts are invited. AUDIT_FORWARD=stdout prints every audit row as a JSON line for your log pipeline.

Added: identity and permissions.

• A registry of 98 permissions, decided by one policy on every route.
• MCP tokens capped by their owner's permissions.
• Agent approvals that need agent:approve_phase or agent:approve_dangerous.
• Acting as a user needs a reason, has a time limit and is shown to that user.
• 12-hour admin sessions with a 60-minute idle limit, and sign-out of single devices.
• A 12-character password floor, and sign-in no longer reveals whether an account exists.

Added: hostnames on target IPs. An IP-mode project picks one of four modes:

• IP only (the default for every IP project, existing ones included)
• Record hostnames
• Record + scan matching
• Record + scan all

A hostname is scanned only when it resolves to one of the project's target IPs. Every name that is not scanned is recorded in the graph with the reason. Partial recon, the agent and MCP (create_project, update_project_scope) follow the mode.

Added: found secrets are readable in the UI. A secret recon finds shows as •••• plus its last four characters, with a button that copies the full value, and links that carried a secret open whole. The agent's graph queries never read these values. Leaked links and secrets in web-archive URLs (GAU, ParamSpider) now become findings.

Security

Six advisories are fixed:

• GHSA-j3r5-x2gg-2hgv (CWE-862, CWE-200): any signed-in user could run arbitrary stdio MCP commands in the shared agent container. Saving, testing and loading a stdio MCP server now needs an admin.
• GHSA-3cjg-8cp8-j269 (CWE-306): the Kali terminal handed a root shell to whoever reached it.
• GHSA-wgxp-vq94-73h8 (CWE-862): signed-in users could read the tunnel credentials. The tunnel is now managed by admins.
• GHSA-w454-6hwp-fm58 (CWE-639): signed-in users could list, type into or kill other users' Metasploit sessions.
• GHSA-vhjw-gfmx-j3fx: CodeFix could open a pull request with changes no person approved.
• GHSA-8whg-rvcr-r88r (CWE-636, CWE-250): an agent started without keys served its master-key routes, stdio MCP servers ran as root, and a stop left the run's commands running in the Kali sandbox.

Other fixes that apply on update, whatever the switches:

• Saved graph views run in a read-only session behind an allowlist.
• The agent's tenant filter scopes every query shape it accepts and refuses the rest.
• /api/agent/files serves only the project's own workspace.
• A run can no longer write into another project's attack chain.
• No service credential reaches the Kali sandbox, and a chat run spends only its owner's model and search keys.
• A scan carries a job credential bound to its owner and project.
• An IP-mode scan no longer reaches addresses outside its target list.

Fixed

• CWE metadata was lost after a MITRE refresh. CWE 5.0 moved its XML to a new namespace, so the refresh found no weakness and wrote {} over cwe_metadata.json, and every scan lost the CWE names and details. The parser now reads the namespace from the catalog, keeps the current file when a parse comes back empty, and ships metadata regenerated from CWE 5.0 (984 weaknesses).
• The projects page no longer acts as an account the admin did not pick.
• Importing a project no longer moves the original project's attack chains.
• jsluice secrets keep their sample.
• The AWS secret access key TruffleHog finds in a JS file is kept as paired_secret.
• IP mode no longer passes placeholder names to naabu and httpx, scans each IP once, and brackets IPv6 addresses in URLs.
• Names collected by Censys, FOFA, Netlas and ZoomEye are written to the graph.

Before you update

• If you are the only user: nothing to do. The header's Users becomes IAM, and no project is shared until Root turns sharing on.
• To keep part of RBAC off, set its switch to false in .env before updating: RBAC_IDENTITY_ENABLED, RBAC_PERMISSIONS_ENABLED, RBAC_SHARING_ENABLED, RBAC_SHARING_WRITE_ENABLED, RBAC_GOVERNANCE_ENABLED. Updates never change a value you set. Try the switches on your own install first.
• Root: the update confirms Root. With one admin, that admin becomes Root. With several, the update asks in the terminal (a deploy uses ADMIN_EMAIL). You can also run ./redamon.sh set-root <email>.
• Legacy grants: members who existed before the update keep the Kali terminal, shell sessions and tunnel settings as legacy grants. The grants nobody has decided lapse at the boot that turns RBAC_PERMISSIONS_ENABLED on. On a server shared by several people, review them on the Users page.
• Saved graph views that the new allowlist refuses answer 400 and say what to change, for example a pasted non-breaking space, shortestPath or an apoc call.
• Metasploit serves one project at a time. A project releases the console 10 minutes after its last command; MSF_PROJECT_LEASE_IDLE_S changes the delay.
• stdio MCP servers run as uid 10001. A tool installed under /root must move to a system-wide path, or have its directory chowned to 10001.
• Neo4j, graph snapshots, project exports and the recon JSON now hold found secrets in clear. Treat database access and exported files like the credentials they contain.
• Known limit: at every share level, Viewer included, the graph shows found secrets in full. The share window says so.

Upgrade

./redamon.sh update

The update rebuilds the webapp, the agent, the Kali sandbox, the recon image and the AI attack-surface image, then restarts the recon orchestrator after the webapp. The webapp, the agent and the orchestrator must move together. A scan or agent run in progress during the restart may fail: start it again. All data changes are additive. Databases, scan results and reports are kept (volumes are never deleted).

Going back to 7.7.2 is not a switch. 7.7.2's first start drops every table and column added since, with their data. Before downgrading, read the report from docker compose exec webapp node scripts/rbac-upgrade-preview.mjs --downgrade and back up the database. The full steps are on the wiki's Deploying to a Server page.

Coming from v7.5.1

This is the first GitHub release since v7.5.1. Versions 7.6.0 to 7.7.2 in between added:

• Agent in the Loop (7.6.0): your own Claude Code or Codex can drive the agent as its model.
• Workspace uploads and URL imports (7.6.0): folders, archives, and imports from repositories or sites.
• Jev through OpenRouter (7.6.2).
• urlscan leak, exposed-file and problem-page findings (7.7.0).

Points to know when you update from v7.5.1:

• 7.6.0 turns on Agent in the Loop and the inbound MCP server (AGENT_IN_THE_LOOP_ENABLED, MCP_SERVER_ENABLED), once, even where MCP_SERVER_ENABLED=false was set. Nothing answers on the MCP server until someone creates a token, and a switch you set to false afterwards stays off.
• 7.6.2 raises BROKER_TOOL_MEM_BYTES to 3g. A lower value in .env starves the ZAP Ajax Spider.
• 7.7.0 removes the 17 per-project tool image settings, because tool images are now fixed. The update also runs a one-off backfill that masks the urlscan values earlier releases stored.
• 7.7.0 changes GAU's default blacklist only for new projects. To have an existing project keep archived documents, remove pdf, doc(x), xls(x), ppt(x), zip, rar, 7z, tar and gz from its list in the GAU section.

Full details in CHANGELOG.md.