🚀 What’s New
- AI Pentest Wizard Rework: The pentest launch wizard is now a streamlined four-step flow — Target, Verify Ownership, Source Repository, then Scan & Launch. You can optionally attach a source repository for white-box context, and the previous authentication step is no longer required to get started.
- War-Room Live Board: AI Pentest runs now feature a real-time war-room board that visualizes live attack progress as it unfolds. You can watch findings materialize on an interactive hex board while the scan is running — no more refreshing a static report.
- Bulk Delete for Pentest Runs: You can now select and delete multiple completed pentest runs at once from the pentest list, making cleanup fast and effortless.
- PlexiFlow Automation — Data Mapping & Per-Node Testing: Automation workflows now support typed data mapping between nodes, so you can pipe outputs from one step directly into the next with field templates on connector, ticket, and notification inputs. A new per-node testing capability lets you validate any individual step in draft mode before running the full workflow, and bounded batch iteration keeps large data sets from overwhelming a node.
- Repo-Centric Assets Page: The Assets page is now organized around your repositories, with dedicated tabs for Repo Scan, Registry Audit, and Cloud Assessment. New Source Control and Tags filters, a date-range filter, and a one-click Clear Filters action make it faster to locate the exact asset inventory you need.
🛠 Improvements
- Codex Remedium — Retry Parity: Remediation retries now work consistently regardless of a finding’s data shape — file-less findings no longer skip the bounded retry loop. When a remediation attempt fails, you see the exact failure reason instead of a generic error, so you can diagnose and re-trigger with confidence.
- Live Browser Waiting State: The AI Pentest asset page now shows a clear waiting indicator while a live browser session is preparing, instead of presenting a blank or stuck frame.
🔒 Security
This release includes a focused security hardening pass across authentication, session handling, and transport:
- WebSocket access tokens are now transmitted via a named subprotocol instead of the URL, preventing token leakage in logs and browser history
- Login sessions are now fully invalidated on logout, so a signed-out token can no longer be reused
- Session cookies are now enforced with the Secure attribute, ensuring they are only transmitted over encrypted connections
- Transport encryption has been strengthened across all platform endpoints
🔧 Fixes
- Hidden live surfaces on pentest detail: Non-functional live browser and log surfaces no longer appear on the pentest detail page for applicable run types — only the war-room board that actually produces a live frame is shown.
- SMTP setup: Email relay configuration now correctly references the documented password key, so outbound email authentication works as described in the setup guide.