# ShakerScan 2.12.2

> ShakerScan documentation at v2.12.2. [Source](https://github.com/andriyze/shakerscan/blob/v2.12.2/docs/releases/2.12.2.md) · [Web version](https://shakerscan.com/docs/open-source/releases/2.12.2)

The client for this release is `shakerscan` 0.12.0 (unchanged).

A patch release: the certificate-transparency monitor no longer leaves a gungnir process running at
every domain reload, plus two small web UI corrections. No schema changes; a rollback restores the
pre-upgrade database dump, as for every release (`docs/upgrade-and-rollback.md`).

## Fixes

* **The CT monitor stops gungnir at every domain reload.** The `gungnir-worker` service reloads the
  monitored root domains every five minutes by cancelling the running monitor. The process cleanup
  ran only when the monitor ended on its own, so each reload left the previous gungnir running: the
  worker gathered one more process every five minutes, each taking CPU, until the container's
  memory limit killed them. The cleanup now runs on every way out (reload, worker shutdown, error):
  gungnir runs in its own process group, the group is signalled (SIGTERM, SIGKILL after 5 s) and
  the process is reaped before the next one starts. Any install that runs the CT monitor
  (`--profile gungnir`) should take this release.
* **The CT monitor skips address roots.** A target whose root is an IP address (for example
  `10.0.0.5`) is no longer passed to gungnir: certificate-transparency logs name DNS names, so
  watching an address could never match.

## Interface

* **The Targets row menu offers a Hunt only to someone who may start one.** "Start Hunt" (and, on
  a managed workspace, "Copy the Hunt command") now follows the `hunts.manage` session capability,
  the action that already decides the Hunt page's Stop. A viewer, or an installation without Hunt,
  no longer sees it (`docs/session-capabilities.md`).
* **A cancelled discovered-secret step-up says how to retry.** The notice now says the decision was
  not made and can be chosen again to confirm it in the browser, with the terminal command as the
  alternative.

## Known limits

* The session capabilities answer hides controls; it does not authorize anything. Every request is
  still decided by the server that receives it.