sif v2026.11.4

what's changed

• feat(modules): add elasticsearch exposure module (#151) (1bbc564)
• fix(scan): surface dirlist wordlist read errors (#164) (0fa3d03)
• feat(modules): add django debug page exposure module (#148) (733578e)
• feat(scan): broaden cloudstorage bucket name candidates (#162) (77f203e)
• feat(modules): add graphql introspection detection module (#139) (9340a8b)
• feat(modules): add werkzeug debugger exposure module (#149) (27a8a27)
• feat(modules): add prometheus metrics exposure module (#147) (8c732f9)
• feat(modules): add phpinfo exposure module (#145) (c68b077)
• feat(modules): add docker registry and harbor exposure modules (#218) (e2f5963)
• feat(modules): add netrc, pgpass and my.cnf exposure modules (#208) (4a84790)
• fix(scan): don't follow redirects when probing cors (#200) (f22aa9e)
• feat(modules): add svn, mercurial and bazaar exposure modules (#210) (cf159ad)
• fix(scan): de-duplicate selected modules before running them (#224) (be56a90)
• feat(modules): add adminer and phpmyadmin database panel modules (#186) (273dcdc)
• fix(scan): update stale ghost and pantheon takeover fingerprints (#168) (af759c7)
• fix(scan): crack weak hmac secrets on hs384 and hs512 tokens (#197) (0c9419b)
• fix(scan): don't flag quotes reflected in text as attribute xss (#203) (7c635ba)
• fix(scan): require a wordpress marker on probed wp paths (#169) (0255e2d)
• feat(modules): add joomla, drupal and magento config exposure modules (#211) (db86299)
• feat(modules): add spring boot actuator exposure module (#144) (d7d669e)
• feat(config): add scan templates via -template (#154) (9be84be)
• feat(frameworks): add config-defined custom detectors (#160) (9f3b9ea)
• feat(modules): add server status page exposure module (#150) (301f758)
• fix(scan): skip built-in module when its legacy flag already ran (#223) (d17f7c2)
• feat(modules): add ignition, profiler and heapdump exposure modules (#196) (1b41b5e)
• chore(deps): bump github.com/projectdiscovery/nuclei/v3 (#141) (7a915d5)
• chore(deps): bump golang.org/x/time from 0.14.0 to 0.15.0 (#142) (3f78eab)
• Add Claude Code GitHub Workflow (#226) (6dd1d9e)
• feat(modules): add env file exposure module (#185) (c6cedf3)
• feat(modules): add grafana, kibana and jenkins login panel modules (#187) (368d658)
• feat(modules): add terraform, kubeconfig and compose exposure modules (#201) (1e47b65)
• feat(modules): add maven, gradle and nuget credential exposure modules (#209) (8c8f8af)
• feat(modules): add docker, kubernetes and kubelet api exposure modules (#212) (caeff39)
• feat(modules): add netdata and cadvisor exposure modules (#217) (b31234c)
• fix(scan): drop subdomain-takeover fingerprints for mitigated and generic services (#165) (5dc14ec)
• fix(scan): detect modern drupal by its headers (#170) (7e104ac)
• fix(scan): apply reflected-path tolerance to soft-404 calibration (#180) (af337bd)
• feat(modules): add json extractor (#191) (9cf7854)
• fix(frameworks): drop bare-substring signatures that false-positive (#133) (d34db55)
• feat(modules): support or logic via matchers-condition (#189) (f37094c)
• feat(modules): add favicon hash matcher (#183) (0422b8b)
• fix(frameworks): make Shopify detection specific (#155) (672858b)
• test(modules): fix favicon_test checkMatchers arity after matchers-condition (#228) (17cf26c)
• fix(frameworks): make Spring Boot detection specific (#157) (54d1be2)
• feat(modules): add favicon fingerprint demo module (#184) (0c6a8db)
• feat(modules): add wordlist file support to http modules (#158) (184842f)
• fix(frameworks): make CodeIgniter detection specific (#156) (fb9b92a)
• test(scan): fix integration_test SQL arity after calibrate param (#230) (7c0eb0b)
• chore: migrate module path to github.com/vmfunc/sif (#194) (39b3333)
• style: apply gofmt to source tree (#232) (96092da)
• docs(readme): fix invalid discord shield invite link (#231) (ee4ade2)
• ci(claude-review): skip fork and dependabot PRs where auth is unavailable (#268) (9d95c5b)
• chore(deps): bump github.com/tidwall/gjson from 1.18.0 to 1.19.0 (#264) (3971d37)
• chore(deps): bump reviewdog/action-markdownlint from 0.26.2 to 0.27.0 (#265) (61c4d33)
• chore(deps): bump reviewdog/action-yamllint from 1.21.0 to 1.22.0 (#266) (0caca05)
• fix(frameworks): stop false positives and version mis-extraction (#247) (6575c2e)
• feat(modules): detect exposed huggingface inference servers (#234) (37a1a9e)
• feat(modules): detect exposed llm chat frontends (#237) (9e2965b)
• feat(modules): detect exposed data labeling tools (#239) (7e3648e)
• feat(modules): detect exposed ai image generation servers (#241) (a549102)
• feat(modules): detect exposed ml experiment trackers (#243) (fcccff5)
• feat(modules): detect exposed vector search engines (#244) (754739b)
• feat(modules): detect exposed ai speech servers (#245) (84ae3a7)
• feat(modules): detect exposed one-api llm gateway (#246) (1b06770)
• feat(modules): add loki, jaeger and zipkin exposure modules (#248) (16ffcc2)
• feat(modules): add concourse, woodpecker and gocd exposure modules (#250) (b9bca40)
• feat(modules): add node-red flow api exposure module (#251) (64e3f54)
• feat(modules): add caddy and envoy admin exposure modules (#252) (c69818e)
• feat(modules): add dagster and mage exposure modules (#253) (b4dec11)
• feat(modules): add sidekiq, flower and rq-dashboard exposure modules (#254) (855a47c)
• feat(modules): add selenium grid and selenoid exposure modules (#255) (2a49a72)
• feat(modules): add prometheus alertmanager exposure module (#256) (19eb3b4)
• feat(modules): add jenkins and nifi exposure modules (#257) (2c9bb4b)
• feat(modules): add grafana anonymous access exposure module (#259) (551c89a)
• feat(modules): add n8n settings exposure module (#260) (ed0cceb)
• feat(modules): add kafka ui and kafdrop exposure modules (#261) (7979463)
• feat(modules): add zookeeper and hadoop namenode exposure modules (#262) (12cab93)
• feat(modules): add eureka and spring boot admin exposure modules (#263) (7eb6603)
• chore(deps): bump actions/checkout from 4 to 7 (#267) (f97c676)
• feat(httpx): retry 429 and 503 with Retry-After backoff (#227) (1bb5439)
• feat(modules): detect exposed ai orchestration platforms (#242) (6e022d5)
• feat(modules): add clickhouse and dgraph exposure modules (#258) (3a289a3)
• feat(modules): detect exposed openai-compatible llm servers (#233) (24bcab0)
• feat(modules): detect exposed local llm runners (#235) (e1c8e39)
• feat(modules): detect exposed gpu inference servers (#236) (122fe5f)
• feat(modules): detect exposed rag and knowledge apps (#238) (abcc22d)
• feat(modules): detect exposed ml platforms (#240) (9e8fb3a)
• feat(modules): add traefik, nomad and portainer exposure modules (#249) (7ea1cd2)
• fix(notify): redact secret webhook url from transport errors (4e49d79)
• fix(notify): neutralize markdown injection in slack/discord code blocks (7d938ac)
• chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#369) (9c4204f)
• chore(deps): bump github.com/projectdiscovery/nuclei/v3 (#368) (24f3481)
• feat(scan): add -concurrency flag to scan targets in parallel (#367) (d13622d)
• chore(deps): bump actions/setup-go from 5 to 7 (#371) (149fb6c)
• chore(deps): bump reviewdog/action-markdownlint from 0.27.0 to 0.28.0 (#370) (2965869)
• ci: run go and functional-test on merge_group (#372) (ef4b690)
• fix(scan): bound crawl breadth with a page budget (#269) (0d96838)
• feat(modules): add active web-vuln probe modules (#271) (f8f3b8c)
• feat(modules): add disable-redirects http option (#273) (2cfee4c)
• feat(modules): add host-header injection and xxe probe modules (#277) (294bfb0)
• feat(modules): add mongo-express, redis-commander and pgweb exposure (#278) (1f37085)
• feat(modules): add laravel telescope dashboard exposure module (#279) (7742b8e)
• fix(scan): correlate cname before confirming subdomain takeover (#281) (3ecc7e6)
• fix(scan): require a real bucket listing body before flagging s3 exposure (#282) (6b7762f)
• fix(scan): report the found url in dork results and dedupe by url (#283) (64a2250)
• fix(recon): tighten directory-listing matchers to real listing furniture (#284) (39244b4)
• fix(frameworks): stop gatsby and svelte prose from faking detection (#285) (251be84)
• fix(modules): guard ignition, web.config and appsettings against soft-404 shells (#286) (9be3d4a)
• feat(modules): add s3, gcs and azure bucket listing modules (#288) (1ea8eff)
• feat(recon): add localai and invokeai exposure modules (#289) (b4fae85)
• feat(recon): add kubeflow pipelines and metaflow exposure modules (#290) (c24617d)
• feat(info): add roundcube and zimbra webmail fingerprints (#291) (a673eac)
• feat(recon): add postfixadmin setup and panel fingerprints (#292) (80c2574)
• feat(modules): add node inspector, rails routes and openapi exposure modules (#293) (015f458)
• feat(modules): add grafana tempo and otel zpages exposure modules (#294) (2a88881)
• feat(modules): add vaultwarden, authentik and synapse version modules (#295) (49e41e4)
• feat(modules): add hpe ilo, dell idrac and redfish exposure modules (#296) (f658fc2)
• feat(modules): add nsq and pulsar exposure modules (#297) (473c74d)
• feat(modules): add guacamole and webmin login exposure modules (#298) (b4206ef)
• feat(modules): add terraform tfvars, ansible vault and ci config exposure modules (#299) (cb65f86)
• feat(modules): add chartmuseum and verdaccio registry exposure modules (#300) (5444090)
• feat(modules): add haproxy stats, nexus and pushgateway exposure modules (#301) (243e0ab)
• fix(scan): baseline-diff lfi evidence to stop static-content false positives (#303) (4f01345)
• fix(scan): baseline-diff sql errors against shared templates (#304) (9fce39c)
• fix(scan): gate cors http-downgrade probe on https targets only (#305) (12067b4)
• fix(scan): strip url whitespace before open-redirect host check (#306) (e8eee5c)
• feat(modules): add tcp module executor and recon modules (#308) (bf8c6a8)
• fix(scan): tolerate ref path items when parsing openapi specs (#309) (e2da1bc)
• fix(scan): grade hsts on the final response scheme after redirects (#310) (5e1c029)
• fix(scan): accept string-encoded jwt exp claim (#311) (a46aea1)
• fix(report): map sarif level to finding severity (#312) (5972cc9)
• feat(report): add json findings report with -json (#313) (f570dce)
• feat(modules): embed built-in modules in the binary (#316) (356b16f)
• feat(modules): add case-insensitive word matcher option (#319) (5ebeb89)
• fix(frameworks): match cve entries against a bare-major version (#320) (fa84b3f)
• fix(scan): stop one over-long url from dropping the wayback feed (#321) (2293532)
• fix(js): bound next.js manifest fetch with the scan timeout (#323) (b72e076)
• fix(scan): honour the caller context when downloading the ports list (#324) (41f35ac)
• fix(scan): truncate shodan banners on rune boundaries (#326) (a35f3bc)
• fix(scan): percent-encode dork queries before search (#327) (1f6d0f7)
• feat(output): add routable Sink for per-scan output capture (#331) (281e59c)
• fix(httpx): stop leaking cookie/auth headers on cross-host redirects (#332) (03b023e)
• fix(crawl): stop redirects escaping crawl scope, cap fanout (#333) (788d20c)
• fix(report): sort sarif driver rules and strip crlf from markdown headers (#337) (d8ca2e9)
• fix(modules): search system data dirs for built-in modules (#338) (3e55f38)
• fix(scan): validate git exposure responses are real git artifacts (#339) (598d85e)
• fix(detectors): framework detector fp/fn corpus pass (#341) (e04d4e1)
• fix(js): supabase jwt base64url decode and per-project error isolation (#342) (c1b7c7c)
• fix(store,logger,scan): concurrency-adjacent races and correctness fixes (#343) (a44cfb2)
• fix(scan): tune js secret rules for false positives and missed formats (#344) (d93fcbc)
• fix(modules): guard regex extractor against negative group index (#346) (91df2cc)
• feat(modules): add crlf and ssi injection detection modules (#347) (a435c04)
• fix(scan): resolve favicon href against origin to stop pathful-target misfetch (#350) (75597fc)
• feat(pool): add EachCtx for cancellable fan-out (#352) (7e6f6fe)
• fix(scan): decode html entities in probe title (#354) (c5fed20)
• feat(config): add -config/-profile config file and profile overlays (#357) (dff4de3)
• refactor(fingerprint): make the favicon tech table the single source (#358) (059d735)
• feat(frameworks): add web application firewall detectors (#360) (bd91f7f)
• fix(modules): pass case-insensitive flag to tcp word matcher (#373) (0185644)
• fix(modules): route module scans through the shared http transport (#318) (a664f36)
• fix(scan): fetch wayback source over https (#351) (d52cd84)
• fix(frameworks): scope header markers to stop bare-brand false positives (ee74728)
• fix(frameworks): tighten alpine and flarum against substrings (129abe8)
• feat(frameworks): add 8 hosting and edge platform detectors (47e28fa)
• feat(frameworks): add 5 framework detectors (b2b25e7)
• feat(frameworks): add 6 framework detectors (de7740c)
• feat(frameworks): add 10 framework detectors (72ac357)
• feat(frameworks): add 23 framework detectors (f64fe01)
• fix(frameworks): tighten cakephp and strapi against prose (cc1b307)
• fix(frameworks): tighten stimulus and symfony against solo false positives (13a6ac0)
• chore(frameworks): trim tautological detector doc comments (0a0e08b)
• fix(frameworks): drop the hosting and jquery detectors from this batch (f23fd00)
• fix(scan): capture every chunk in next.js build manifest arrays (#345) (6500b08)
• fix(notify): break every backtick so long runs cannot reform a fence (4de8fae)
• fix(scan): decode supabase jwt body as base64url (#348) (a09643c)
• fix(frameworks): stop prose and image mime types from faking magento (#322) (7d206ad)
• feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340) (1d7e219)
• feat(scan): add tls certificate recon module (#274) (3e00297)
• feat(modules): add a range matcher for response size or status (#362) (c195e88)
• feat(frameworks): report every detected technology (#314) (1820ba2)
• fix(frameworks): stop django source prose from faking detection (#328) (b805bfb)
• feat(modules): add dynamic-variable request chaining (#317) (c2dbe4a)
• refactor: share path-resolution and body-cap helpers (#355) (f6db61b)
• fix(tcp): stop a cancelled context from being swallowed by the deadline re-arm (#366) (2ce359a)
• fix(modules): read the chained-request body through the shared cap (#374) (a38ba0a)
• fix(finding): key header findings by value and sort findings deterministically (1302113)
• fix(finding): key repeated headers by occurrence, not by value (e8de5f8)
• refactor(cli): drop comments restating adjacent dns/subdomain code (a350757)
• fix(output): sanitize control bytes before printing to the terminal (18b4841)
• fix(scan): route whois record through the sanitized output sink (5b11639)
• fix(scan): point stderr module loggers at the output sink (0d9b054)
• fix(output): truncate progress item text on rune boundaries (f250590)
• feat(modules): add fingerprint module type (830ad7b)
• feat(js): add provider-prefixed and structural secret rules (4f82486)
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (c64ea41)
• chore(deps): bump actions/labeler from 6 to 7 (55d1094)
• feat(frameworks): enrich cve findings with reference urls (d5e7447)
• fix(favicon): read icon with the shared body cap so both paths hash identically (3aad57c)
• test(frameworks): pin cve bare-major + reference-url invariants (0c1b989)
• refactor(modules): thread a MatchContext through the matcher engine (4fda4fe)
• fix(modules): reject empty word and regex matchers at load (7625f0a)
• fix(favicon): skip hashing non-image favicon responses (b51c422)
• test(favicon): guard yaml favicon hashes against the fingerprint table (d077fcf)
• chore(deps): bump github.com/projectdiscovery/goflags (6e35a68)
• chore(deps): bump reviewdog/action-yamllint from 1.22.0 to 1.23.1 (6af4799)
• chore(deps): bump reviewdog/action-shellcheck from 1.32.0 to 1.32.1 (d2488e0)
• chore(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 (f0f2476)
• Merge pull request #375 from vmfunc/dependabot/github_actions/ossf/scorecard-action-2.4.4 (ba4ec94)
• Merge pull request #393 from vmfunc/dependabot/github_actions/reviewdog/action-yamllint-1.23.1 (d5e61a8)
• Merge pull request #394 from vmfunc/dependabot/github_actions/reviewdog/action-shellcheck-1.32.1 (b748889)
• Merge pull request #377 from vmfunc/dependabot/github_actions/actions/labeler-7 (479f311)
• Merge pull request #395 from vmfunc/dependabot/go_modules/golang.org/x/net-0.58.0 (c196912)
• Merge pull request #391 from vmfunc/dependabot/go_modules/github.com/projectdiscovery/goflags-0.1.76 (a7e25d5)
• Merge pull request #330 from TBX3D/feat/per-target-accumulator (cd7e21f)
• Merge pull request #334 from TBX3D/harden-notify-clean (b0397fc)
• Merge pull request #335 from TBX3D/harden-dedup-clean (f6cef07)
• Merge pull request #336 from TBX3D/harden-output-clean (d117a04)
• Merge pull request #356 from TBX3D/spike/fingerprint-type (23d119c)
• Merge pull request #361 from TBX3D/feat/js-secret-provider-coverage (a63f678)
• Merge pull request #381 from TBX3D/lane/favicon-hardening (5414082)
• Merge pull request #380 from TBX3D/lane/cve-references (0d4a523)
• Merge pull request #379 from TBX3D/lane/match-context (6187d11)
• Merge pull request #363 from TBX3D/feat/fw-detectors-batch2 (7b4c32f)
• Merge pull request #382 from TBX3D/lane/matcher-validation (e9d578a)
• chore(deps): bump reviewdog/action-markdownlint from 0.28.0 to 0.30.0 (#404) (89665d7)
• chore(deps): bump github.com/projectdiscovery/retryabledns (#398) (69328c5)
• chore(deps): bump github.com/projectdiscovery/goflags (#397) (c834f4e)
• chore(deps): bump reviewdog/action-misspell from 1.27.0 to 1.29.0 (#402) (18b1088)
• chore(deps): bump reviewdog/action-shellcheck from 1.32.1 to 1.34.1 (#401) (05895a5)
• chore(deps): bump reviewdog/action-yamllint from 1.23.1 to 1.25.1 (#403) (3b49238)
• ci: build with go 1.26 (#406) (2e67c9b)
• chore(deps): bump github.com/projectdiscovery/utils (#396) (f98638f)
• fix(httpx): keep the no-drain reuse control valid on go 1.27 (#417) (f6302ce)
• fix(modules): guard backup-files against soft-404 html shells (#270) (8556880)
• feat(modules): add cockpit and gitea fingerprint modules (#272) (6a9cef0)
• feat(modules): add zabbix and icinga monitoring exposure modules (#275) (b6b01b5)
• chore(deps): bump reviewdog/action-misspell from 1.29.0 to 1.30.3 (#420) (e16c0f7)
• chore(deps): bump reviewdog/action-markdownlint from 0.30.0 to 0.32.0 (#419) (9049b2f)
• chore(deps): bump reviewdog/action-yamllint from 1.25.1 to 1.25.4 (#418) (119c52b)
• chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#414) (a542c48)
• chore(deps): bump github.com/antchfx/htmlquery from 1.3.6 to 1.3.7 (#411) (692f87d)
• chore(deps): bump github.com/tidwall/gjson from 1.19.0 to 1.20.0 (#410) (9b73fab)
• chore(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 (#408) (a540ab2)
• fix(frameworks): stop prose and unrelated headers from faking strapi and cakephp (#276) (6926886)
• fix(ci): align toolchain references on go 1.26 (#421) (dea473a)
• feat(modules): add lint and test subcommands (#422) (0340c50)
• ci(modules): gate module PRs on lint (#423) (6db057c)
• refactor(scan): stream findings through an event sink (#424) (d959689)
• feat(tui): live scan dashboard (#425) (dcbcce6)
• feat(tui): interactive scan picker (#426) (6cb9451)

install

homebrew / linuxbrew

# coming soon

debian / ubuntu

sudo dpkg -i sif_2026.11.4_amd64.deb

go install

go install github.com/vmfunc/sif/cmd/sif@v2026.11.4

binary download - grab the right archive from below.

verification

sha256sum -c checksums-sha256.txt