Release Notes¶

#84 · Enhanced Private Locations: WebSocket & CLI Support

We’ve released a new version of our Private Locations feature, now supporting testing of internal APIs with more protocols, including WebSocket, which was previously unsupported.

Additionally, Private Locations are now available through the Escape CLI for a smoother experience. Learn more here.

Key benefits:

1. Single Pane of Glass

All Escape tooling (CLI for API interactions and Private Location management) is now unified into one binary, reducing complexity and making deployment easier.

2. Improved Stability & Scalability

• More stable and scalable, especially for frontend DAST
• More reliable health checks for uninterrupted operation

3. Simplified Setup & Usage

• No more manual repeater ID creation
• Support for WebSocket protocols for better API testing
• No Node.js installation required (binary format)

4. Enhanced Transparency & Monitoring

• Open-source & auditable for security and transparency
• Direct log access from the Escape front-end
• New workflow indicating when a repeater is unhealthy

Migration from Legacy Repeater

If you're using the old repeater image, follow the migration guide below to switch to the new CLI-based approach.

The new escapetech/cli image simplifies setup—no need to manually create a repeater or copy-paste its ID.

Steps to migrate:

1. Retrieve your API key from your profile page
2. Update your configuration:
   • Remove the ESCAPE_REPEATER_ID environment variable
   • Add the ESCAPE_API_KEY environment variable
3. Update the startup command:\ locations start -v location-name where location-name is your desired location name
4. Switch from the escapetech/repeater image to the escapetech/cli:latest image

#83 · Advanced: Extend DAST Exploration for Deeper Security Testing

Escape's DAST exploration runs for 30 minutes by default, striking a balance between speed and depth to identify business-critical vulnerabilities quickly. However, for even more comprehensive coverage, you can extend the exploration time in the Expert Settings, allowing the algorithm to analyze your application more thoroughly.

How to extend exploration time:

Go to Scan → Expert → Set max_duration to your desired duration.

Learn more about expert settings here.

#82 · New Security Test: Stack Trace Disclosure Detection

We've added a new security test to detect detailed error messages and stack trace disclosures, which can expose sensitive system details such as file paths, code snippets, and internal IPs. This test is now included by default in Escape's DAST.

When you return clear technical error information in a response, attackers might use that information to identify the specific technologies you're using, making it easier for them to target known vulnerabilities in those systems.

Here you can find an example:

It's important to sanitize or hide these detailed errors and only log them internally so that you protect your application's inner workings from potential exploitation.

Learn more in our documentation.

#81 · Instant Resource Access with Ctrl+K / Cmd+K

You can now quickly jump to any resource within the Escape app or create a new app DAST scan — whether for REST, GraphQL APIs, or frontends — instantly using the Ctrl+K or Cmd+K (Mac) keyboard shortcut.

How to use

• Press Ctrl+K (Windows) or Cmd+K (Mac) anytime within the Escape app.
• Type to search for the resource you need, or choose from the list.
• Select your desired option from the search results to navigate directly to it.

We hope this feature will help you improve your efficiency!

#80 · Disable Private Locations

We've improved the private location selector, giving you more control over where your scans run:

You can now disable specific locations, ensuring your tests only execute in the private networks that matter at this moment to you.

Need to disable any private locations? Go to -> Organization -> Private Locations.

#79 · Playwright Authentication Improved

The Playwright authentication preset is designed for scenarios where traditional authentication methods fall short, leveraging browser automation to handle logins seamlessly.

Instead of manually opening your app’s login window and entering credentials, Escape’s proprietary AI agent detects login fields, fills them in automatically, and logs in for you—enabling fully authenticated DAST scans without extra steps.

Once the login process is complete, you can now view screenshots at each step, helping you verify success or quickly troubleshoot any issues:

Be certain — with this internal and secure technology, credentials are never sent to any external AI provider, ensuring complete privacy.

This is an exciting step forward in making authenticated DAST scans more seamless and efficient!

Learn more about Playwright authentication here 🚀

#78 · Frontend DAST Improvements

We've made several improvements to Escape's Frontend DAST to enhance its accuracy and reliability. One key update is the addition of an HTML injection check that helps identify vulnerabilities where an attacker can inject malicious HTML code into a web application.

Usually, this can lead to issues like:

• Content Manipulation – Attackers can modify the page’s content, affecting how it looks and functions.
• Phishing Attacks – Malicious forms or fake login pages can be injected to steal user credentials.
• Session Hijacking – Attackers can insert scripts that steal session cookies.

By adding an HTML injection check to Frontend DAST, the scanner can now detect these vulnerabilities before they become a real threat, helping you secure your applications more effectively.

#77 · Jira Integration Fix

We've fixed a bug in our Jira integration that was preventing proper functionality.

As part of this fix, the integration now fully supports API keys, ensuring a more secure and reliable connection. This update improves authentication and overall stability, making your Jira experience smoother than ever.

Don’t wait—connect your Jira account today and start automatically providing developers with the remediation information and code snippets they need, tailored to their framework!

#76 · Remediations Update

We've revamped remediations for all frameworks to deliver clearer, more actionable guidance. This update aims to improve the accuracy and usability of remediation steps, making it easier to identify and resolve issues efficiently.

With more detailed insights and practical recommendations, you can now take faster, more informed actions. We hope this helps you fix critical issues more quickly and build even greater trust with developers!

#75 · More Detailed Information About Frontend Apps in Inventory

We’ve enhanced the Inventory section to provide more detailed insights about your front-end applications!

How to Access

Navigate to:\ Inventory → All Services → Frontends → Click on the app in question

What's New?

Each frontend app now includes a comprehensive information card with the following details:

Description

• Provides a quick overview of your frontend app.

Key Metadata

• Created: Displays when the frontend app was added (e.g., 5 months ago).
• Last Seen: Shows the most recent activity (e.g., an hour ago).

Sensitive Data

• Highlights potential security risks by identifying exposed sensitive data and its type.

Endpoints Consumed by the Frontend App

• Displays a list of API endpoints the frontend app interacts with, providing better visibility into dependencies and integrations.

Activity Log & Comments

• Under the Activities tab, you can now add and view comments related to the app, ensuring better collaboration and tracking.

We hope this update will help you gain better insights into your frontend applications!