Skip to content

Release Notes

  • tagged DAST
  • 2 min read

#124 · Global Configuration for Scan Profiles

Escape now allows you to define global configurations that apply to all your scan profiles, streamlining the setup process across your organization. These configurations can be set at the organizational level, providing consistency and ease of management for repeated scan types.

Key Features of Global Configurations:

  1. Apply Defaults Across Scan Profiles

    For example, you can define what custom data types (named scalars) should be internal to your company and should never be exposed by any APIs by default and raise an issue if the scalar is found in a git repository in every scan.

  2. Network Configuration: Custom Headers & Timeouts

    On the network side, you can now define custom headers and timeouts globally. This provides better control over request configurations across your scans.

  3. Rate Limiting for APIs

    Rate limiting for APIs is now configurable at the global level. The way it is defined, however, has changed. Now you need to use the following variables to define the required parameters:

    max_duration in s

  4. Override Settings in Individual Scan Profiles

    For enhanced flexibility, you can override global configurations within specific scan profiles. This means:

    • If you need to set a different request timeout for a particular scan, you can now do so.
    • If you need to block specific routes during a scan, you can now easily blacklist pages (e.g., we’re blocking crawling of the "logout" page by default which you can override, or you can customize avoiding other specific routes).

How to Set Up Global Configurations:

To configure these settings, navigate to your Organization Page > General Settings and open the Global Configuration tab. From there, you can define, adjust, and manage your global scan settings.

global-config-example2.png

For more information on how to set Global Configurations up, check out our documentation:

  • tagged ASM
  • 1 min read

#123 · ASM Documentation Update

We’ve made updates to the ASM documentation to address commonly asked questions and provide more clarity on key aspects of the ASM functionality. The following topics are now covered:

  1. How to restart ASM and ASM scans
  2. When and why asset X is scanned
  3. How to view ASM scans

You can find the updated documentation here.

  • tagged Platform
  • 2 min read

#122 · Escape CLI – New Features with Escape Public API v3

We’re also excited to announce that the Escape CLI now fully supports all the new capabilities introduced in Public API v3. This brings enhanced functionality, making it easier for your team to interact with the platform directly from the command line.

cli.png

What's New in the CLI?

  1. Full API v3 Support
    • The CLI now provides full access to all the new features in API v3, ensuring you can manage assets, profiles, issues, events, scans, and more directly from your terminal.
    • This brings a streamlined experience for users already familiar with the API, allowing for a unified interaction between the CLI and the API.
  2. Autocompletion Support
    • With the new CLI version, you can now generate autocompletion scripts for your shell (Bash, Zsh, Fish, etc.).
    • This saves time and reduces errors by providing suggestions as you type, improving productivity and helping your team navigate commands more efficiently.
  3. Colour-Coded Display
    • For better visibility and organization, the CLI now supports color coding of various lists (assets, profiles..) when displayed in the terminal.
    • This makes it easier to quickly differentiate between asset and scan types, statuses, and categories, enhancing the overall user experience, especially when managing large datasets.

color-coded-cli.png

These updates will improve your team’s workflow, making the CLI more powerful and user-friendly. For more details on how to get started, check out the updated CLI documentation.

  • tagged ASM
  • 2 min read

#121 · Escape Public API v3 is now live!

We are excited to announce the release of the third version of the Escape Public API. This update reflects our current platform structure, following the introduction of Attack Surface Management (ASM). v3 brings improvements to alignment with the platform’s data organization, streamlining integrations, enhancing performance, and offering more flexibility for your security team.

What’s new in v3?

With the release of this version of our Public API, we’ve focused on optimizing your workflows and interactions with Escape.

Here’s a breakdown of the most significant changes:

1. Authentication Now Supports a Dedicated API key header

  • v2: Authentication was handled via the Authorization header: Authorization: Key YOUR_API_KEY
  • v3: We now also support using a dedicated X-ESCAPE-API-KEY header in addition to the Authorization header.

2. Applications Depreciated – Replaced by Profiles

  • Asset Management: You can now list, search, and manage assets across your organization.
  • Asset Details: Easily retrieve and update asset information by ID, including description, framework, owners, status, and tags.
  • Asset Creation: Create new assets across multiple types (DNS, IPv4, IPv6, GraphQL, REST, gRPC, Web Apps, Schemas, and more) and integrate with popular platforms (Wiz, Postman, Kubernetes, GitHub, GitLab, and more).
  • Asset Deletion: Remove assets by ID when no longer needed.

3. Profiles

  • Profile Management: Now you can list, search, get, and create different scan profiles for your organization. This new feature allows you to better organize and manage your scanning configurations. Check out the API docs for full details.

4. Issues

  • Issue Tracking: List, search, and update issues related to your organization.
  • Issue Details: Retrieve specific issue information by ID, and track activities related to each issue.

5. Events

  • Event Management: Easily list, search, and retrieve detailed information on events within your organization, providing better visibility and control.

6. Scans

  • Scan Management: Trigger, track, and access results for your scans.
  • Scan Control: List scans, start new ones, retrieve detailed scan information, cancel scans, or ignore specific scan runs as needed.

7. Tags

  • Tagging: List and search tags across your organization, and create new tags to better categorize and manage your assets.

Transitioning from v2 to v3

To ensure a smooth migration from v2 to v3, please follow these steps:

  1. Review Endpoint Changes:

    The structure of some endpoints has been adjusted in v3. Be sure to consult the v3 documentation to familiarize yourself with these changes.

  2. Update Your API Calls:

    Modify any existing API calls that may reference v2-specific endpoints or parameters. The new v3 structure is streamlined for better performance and flexibility.

  3. Thoroughly Test Integrations:

    Given the changes to endpoints and data structures, we highly recommend testing all integrations to ensure everything operates smoothly with the new API.

For detailed information on the new features and changes check out the following links:

If you have any questions or need further assistance, don’t hesitate to reach out to our team. We’re here to help!

  • tagged Platform
  • 1 min read

Admins can now invite teammates to their organization using a dedicated invite link, making onboarding faster and more flexible.

How it works:

  1. Go to Team Settings available at https://app.escape.tech/organization/team/
  2. Enter the email of your new team member and click “Invite”
  3. Once added, click the member's name in the team list
  4. Click “Copy Invite Link” from their profile

copy-invite-link-escape.png

Share the link directly—your teammate can join the organization with one click.

This makes it easier to onboard team members, especially in async or distributed environments.

  • tagged Platform
  • 2 min read

#119 · Bulk Edit Assets, Issues and Profiles

You can now perform bulk actions across assets, issues, and scan profiles directly from their respective pages. Apply tags, update statuses, and keep your inventory organized without repetitive manual work - built specifically for teams managing complex or high-volume environments.

What’s new

1.All Assets page:

  • Bulk assign tags: Organize assets more efficiently by applying relevant tags to multiple items at once.

  • Bulk update status: Quickly categorize assets as Monitored, False Positive, Out of Scope, or Deprecated with a single action.

    ![Screenshot 2025-07-30 at 14.02.04.png](320466-bulk-edit-assets-issues-and-profiles/03-185-8be8f491d8c260b4276d8e2843cb1c9ec2298f56.png)
2.All Issues page (when grouped by None):

Easily update the status of multiple issues at once—set them as Open, Need Manual Review, Resolved, False Positive, or Ignored with a single click.

Screenshot 2025-07-30 at 13.20.45.png

3.Scan Profiles page:
  • Bulk assign tags: Organize assets more efficiently by applying relevant tags to multiple items at once.

new.png

These improvements are designed to streamline your workflow, especially in large-scale environments—so you can maintain a clean, structured inventory without the repetitive manual work.

It’s easy for our team to add more bulk actions if your AppSec team requires it. Got any feedback? Reach out to your dedicated Escape contact!

  • tagged DAST
  • 2 min read

#118 · New Release: Frontend Custom Rules for Escape DAST

We’re excited to announce that Custom Rules are now available for Escape Frontend DAST.

With this release, you can go beyond Escape’s extensive built-in security tests and, in addition to handling complex authentication flows, define your own detection logic tailored to your applications and business requirements.

What this means for you

  • Adapt to your context: Build rules for specific workflows, sensitive pages, or custom attack scenarios.
  • Scale your governance: Apply your own security policies across multiple applications with a consistent, automated approach.
  • Leverage a simple, powerful language: Define rules in YAML while benefiting from Escape’s inference engine to detect issues dynamically as you navigate the application.

How it works

Custom Rules for Frontend DAST use the same YAML-based format as the Authentication action presets you may already be using. That means there’s no new syntax to learn and you can start defining rules right away.

Each rule is built from three main components:

  • Detectors: Specify the conditions that should trigger an alert, such as matching page content, evaluating JavaScript assertions, or other custom signals.
  • Alerts: Configure the severity, context, and category of the findings when a rule is triggered.
  • Seeders: Optionally guide the scan by pre-seeding it with navigation steps or requests.

You can now create rules for scenarios as simple as detecting a successful login message or as advanced as validating custom security controls in your frontend logic.

Documentation

Full documentation, including examples and YAML specifications, is available here:

Frontend Custom Rules Documentation

With Frontend Custom Rules, you now have the flexibility to extend Escape DAST to cover exactly what matters most to your applications and users.

  • tagged DAST
  • 1 min read

#117 · AI-Powered Text CAPTCHA Solving is Now Supported

We are excited to announce that you can now automate text-based CAPTCHA solving for your web app testing with Escape!

Text CAPTCHAs with combinations of letters and numbers are widely used to prevent automated bots from accessing web applications.

text-based-captcha-example.webp

However, these CAPTCHAs often block automated security scanners from authenticating and testing protected areas of your application, requiring manual intervention to proceed with security testing.

With the new support for AI-powered text-based CAPTCHA solving, Escape’s DAST scanner is now fully equipped to handle these scenarios. You can securely automate testing for web applications protected by text-based CAPTCHAs without manual intervention during the scanning process.

Getting started is easy! Just configure the SolveCaptchaAction object variables under Browser Actions authentication preset or in post_login_actions in the BrowserAgent. Here's an example setup:

presets:
-   type: browser_actions
    login_url: https://example.com/login
    logged_in_detector_timeout: 10
    stealth_mode: false
    users:
    -   username: frontend-user@example.com
        actions:
        -   action: fill
            auto_submit: false
            locator: input[name="username"]
            value: user@escape.tech
        -   action: solve_captcha
            auto_submit: true
            locator: input[name="captcha-input-box"]

Learn how to configure this preset for your needs in our documentation:

  • tagged DAST
  • 1 min read

#116 · MFA using Time-Based One-Time Passwords (TOTP) is now fully supported in our Web App Scanner

We are excited to announce that Multi-Factor Authentication (MFA) using Time-Based One-Time Passwords (TOTP) is now fully supported in our Web App Scanner!

The use of multi-factor authentication (MFA) significantly enhances identity security by introducing an additional layer of verification beyond traditional login credentials. While this strengthens protection against unauthorized access, it can present a challenge for most of the DAST tools since they are typically designed for unattended execution, where manual interaction – such as approving a sign-in request or entering a time-sensitive code – can disrupt the automation workflow.

With the new support for TOTP-based MFA, Escape’s DAST scanner is now fully equipped to handle these scenarios. You can securely test web applications protected by MFA without needing manual intervention during the scanning process. This means you can automate the security testing of applications that require MFA, ensuring comprehensive coverage while maintaining a streamlined workflow.

Getting started is easy! Just use the Browser Agent authentication preset. Here's an example setup:

presets:
-   type: browser_agent
    login_url: https://auth.example.com/login
    users:
    -   username: frontend-user-with-totp@example.com
        password: pass
        post_login_actions:
        -   action: fill_totp
            auto_submit: true
            locator: input[id="totp-input"]
            secret: '123456'

Learn how to configure this preset for your needs in our documentation!

  • tagged DAST
  • 2 min read

#115 · Documentation Revamp – Built with Your Feedback

Over the past few weeks, we’ve taken a close look at how users navigate our Public Documentation — and thanks to insightful input of some of the customers and the features shipped since the beginning of the year, we’ve rolled out a major update.

What’s new:

  1. Clearer structure for Escape DAST capabilities

    The DAST section is now split into two distinct areas, so you can go straight to what matters to you: Frontend DAST and API DAST.

Each comes with its own set of detailed pages to help you get up and running fast:

Frontend DAST:

API DAST:

This update is all about reducing friction and helping teams to get value quickly. We’ll keep refining our documentation gradually, so keep the feedback coming!