v0.3.2

What's changed

New

• Scan ▸ Active Scan: Nuclei templates. Download the community nuclei-templates library — the latest release, checked against its published SHA-256, or the newest commit on main for templates not yet released — or import an archive. Templates you turn on judge in-scope captured traffic without sending anything. A manual scan sends the templates you pick to targets you name, and an auto scan, off until you turn it on, sends them to each new in-scope host the proxy captures. Templates with payloads, several request blocks, a flow, raw requests, and out-of-band callbacks through the session's Interactsh server are sent; templates tagged intrusive, default-login or brute force, and ones sending PUT, DELETE or PATCH, stay out unless you allow them. Matches land in Findings, and every exchange of a manual scan stays in HTTP history. sniper-cli templates drives the library, passive templates and scans.
• Scan ▸ Recon now sits beside Active Scan, its discoveries join the site map, and its budgets are optional. Recon is in the CLI and the agent skill. Thanks to @ksw9722 (#26, #30).
• Map ▸ Flow. One origin's requests in time order as a sequence diagram: the client and that origin as lanes with the origins it links to, a band per page load, repeated requests folded into one arrow with a count, and redirects drawn back to the client. An arrow opens its row in HTTP history, and Copy Mermaid copies the diagram. sniper-cli scope service-map flow reads it.
• Findings ▸ Rescan applies the current rules to the history a session has retained, so an issue the rules no longer report goes away without browsing again.
• The Fuzzer runs in the background with progress and Stop, up to 16 requests at a time. A Sniper attack puts payloads in one position at a time beside Battering ram; payloads in the URL are percent-encoded as Burp does; a request that cannot be sent becomes a result that says why; results can be filtered, sorted and sized by their headers.
• Decoded previews on hover. URL- and Base64-encoded values in request and response panes show what they decode to.
• A Session dashboard. The Session screen adds up what every session takes on disk, its requests and its findings by severity, and when it last captured. Each row names its scope, or the hosts it saw, and the selected session lists its scope, busiest hosts, marked requests, pinned Replay tabs, Replace rules, recent scans and findings.

Changed

• A calmer interface. Every tab strip has one size and marks the active tab with a thin line that slides, Pretty / Raw / Hex included. Screens show their controls once there is something to act on, and the Active Scan screen is one panel with a switch.
• Replay's Change method moves parameters, as Burp does. Switching to GET or HEAD moves a form body into the query string and drops any other body; switching from GET to POST moves the query into a form body.
• Replay starts empty instead of making up a blank GET request, and closing the last tab leaves it empty.
• Replace shows its fields only for a rule that exists. Save is on only when there is something to save, and a rule's On switch saves only that switch.
• Tools follows its input. A value that can only be a JWT opens the JWT tool, a category with nothing to show dims, and a copy shows.
• Settings and rule changes no longer rewrite captured traffic. A scope edit, an intercept toggle or a rule change rewrote the whole body file, about a second on a 1.2 GB session; they now write only the session's state.
• Fewer false positives in Findings. CSP is judged by its effective policy, CORS needs browser-valid header values, error and cache findings need context, and SDK keys and beacon IDs are no longer reported as leaked secrets.
• Installed agent skills follow the app. The desktop app updates every installed copy of the bundled skill when it starts.

Security

• The proxy refuses another machine Sniper's UI and the ports of the browsers it opened. With the proxy listening beyond loopback, a client on the network could reach the local API, captured traffic included, through the proxy, and the DevTools or MCP ports of a browser Sniper opened. Requests and tunnels from another machine to those ports now get 403.

Bug Fixes

• A session with a torn line in its body file opens. After a power loss, one line that no longer parsed made a session unopenable. That record now keeps its metadata without bodies, and the file as it was is kept beside the session first. Thanks to @ksw9722 (#27).
• Held chunked responses can be forwarded, Drop and Forward stay in view beside a long URL, and an Intercept tab shows changes made elsewhere.
• Replace no longer saves an empty rule in place of one typed before pressing Add.
• Dialogs keep their keyboard focus (Compare, API Docs, cURL import, scanner dialogs), and late reads and actions in Findings, the Fuzzer, Recon, Decoder, WebSocket and HTTP history stay with the view that started them.
• cURL import and export keep explicit options, empty header fields and encoded dot segments.
• Decoder reads signed and fractional Unix seconds, uppercase hex digits and exact decimal milliseconds, and rejects incomplete hex bytes.
• History retention no longer rewrites a session every 30 seconds once it reaches its cap.
• The Fuzzer keeps a run another client saved when this one saves its workspace, and sniper-cli can set a template's scheme on an IP address host.

Packages

• macOS — a universal DMG (arm64 + x86_64), which is what the in-app updater looks for, with a .sha256 beside it.
• Windows x64 — a -setup.exe installer and a portable ZIP with sniper-desktop.exe, sniper.exe and sniper-cli.exe, each with a .sha256, built and attached by CI from this commit. Both need the Microsoft Edge WebView2 Runtime and are unsigned — check the checksum before running. See Windows setup and packaging.
• Linux (Debian 13 x86_64, X11) — a .deb and a portable .tar.gz, each with a .sha256, built by CI from this commit, with the build manifest and the CI runtime check (-runtime-PASS.json: install, remove, reinstall and purge in a fresh Debian 13). They use the system GTK 3 and WebKitGTK 4.1; other distributions are outside the qualification. See Linux installation.

Full Changelog

v0.3.1...v0.3.2