Releases

API Filtering

In the previous release, we introduced new API filter operators such as greater-than and not-equal. A bug in that implementation caused some API integrations to break when multiple filter values were used. Previously, a filter like filter[severity]=1,2 returned results where severity = 1 OR severity = 2. Due to the bug, this was incorrectly evaluated as severity = 1 AND severity = 2, resulting in no matches. This issue has now been fixed. Multiple filter values once again default to OR behavior.

Elasticsearch and Redis updated

Breaking change, read the upgrade guide! - Likelihood of Impact: Very High

Reporter has been updated to use Elasticsearch 8 and Redis 8. You MUST upgrade to Elasticsearch 8 and Redis 8 as part of this upgrade! Reporter will not be compatible with Elasticsearch 7 after this upgrade.

Use the following instructions to set up Elasticsearch 8 and Redis 8:

Duplicate Assessments

With just a few clicks, you can now duplicate entire assessments, making this functionality perfect for setting up recurring engagements. Create your assessment once, then clone it for each new iteration or project. All your targets, structure, and even unresolved findings can be carried over.

Assessment templates and editor

The assessment template editor has been completely redesigned. You can now configure the entire assessment template, including all its sections, in a single form. Sections can be reordered with drag-and-drop, properties can be modified on the spot, and translations can be added directly without leaving the page. All changes are saved at once, making it much easier to maintain templates.

Flexible report layout

You can now insert fully custom pages anywhere in your report theme, each with its own layout, structure, and styling. This makes it easy to include elements like a disclaimer, cover letter, or dedicated contact page, designed exactly the way you want. Previously, text boxes and backgrounds could only be added to the front, back, and content pages.

API changes

Breaking change! - Likelihood of Impact: Very Low

The clonedTo and clonedFrom includes for findings have been renamed to importedTo and importedFrom. The events in the timeline relating to importing have been renamed from FindingCloneEvent to FindingImportEvent, and they now only appear on the original finding.

Researcher panel improvements

Researcher activity indicators

User icons are now displayed in the researcher panel, showing who is currently working on which finding and whether they have an active edit lock.

New Scoring System: PASSI

We’ve added support for the PASSI scoring system, developed by the French national cybersecurity agency ANSSI. This system uses a 4-point 'Impact' scale and a 4-point 'Ease of Exploitation' scale to determine the severity of findings, similar in approach to the OWASP Risk Rating Methodology.

Alongside this, we’ve introduced:

New Finding Statuses

Two new statuses have been added to findings: Partially Resolved and Unable to Verify. These are available alongside the existing statuses: Unresolved, Resolved, Retest Pending, and Accepted Risk.

Tool Findings API enhancements & new webhooks

We've enhanced the API and webhooks to provide greater control and automation over findings and targets extracted from supported scanning tools like Burp and Nessus. With these new capabilities, you can: