You can now automatically format syntax-highlighted code blocks by clicking the magic wand icon that appears when you hover over them. Pretty-printing is supported for JSON, JavaScript, TypeScript, CSS, SCSS, HTML, YAML, GraphQL, Markdown, XML and PHP.
For HTTP code blocks, Reporter can also reformat the body. A Content-Type header is required so Reporter can determine the correct language and formatting rules.
Breaking API change - This release contains a minor API breaking change. Please read the following release notes before upgrading.
The JSON response format for creating API tokens via the API has changed to make the response consistent with other API routes.
Breaking change! - This release contains API breaking changes. Please read the following release notes before upgrading.
Admins can now send announcements to users through in-app notifications, email, or both. Recipients can be targeted in several ways:
Breaking and recommended changes - This release contains API breaking changes and recommended changes to the application settings. Please read the following release notes before upgrading.
"Resolvers" on findings have been renamed to "Assignees". This term better reflects their role as the users responsible for following up on a finding, and matches the convention used by tools like GitHub and GitLab.
We have introduced several improvements to client-level access control, giving teams more flexibility and control when managing client access across assessments. You can now grant access to all current and future assessments, delegate client access management to designated client users, and define client user properties, such as whether a user is a client lead, across all assessments.
Reporter now ships with a built-in MCP server, allowing AI assistants to interact with your Reporter instance through natural conversation.
Short screen recording showing the MCP server in action:
In the previous release, we introduced new API filter operators such as greater-than and not-equal. A bug in that implementation caused some API integrations to break when multiple filter values were used. Previously, a filter like filter[severity]=1,2 returned results where severity = 1 OR severity = 2. Due to the bug, this was incorrectly evaluated as severity = 1 AND severity = 2, resulting in no matches. This issue has now been fixed. Multiple filter values once again default to OR behavior.
Breaking change, read the upgrade guide! - Likelihood of Impact: Very High
Reporter has been updated to use Elasticsearch 8 and Redis 8. You MUST upgrade to Elasticsearch 8 and Redis 8 as part of this upgrade! Reporter will not be compatible with Elasticsearch 7 after this upgrade.
Use the following instructions to set up Elasticsearch 8 and Redis 8:
With just a few clicks, you can now duplicate entire assessments, making this functionality perfect for setting up recurring engagements. Create your assessment once, then clone it for each new iteration or project. All your targets, structure, and even unresolved findings can be carried over.