Skip to content

v4.6.14

Choose a tag to compare

View all tags
@xalgord xalgord released this 01 Sep 21:11
· 13 commits to main since this release
v4.6.14
9eebd3e

v4.6.14 — Uploaded context seeds the hypothesis ledger

Changed

  • Uploaded scan-context artifacts now seed the hypothesis ledger, not just a briefing. When a scan starts with an OpenAPI/Swagger spec, HAR, Postman collection, or Burp export, Xalgorix already parsed it into a normalized endpoint surface and registered any captured session — but the endpoints only appeared as a passive text briefing. They now also become bounded, role-scoped authorization hypotheses (the prime IDOR/BOLA surface) in the shared ledger, so the operator-supplied surface directly drives authz_matrix and the evidence-driven specialists. Role is authenticated when the artifact carried a live session, else anonymous. Seeding is deduplicated (class/endpoint/parameter/role) and bounded, so it never floods the scheduler or double-counts across sub-agents. Mirrors what ingest_har does mid-scan, now applied to every context upload at scan start.

Binaries: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 (v4.6.14, stripped).

Full changelog: https://github.com/xalgorix/xalgorix/blob/main/CHANGELOG.md

Assets 6
Loading