Stackurity v0.13.6

Security

• A botnet cannot lock an account out with failed sign-ins. Addresses an account signed in from with its password in the last 30 days are exempt from the per-account cap of 100 failures in 15 minutes; they keep their own per-address backoff.
• The dashboard's Content-Security-Policy no longer allows inline styles (style-src 'self', without 'unsafe-inline'); every page was checked in a browser without a violation.
• Sessions end after 30 minutes unused (STACKURITY_SESSION_IDLE_TIMEOUT, off to keep only the 12-hour limit), and an expired session and signing out are recorded in the activity log (auth.session_expired with idle or absolute, auth.logout). Signing in always ends the session the browser already had, and turning on two-factor sign-in or changing your password gives the current session a new ID. Changing your password also disconnects AI assistants unless you choose otherwise, and can revoke API tokens; the answer says how many tokens still work. Migration 0055_session_idle.
• Breached passwords are refused. A new password (setup, change, reset, invitation, an admin's, and sign-up on Stackurity Cloud) is checked against Have I Been Pwned's Pwned Passwords with k-anonymity: only the first five hex characters of its SHA-1 are sent. On by default; STACKURITY_BREACHED_PASSWORD_CHECK=off turns it off, STACKURITY_BREACHED_PASSWORD_URL uses a mirror, and an unreachable service is logged and does not block anyone. Passwords stay 12 to 256 characters. See network.md.
• Password reset by email. Forgot your password? emails a single-use link that works for 15 minutes (only its hash is stored), with the same answer whether or not the account exists, limited per address and per email. A new password ends every session, disconnects AI assistants and, if chosen, revokes API tokens; two-factor sign-in still applies. It works on Stackurity Cloud and on servers with the new STACKURITY_SMTP_* settings and STACKURITY_BASE_URL; elsewhere the sign-in page says to ask an administrator, and a password an admin sets for someone else is now temporary: it must be changed at the next sign-in. Your account has a Password card. Migration 0054_password_reset. See Forgotten passwords.

Added

• Stackurity Cloud: each organisation's own single sign-on (on plans whose features in cloud-plans.json include sso; the pricing page lists it under Enterprise). Admins connect a SAML identity provider under Settings → Single sign-on (metadata URL or file, attribute and role mapping, the addresses to give the provider), prove their email domains with a DNS TXT record (a domain can be verified by one organisation only), test the connection (required before switching on, and again after any change), and can require single sign-on for members, with the owner keeping password access. People find their organisation's sign-in from their email on the sign-in page. Everything is scoped to the organisation under row-level security, and a session started by an organisation's single sign-on works only in that organisation (migration 0049_sso_sessions). Existing accounts are linked only when the organisation allows it, and only its own members that are not instance administrators.
• End-of-life detection for products endoflife.date tracks without the package names their installs use: Stackurity's own lifecycle overlay, a versioned data file checked against each vendor's package index, maps MongoDB's mongodb-org-server, Docker's docker-ce, containerd.io, Electron on npm, redis-server, postgresql-<major> and PGDG's postgresql<major>-server, NodeSource's nodejs, Elastic, Grafana, InfluxData, MySQL, MariaDB, HashiCorp, Kubernetes (kubelet), GitLab, Jenkins, SQL Server, Temurin, Corretto, Go, Tomcat (including Spring Boot's embedded Tomcat), Symfony, Kotlin, Quarkus, Kafka and more. RHEL, Rocky Linux, AlmaLinux and Oracle Linux packages now use endoflife.date's Red Hat identifiers, and Debian packages its Ubuntu ones. endoflife.date's own mappings always win. See Lifecycle mappings.
• Settings → Coverage gaps for instance administrators (GET /api/v1/admin/coverage-gaps): across every workspace, files nothing reads (by kind), components with no vulnerability source (by type and reason) and products with no lifecycle match, counted by assets and workspaces. It names no workspace, asset, path or package.
• Scans report more files they find but cannot read as unsupported coverage: Package.swift, Package.resolved, Podfile.lock, conanfile.txt, conanfile.py, conan.lock, vcpkg.json, uv.lock, pdm.lock, rebar.lock, packages.config, deno.lock, bun.lock and build.sbt.
• Three official stack packs (Settings → Stack packs; Home names them when a repository holds their files). As with the Java and Rust packs, they ship inside the server and read nothing until an instance administrator installs them. See Stack packs.
  • swift: Swift Package Manager's Package.resolved (formats 1, 2 and 3, Xcode projects and package registries) and CocoaPods' Podfile.lock. Swift packages are checked against OSV's SwiftURL advisories (GitHub's Swift advisories; a few dozen packages, mostly SwiftNIO, Vapor and their servers). OSV has no CocoaPods advisories, so pods are inventoried and shown as having no vulnerability source.
  • hex: Elixir and Erlang mix.lock (every format since Mix 1.0), checked against OSV's Hex advisories (GitHub and the Erlang Ecosystem Foundation). Latest releases come from hex.pm (releases:hex, at most 100 lookups a minute as hex.pm asks; STACKURITY_HEX_URL for a mirror), with retired releases never offered as the latest.
  • cpp: Conan conan.lock (Conan 1 and 2), vcpkg vcpkg.json (exact only where pinned under overrides) and the vcpkg.spdx.json vcpkg writes for each installed port. No public vulnerability database covers ConanCenter or vcpkg ports, so C and C++ libraries are inventory only.
• Files these packs read (Package.resolved, Podfile.lock, conan.lock, vcpkg.json, vcpkg.spdx.json) are reported as unsupported coverage without the pack, as mix.lock already was, instead of being ignored.
• Two-factor sign-in with an authenticator app (TOTP, RFC 6238) under Your account: a QR code, a code to confirm, and ten one-time recovery codes stored as hashes. The secret is encrypted with STACKURITY_SECRET_KEY. A code is accepted once, wrong codes are limited (five per sign-in, ten per account in 15 minutes), and API tokens and AI assistants are not affected (the page lists them). Admins can Require two-factor sign-in for all members (members who sign in with a password are sent to set it up; single sign-on is not affected) and Reset two-factor for a member, recorded in the activity log. Home recommends it to admins. Migration 0053_mfa adds the tables. See Two-factor sign-in.

Changed

• Packages built by a vendor's repository (MongoDB, Docker, Elastic, Grafana, PGDG, NodeSource, Redis, nginx.org, MariaDB, MySQL, Ondřej Surý's PHP, Remi and others) are no longer matched against the distribution's advisories, which describe the distribution's own builds and showed them as clean. Their coverage is now unsupported ("built by , not by the distribution"), so assets running them show an evaluation gap; findings that matching produced on them are resolved. Their end of life uses upstream dates, and the inventory note names the repository. See Packages from vendor repositories.
• Repository scans skip .build, Swift Package Manager's build directory, which holds a checkout of every dependency.

Fixed

• The consul and nomad packages Debian (10, 11) and Ubuntu (18.04 to 23.10) built themselves are no longer taken for HashiCorp's builds: the lifecycle overlay now recognises HashiCorp's repository by its version format (1.20.1-1), so distribution builds (1.8.7+dfsg1-3) are still matched against the distribution's advisories (overlay 2026-10-29.1).
• The coverage-gap report (GET /api/v1/admin/coverage-gaps) no longer scans all inventory on every request: each server reuses a report for up to 5 minutes (checked_at says when it was built).
• A Debian or RPM epoch no longer stops the release line from being read (5:7.0.15 is Redis 7.0, 1:10.11.6 MariaDB 10.11).
• An upstream pre-release version such as 2.0~beta is no longer taken for a build named after a release codename.

Upgrading

• POST /auth/password answers 200 with a JSON body (what was revoked, and tokens_kept) instead of 204, and disconnects AI assistants by default; send "revoke_assistants": false to keep them.
• Browser sessions now end after 30 minutes without use. Set STACKURITY_SESSION_IDLE_TIMEOUT (for example 2h, or off) to change it.
• To email password reset links from a self-hosted server, set STACKURITY_SMTP_HOST, STACKURITY_SMTP_FROM (and username, password, port, TLS as needed) and STACKURITY_BASE_URL.
• New passwords are checked against known breaches by default (an outbound request to api.pwnedpasswords.com, see network.md); set STACKURITY_BREACHED_PASSWORD_CHECK=off for none.
• Two-factor sign-in needs STACKURITY_SECRET_KEY.