Stability for extended scans has been significantly improved: We've resolved an issue caused by a Python bug that randomly interrupted and killed long scans. We’re confident this fix will ensure a smoother experience with Escape!
We know how frustrating the authentication process in DAST scans can be, which is why we've made several key updates to streamline it! Our goal is to provide you with better flexibility and efficiency for your security testing needs.
Here's the full list:
We now support more complex authentication processes through the new Browser Actions Authentication Preset. This is especially useful for scenarios where traditional authentication methods don’t work well. With Browser Actions, you can customize your authentication flow using browser actions rather than relying on Escape's AI agent. This is ideal for form-based authentication where inputs are provided directly by users.
The Browser Actions preset uses Playwright for browser automation actions, such as filling in forms and clicking buttons. By default, it extracts cookies, localStorage, and sessionStorage from the browser, injecting them into the scan engine for frontend scans. For API scans, only cookies are injected.
Key benefits:
For detailed documentation and some examples of how you can set it up, visit: Browser Actions Authentication Preset.
We’ve introduced a new Single Page Mode to handle use cases where enterprise applications allow only one user to be logged in at a time. This feature ensures that authentication is managed seamlessly in environments with strict session controls, eliminating the need for additional configurations or manual intervention. Once authenticated, the system will maintain that connection throughout the scan.
For applications that automatically log users out when the tab is closed, our system now ensures that reauthentication is handled automatically. There's no need to reconfigure your DAST scan setup or manually log in again—everything is managed in the background, allowing for a smooth and uninterrupted scanning process.
In cases where applications do not allow multiple tabs to be logged in simultaneously, our updated DAST scanning process automatically manages reauthentication. This removes the hassle of managing tab states and ensures that your scan continues without the need to manually re-authenticate across multiple tabs.
The improvements we've made to our DAST scanning authentication process addressed the specific pain points our customers face, especially for complex or custom authentication systems! With these updates, you can now handle advanced authentication workflows, such as the one described above, without losing session continuity or compromising on scan effectiveness!
We’ve added a powerful new feature: the API Lifecycle Graph within the Inventory. This visualization allows you to see an in-depth view of your API service, including its lifecycle and key integration details.
We hope that visually representing all relevant information helps you make informed decisions faster and improves your ability to monitor, manage, and secure your APIs effectively!
We’ve added the PlaywrightUserPreset option to the advanced configuration settings. This allows you to inject optional headers during the authentication process and for authenticated requests, giving you more flexibility when setting up tests.
use the following structure:
presets: type: playwright
type: playwright
login_url: https://auth.example.com/login`
users:
header:
For each tested front-end application, our "Visited Pages" tab has received an upgrade!
The Visited Pages tab plays a crucial role in your scan results. Unlike API scans, where there is a predefined list of endpoints, front-end scanning relies on a crawling system and security checks engine. This allows you to validate which pages were visited and the issues found on each crawl.
Grouping of Similar Pages: Pages are now grouped by default, helping you focus on key pages and reducing noise for more efficient analysis.
Improved Page Organization: Each visited group includes:
Filters: You can filter by:
If you prefer to see everything, you can still click on Show All for the full view.
This update brings improved efficiency and better organization, allowing you to focus on critical findings and reduce unnecessary noise!
We’ve added a new filter to the Scanned Applications tab, allowing you to filter and view scanned front-end applications easily.
This makes organizing and accessing relevant applications easier, improving your overall testing workflow!
We’ve added a new option to scan APIs associated with the front-end without performing security checks on the front-end itself. If your developers update only the API without touching the front-end, you won’t want to waste time rescanning it. This new feature lets you focus on API vulnerabilities, speeding up the scanning process and avoiding unnecessary checks. To enable this, simply configure the new frontend_crawling_only boolean parameter in your advanced settings.
Under Scan
Either type frontend_crawling_only: true
frontend_crawling_only from the list.
As you know, one of Escape's native capabilities is the ability to generate API schemas for APIs without an associated specification. Escape reconstructs API schemas by parsing the Abstract Syntax Tree (AST) of both frontend and backend source code. Now, we’ve added the ability to visualize the components of the generated schema directly in the Summary tab within the context window for each app.
For example, you can now easily see details such as number of GET, POST, PUT, and DELETE methods for REST APIs.
This visualization provides clearer insights into how an API function and whether schema was correctly generated, making it easier for users to spot potential issues and inconsistencies, especially with complex APIs.
For more details on how the generated OpenAPI schema connects to the API service, check out our documentation.
We’ve improved Escape’s DAST scanner with better coverage and detection of business logic vulnerabilities.
This improvement focuses on REST APIs or front-end applications. Whether you’re scanning one or the other, our enhanced scanner now provides deeper insights and more accurate detection, helping you to identify and address even more complex vulnerabilities.
Our bi-directional integration with Wiz is now live!
Using previously ingested and enriched Wiz resources, Escape DAST identifies business logic vulnerabilities, API misconfigurations, and sensitive data leaks, then feeds these findings—including CWE classifications and remediations—directly into Wiz.
This integration enriches security teams with valuable context and ownership data, enabling them to prioritize and remediate vulnerabilities more effectively. With this unified solution, organizations can detect risks quickly, gain clear ownership insights, and confidently embed security early in the development lifecycle.
Here's how it works:
Want to benefit from the integration?Learn here how to set it up.