ShakerScan Open Source

Status: candidate prepared 2026-10-05. Publication and stable-channel promotion are pending.

This patch release fixes defects found after 2.7.0 shipped: in a post-release audit and while testing 2.7.0 behind an Enterprise gateway. It ships with client 0.7.5.

Proof and evidence

• Authentication-bypass proof reads the whole response the transport accepted and returns no token signal when the JSON does not parse or part of the document lies beyond the bounded inspection walk. A rejection hidden past those limits can no longer become verified proof; the candidate stays an observation. Managed login is unchanged. (#327)
• Purging a scan's HTTP archive covers the same child scans its export shows, clears their archive statistics and reports the owner ids it covered. Clearing a parallel or discovery run no longer reports 0 while leaving child traffic behind. (#327)
• In-process scan capabilities are archived under their own capability name, and the archive separates external scanner traffic (relayed through an opaque pinned tunnel) from engine capabilities that recorded no calls. (#328)

Scans and findings

• The scanner image bakes the nuclei template index, and workers rebuild it before taking jobs when it is missing. The first scan after a worker start no longer spends its passive-template budget indexing templates and finishing with no template findings. (#328)
• A target with no published spec reports source_not_published instead of output_truncated. A scan that selects XSS or SQL injection but derives no candidates explains why, for example that JSON body APIs need state-changing HTTP permission. (#328)
• Fix guidance is kept from the producing check and covers Git credential and configuration exposure, SSH password authentication and the connected-device checks. (#328)

Connected devices and Hunt

• Connected-device scans and probes apply SHAKERSCAN_PRIVATE_NETWORK_TARGETS at submission and again in the device worker. The default still allows private networks; Lab environments keep their allowance. (#328)
• A privileged Hunt start on a target whose scope is blocked reports the scope refusal and its reason first, instead of asking for an authorization receipt that could not be recorded. (#328)
• Asset and Connected Devices views list confirmed open ports as discovered services; UDP probes with no response are shown separately as unconfirmed. (#328)

Install and upgrade

• A root start after a non-root install moves the operator's files under results/ to the root API identity, so existing private archive payloads stay readable. Returning to a non-root start needs the manual chown described in docs/upgrade-and-rollback.md. (#327)

Delivery and validation

This note records the prepared scope, not a completed release certification. Exact-candidate certification, immutable version publication, public installer smoke and the stable-channel PR must succeed before the hosted installer advances.