BlockHouse

What's Changed

• API-first discovery (OpenAPI/Swagger) and JSON/XML body injection testing (#80) by @shenril in #93
• Finding quality: dedup, confidence, evidence, remediation, OWASP/CWE/WSTG mapping (#81) by @shenril in #91
• JWT / token security testing: alg=none, RS256->HS256 confusion, kid, weak secret (#82) by @shenril in #92
• Add optional real-time TUI dashboard (--tui) by @shenril in #96
• Tier 1 cleanup: file-handle leak, compiled detectors, smell fixes by @shenril in #97
• WebSocket Discovery & CSWSH attack module (closes #46) by @shenril in #98
• Security-headers audit & CORS misconfiguration checks (#72, PR 1/2) by @shenril in #99
• Open redirect, SSTI & path-traversal checks (#72, PR 2/2) by @shenril in #100
• Discover HTML forms & test POST/body parameters (closes #70) by @shenril in #101
• In-band XXE (XML external entity) file-disclosure check (closes #104) by @shenril in #106
• In-band SSRF detection (closes #103) by @shenril in #107
• Exposed-file discovery & passive secret-leak scanning (closes #105) by @shenril in #108
• Fix selectolax 1.0 ImportError: use the Lexbor backend (closes #109) by @shenril in #110
• Fix cross-test FileNotFoundError in the dangerous suite (closes #111) by @shenril in #112
• HTTP rate limiting & in-scope host restriction (closes #73) by @shenril in #113

Full Changelog: v1.5.1...v2.0.0