2026.09.01

Expanded API and automation support

More of Reporter's review, remediation, and content-management functionality is now available via the API, expanding what you can build with integrations, automation, and AI-assisted workflows.

• You can now approve findings, assessment sections, and retests or request revisions through new review-event routes. Revision requests can include Markdown instructions and attachments, and automatically create the corresponding task for the researcher.
• You can now record remediation status changes through the API, including an explanation and attachments. Setting a finding to "Accepted Risk" requires a reason and keeps the decision documented in the finding timeline.
• All accessible assessment section events can now be listed through the API. Assessment Section Event permissions are grouped with their individual event types when creating an API token, matching the existing grouping for Finding Events.
• Snippets now have full API support, including creating, reading, updating, translating, and deleting them.
• Notifications can now be listed and marked as read or unread.
• A new index route for tags lets integrations retrieve and reuse existing tags. New tags can still be created by assigning a new tag name to a supported object.
• A new index route for teams makes it possible to retrieve the available teams that can be assigned to assessments.
• Tasks, notifications, and activities can now include the different types of objects they refer to through polymorphic includes. The returned structure depends on the related object, and data is omitted when the API does not support that object or the token does not have permission to read it. See the new Polymorphic Includes section in the API documentation for details.

API Token Management

• Administrators now have an All API Tokens tab where they can search, filter, inspect, and revoke every user's API tokens. Administrator API tokens can also list, retrieve, and revoke tokens belonging to other users.
• API token IDs are now displayed on the API token page. Since every plaintext token starts with its ID, a token beginning with 123| can be identified as token 123 in Reporter.
• When an API token is created through the API with a grouped Finding Event or Assessment Section Event permission, it now automatically receives the corresponding permissions for each event type in that group.

New scoring system: Implementation Status

Implementation Status is a new scoring system for audits that assess the extent to which security measures have been implemented, including those based on ANSSI's Guide d'hygiène informatique. It provides five ratings:

• Implemented with Procedure (OK)
• Implemented (Info)
• Under Consideration (Medium)
• Not Implemented (Critical)
• Not Applicable

Rating-based scoring also includes the following improvements:

• The Audit Table report component can now be used with Implementation Status and Compliant / Not Compliant assessments as well as Audit Rating assessments.
• Rating-based assessments and their report components now consistently use Rating terminology and rating-specific badges instead of vulnerability severity labels.

Translation note - Report components now use separate translation strings for Severity and Rating terminology. If you use Audit Rating, Compliant / Not Compliant, or Implementation Status with customized or non-English report translations, add translations for the new Rating strings in Settings > Translations. Missing translations fall back to the default English text.
 

Finding Import Improvements

You can now import all eligible findings from previous assessments, including resolved findings and those not classified as vulnerabilities. Disable Only unresolved findings when selecting the assessments you want to import from, then choose the relevant findings in the next step.

Imported findings now preserve their original severity alongside their current severity. For example, a finding that changed from Medium to Info after a retest is imported with Medium as its original severity and Info as its current severity. The first event in the imported finding’s timeline shows this earlier severity change, making both its starting point and current state immediately clear.
 

Any open retest request is copied to the imported finding, including its description and attachments, so the request remains available in the new assessment. 

If you prefer to treat the current severity as the starting point in the new assessment, use Reset initial severity button. This sets the original severity to the current value and removes all existing severity changes from the timeline.

Greater Control over PDF Page Breaks

Reporter automatically handles pagination in PDF reports. Authors who want precise control over where specific content starts can now override the automatic page flow by inserting manual page breaks from the Markdown editor.

• This feature is disabled by default. Enable it in Settings > Functionality > Manual page breaks to add the page-break menu to the editor.
• A regular [page-break] always starts a new page.
• A conditional break such as [page-break if-less-than="5cm"] starts a new page only when less than the specified amount of space remains. The editor defaults to 5 cm, which can be adjusted.
• Manual page breaks affect PDF reports only.

Improvements

• Added a General assessment template for security assessments that are not tied to a specific framework, such as infrastructure tests, configuration audits, and phishing campaigns. On existing installations, add it from Assessment Templates > Clone default template.
• Added an option to hide line-wrap symbols (↪) in code blocks in PDF reports. Configure it in Themes > [Your theme] > Miscellaneous > Code blocks.
• PDF tables are now less likely to begin near the bottom of a page with too little room for their contents.
• The Action Plan tables now show a clear message when there are no outstanding actions to display.
• Expanded the documentation for the API, MCP Markdown authoring, shared container environment variables, AI instructions, finding imports, scoring systems, and report customization.
• WEBHOOK_PRIVATE_RANGE now supports the carrier-grade NAT range (100.64.0.0/10), allowing webhook destinations on mesh VPNs such as Tailscale to be whitelisted. See Documentation > General > Settings > Webhooks for configuration and security guidance.
• Updated the report translation files for all languages in the Reporter Languages repository to include the latest report text.

Bug Fixes

• Fixed researcher-panel errors caused by background requests being interrupted during navigation or blocked by two-factor authentication.
• Fixed an issue where the reporter:update-available webhook fired during every hourly update check. It now fires once per release.
• Fixed an issue that prevented all checklist test cases from being removed from a finding on the finding edit page.
• Fixed SMS authentication when confirming your identity while impersonating another user.
• Fixed an issue where editing a retest request created a new finding version even when no finding data had changed.
• Finding version history now records when checklist test cases are added to or removed from a finding.
• Fixed Action Plan table columns becoming misaligned when the priority or complexity column was hidden.
• Fixed nested API includes being dropped when their parent relation was listed after them, such as include=assessmentTemplate.sections,assessmentTemplate.
• Fixed document includes for nested assessment sections returning no results and document includes crashing when a file custom field had been deleted.
• API output file listings now return the correct tool_findings_count.
• Fixed an issue where setting an individual Finding Event permission to None after granting Read and Write access to the Finding Events group could break the API token form. Permissions required by the selected group are now disabled.