Release Notes¶

#104 · Smarter, More Reliable Browser Authentication

We’ve just released a set of improvements that make browser-based authentication flows more powerful, more reliable, and easier to configure. Here’s what’s new:

1. Automatic API token extraction during authentication

Our browser agent authentication got even more powerful. This preset uses an AI Agent to automatically perform the actions to log you in with the provided credentials.

It is now capable of automatically extracting API tokens from API requests made during the authentication process. This means your scans can kick off with the right tokens without any extra steps.

You can learn more about Browser Agent authentication and how to set it up in Escape's documentation.

2. Smarter logged-in detection with logged_in_detector_text

You can now use the logged_in_detector_text field in both Browser Agent and Browser Actions presets.

This configuration option lets the scanner know to wait for a specific piece of visible text that only appears after a successful login, ensuring that your authentication is reliable before scanning begins.

Learn how to set it up

• In the Browser Actions preset
• In the Browser Agent preset

3. New wait text step in Browser Actions Authentication preset

We’ve added a new wait_text action to the Browser Actions Authentication preset, allowing you to explicitly wait for certain text to appear on the page before moving on to the next step.

Use it to:

• Wait for the page to finish loading
• Confirm that the form is ready before filling it

It's pratical if one page is slow and you want to wait before filling a field. All of these have configurable timeouts in seconds.

Here's an example for both wait text and logged_in_detector_text presets:

presets:
  - type: browser_actions
    users:
      - username: piedpiper@escape.tech
        actions:
          - action: fill
            locator: input[name='username']
            value: piedpiper@escape.tech
            auto_submit: true
          - action: wait_text
            value: Forgot password
            timeout: 15
          - action: fill
            locator: input[name='password']
            value: xxxx
            auto_submit: true
    login_url: https://app.example.com
    logged_in_detector_text: 'Connected Integrations'
    logged_in_detector_timeout: 1
  - type: browser_agent
    users:
      - username: piedpiper@escape.tech
        password: xxxx
    login_url: https://app.example.com
    logged_in_detector_text: 'Connected Integrations'
    logged_in_detector_timeout: 15

4. Fewer CAPTCHAs, smoother logins

We’ve improved the default user-agent used during authentication to make it more stealthy and less likely to trigger bot protection systems. That means fewer CAPTCHAs and faster, more reliable logins.

These updates make it easier than ever to build robust, reliable browser-based authentication flows in Escape DAST!

#103 · Improved Logs Page & Updated Naming Conventions

We’ve made some updates to the front-end views to improve overall clarity. While several names have been slightly changed, they won’t impact your overall experience. Additionally, the Logs page of each app now provides more detailed insights to help you monitor and optimize your app’s performance.

You can now see the Mean (Request Duration) for each endpoint (or GraphQL operation). This represents the average time it took for the scanner to send requests to the endpoint, giving you better visibility into scan execution and performance.

#102 · Improved WIZ Integration

We’ve enhanced our Wiz integration to provide you with better visibility into exposed resources, making it easier to identify security risks in your environment.

We now extract more detailed information from WIZ, covering not only directly exposed resources but also those that may be exposed indirectly through services, machines, and other entry points.

What's new

Improved Visibility into Exposed Resources

We now extract more detailed information from WIZ, covering not only directly exposed resources but also those that may be exposed indirectly through services, machines, and other entry points.

Full Exposure Path Analysis

Escape also extracts information from the computed reachability path, which uncovers how resources might be exposed through services, ingresses, and other objects. This includes mappings such as Nginx ingress, Kubernetes services, and virtual machines, helping you spot indirect exposure points.

And then as before:

• Escape has access to the code repositories and matches those Resources with code repositories (including owners)
• Escape runs DAST at scale on those resources
• All the vulnerabilities, exposed secrets, findings, and remediations are fed back into the Wiz using DAST & ASM Vulnerability Findings enrichment and Escape's workflows, merging both infrastructure and application-level insights into a single, unified view.

This update makes our WIZ integration more powerful, helping you spot and address exposure risks with greater confidence.

#101 · Sensitive Data Detection in Front-End Applications

We’re excited to roll out a new feature that helps you catch sensitive data leaks in your front-end applications. Now, it’s easier than ever to find and manage exposed secrets across all of your apps.

What’s New?

Detect Sensitive Data Leaks in Front-End Apps

We’ve added the ability to scan front-end applications for any sensitive data leaks. This means you can now identify if secrets or credentials are unintentionally exposed in your apps.

View Exposed Secrets in One Place

All detected leaks will appear in the Exposed Secrets table, which you can find under the All Risks menu.

Please note that this menu does not contain Personally Identifiable Information (PII) data. For a detailed view of exposed secrets and PII specific to each app, head to the Sensitive Data tab in the scanned application. This provides a more granular look at what’s been exposed and where.

With this update, we aim to help you catch sensitive data leaks early, so they don’t turn into bigger issues down the road!

#100 · We've Expanded Our SQL Injection Detection to More Frameworks!

We’re rolling out an exciting update: our platform now detects SQL injection vulnerabilities in more frameworks!

You’ll now get extra coverage for:

• Propel
• Illuminate
• Doctrine
• SQLAlchemy
• MariaDB

This update makes it easier than ever to secure your apps across a broader range of technologies.

#99 · Enhanced Alert Justification with Screenshots and Code Snippets

We’re excited to announce a major enhancement to the justification process for detected vulnerabilities in our front-end DAST scanner!

Until now, you could only rely on HTTP requests to justify alerts — for example, looking at an HTTP request to demonstrate a vulnerability like an SQL injection. While this approach was effective, it had its limitations in conveying the full context of certain vulnerabilities.

Now, you can also include screenshots and code snippets to better justify alerts!

This new capability adds a much-needed layer of clarity, providing additional context and evidence that makes understanding and addressing vulnerabilities much easier.

See it for yourself:

Key Benefits:

• Better Context: With screenshots and code snippets, you can now offer clearer evidence and documentation, making vulnerabilities easier to analyze and resolve.
• Major Improvement for Frontend DAST: Frontend vulnerabilities often involve complex UIs and dynamic behaviors, and this enhancement simplifies the validation and remediation process.

We hope that this update will help you resolve vulnerabilities more effectively and efficiently, providing better visibility and documentation throughout the remediation process.

#98 · Enhanced Remediation Framework Selection for Frontend Scanner

We’ve enhanced the remediation process in our front-end scanner to help your teams close critical issues faster.

Previously, the framework for generating remediation code snippets was set by default. Now, users have the ability to select their preferred API framework when addressing API-related vulnerabilities, providing more flexibility and control over the remediation of issues.

This update gives you the flexibility to choose the framework that works best for you, making it easier and faster to resolve issues!

#97 · New Design for All Risks -> Issues Table

We’ve made several improvements to enhance the user experience with the All Risks -> Issues table. Here’s a breakdown of the new features:

• Enhanced Application Selection: Users can now select applications either by label or individually, providing more flexibility in managing and viewing the issues per application type important for your business.
• Jira Ticket Filter: We’ve added a filter for Jira tickets, allowing you to quickly and easily search and categorize issues linked to specific Jira tasks.
• Sorting by Severity: The issues are sorted by default by severity, ensuring that the most critical issues are always prioritized and easily accessible.
• Updated Funnel Stages: The stages for “High Business Impact” and “Critical” have been inverted in the funnel. Critical is now the most important stage, highlighting the highest priority issues.

Here is how your Issues Table will look now:

We hope these updates help make navigating through issues faster and more efficient!

#96 · [For GitLab Integration users only] GitLab Integration Enhancement

For organizations with a large number of repositories, GitLab integration has been enhanced to support more detailed crawling of repositories. This will ensure more thorough data collection and highlight repositories under Inventory -> Repositories.

#95 · Performance Boost on All Risks Page

We've implemented massive performance improvements to the All Risks page, significantly enhancing load times and responsiveness.