Platform¶

#139 · Introducing Projects: Turn Visibility Into Action With Clear Ownership

Today, we’re releasing Escape Projects, a new way to organize your assets within Escape platform and assign access so teams can quickly act on the findings that matter to them.

For companies operating across multiple brands, managing acquisitions, or running split engineering teams, the old tag-based RBAC model made it hard to know what assets belong to what team, who should have access to it, and who should fix what. Too many people had access to too many assets, saw too many findings, and not enough action followed.

Projects change that.

“We’re looking forward to this because it will be easier for us to add the right people, put the assets in the right project, and let them start reviewing findings and patching what they need to patch.”

Why This Matters (the real problem we’re solving)

Security teams can have great overall visibility — but ownership isn’t clear, which means findings linger.

Projects give you:

1. Clear ownership

Teams see the assets and findings they’re actually responsible for.

2. Less noise, more action

Engineers stop sifting through information that doesn’t belong to them.

3. Faster remediation loops

By mapping subdomains, apps, or brands to their owners, teams can act immediately and remediation progress over time.

4. Enterprise-scale flexibility

Perfect for companies with multiple brands, complex org charts, or frequent M&A activity.

In short:

You turn visibility into action. And action into real security improvements.

What’s New

1. Project-Based Access Control

Create Projects that map directly to your real-world structure (brands, business units, product teams, regions, etc.).

Assign assets to Projects and bind the right users with scoped permissions.

2. Tags Are No Longer Used for RBAC

Tags stay in the product for filtering and scanning logic—but they no longer control access.

3. Old Team Roles Have Been Removed

We’ve replaced legacy team roles with clearer, more predictable project-scoped roles.

4. Assets Drive Access, Not Profiles

Profiles themselves aren’t tied to Projects.

Their assets are — giving you flexibility as your org evolves.

5. Global Elements Stay Global

For compatibility:

• Custom Rules remain global and need a global role binding to edit
• Workflows also remain global
• During scans, existing tag-based rules still apply

How It Works

1. Go to Organization Settings → Projects: This is where you create, edit, and manage Escape Projects.
2. Create a Project:

Projects can represent brands, teams, BU's, regions, or any logical ownership boundary. Examples: “Brand A”, “Payments”, “EU Web Team”, “Team A”.

1. Bind users to the Project with the appropriate role: Give team members the right level of access: Viewer, Editor, Admin, etc.

1. View All Members of a Project: Under the Members tab, you can see who has access and with which role.

1. Assign assets to that Project:

Projects are powered by the assets they contain. Assign domains, subdomains, schemas, and profiles to each Project. All associated scan profiles and issues will be auto-assigned as a result.

It is possible to bulk assign par domain name or other filter of your preference:

1. Teams can now filter on the assets and findings they own:

1. Critical operations happening on projects (creating, editing, deleting) are audited and can be viewed in the audit logs page:

Assigning “Unclassified” Assets — Important

Every asset must belong to a Project.

If you have assets that are not yet classified, we recommend creating a dedicated Project such as: “Not Assigned”

You can bulk-assign these assets later from the Inventory.

Use the Project filter and select “No project” to filter on any assets that are not yet assigned to a specific scope.

Why this matters:

Assets not assigned to any Project are visible org-wide, which breaks scoped visibility.

If you want clean, project-based access, everything must be assigned.

Concrete Example of How Projects Can Fit into Your Workflows

Let’s say you want a specific software engineer to only view vulnerabilities for the assets they work on — nothing else.

You would:

1. Create a Project called “Team A”
2. Assign the relevant assets to that Project
3. Bind the engineer to the Project with
   • View Reporting
   • Manage Reporting
4. When they log in, they will only see
   • The assets they own
   • The vulnerabilities and findings related to those assets
   • Their filtered list inside the All Issues tab

If the engineer works across multiple projects, their scope will simply be the union of those Projects, and they can still filter down to a single Project when needed.

⚠️ Important Note About Deleting Projects

Deleting a Project currently deletes all assets it contains.

This will change in an upcoming update.

For now, please unlink assets before deleting a Project.

What’s Coming Next

We're already working on scoping more functionality to Projects, so teams can operate independently end-to-end.

Coming soon:

• Workflows scoped to Projects
• Integrations scoped to Projects (Slack, Jira, etc.)
• Project-scoped reporting
• Automated alerts for each team, routed only to the relevant Project
• More granular API support

For now, automated workflows can be built through the Escape API (Beta): https://public.escape.tech/v3/#tag/beta/post/projects

To sum up, with Projects in place, your organization gains:

• Deeper visibility into ownership
• Clearer accountability across teams and brands
• Actual action on findings — not just reporting
• A scalable RBAC model that grows with your environment

It’s a practical step toward helping teams move from simply seeing issues to actually addressing them — with the right people looking at the right assets from day one.

Want to make sure Escape Projects are available on your account? Reach out to your dedicated Escape representative.

#138 · Verify and Filter API Scans for Method-Specific Coverage (GET, PUT, POST, DELETE)

As a security engineer, you need to ensure thorough testing of all API request methods. With our new HTTP Method filter, you can now easily focus on verifying whether specific request methods (GET, PUT, POST, DELETE) were tested when reviewing your scan coverage.

Why This Matters :

Different HTTP methods can introduce different types of vulnerabilities. For example:

• PUT requests might enable file uploads or modifications, increasing the risk of improper access control.
• POST requests often involve sensitive data, making them prime targets for attacks.
• GET requests could expose information, putting data security at risk.
• DELETE requests introduce the potential for data loss or accidental deletions.

By filtering targets by HTTP method, you can ensure that each method was thoroughly tested for vulnerabilities. This also provides a clear view of your scan coverage, making it easier to demonstrate to leadership that all critical methods have been properly tested.

Key Benefits:

• Focused Vulnerability Testing: Easily check that the most sensitive request methods (PUT, POST, DELETE) have been adequately tested.
• Improved Efficiency: Filter out unnecessary data and concentrate on the most relevant request methods to save time.
• Comprehensive Coverage: Make sure no high-risk request methods are overlooked in your security reviews.

How to Use:

1. Go to your Scan Profiles.
2. Navigate to the Coverage tab for a specific scan.
3. Apply the HTTP Method filter and choose GET, PUT, POST, or DELETE to refine your targets.

This update helps you stay focused and ensures that your API security testing is comprehensive and efficient.

#136 · New Escape's Public Locations available

We’ve added three new Escape Public locations to the platform, located on West Coast, USA, along with their associated IPs. If you want to allow incoming traffic from these locations, you'll need to enable them.

Previously, Escape locations were available only in Europe and Canada. You can find the complete list of public Escape locations and their corresponding regions in our available on our documentation.

To enable these locations, go to Settings → Private Locations and activate the "United States" locations. While these locations are accessible to all organizations, they are disabled by default.

#135 · Quickly Validate and Streamline Scan Profile Configuration Before Launch

We’ve improved our Test Configuration feature in the scan profile creation form that allows you to quickly validate your settings and ensure your scan profile is correctly set up before launching. This enhancement helps you save time and avoid potential errors by allowing you to review all your settings in real-time.

What’s New:

• Streamed Validation: When validating configurations, such as Browser Authentication, screenshots and results are now streamed progressively. This means you can see feedback in real-time, rather than waiting for the entire process to finish, giving you quicker insights and enabling adjustments on the fly.
• Validate Before Profile Creation: You can now validate your settings before creating a scan profile or integrating it with other systems. This ensures that everything is properly configured, reducing the likelihood of issues when the scan starts.

How to Use:

Once you’ve set up your new scan profile, simply click on the Test Configuration button. This will trigger the validation process, allowing you to review and adjust key settings such as authentication, scheduling, rate limits, and more before finalizing your scan setup.

#134 · New "Create New Scan Profile" Form

We’re excited to introduce an improved "Create New Scan Profile" form that addresses several key customer pain points. Users previously had to navigate through settings after creating an app to configure their scans, but now, this process is simplified, allowing for a much more in-depth setup right from the start.

Addressing Your Pain Points

Many of our users requested a more comprehensive way to set up their scans when creating a new scan profile, instead of configuring them separately through the settings later on. Here are the key features that were previously lacking but are now included in the new workflow:

• Configure Advanced Authentication: Set up advanced authentication configurations during profile creation, including custom login page URLs, usernames, and passwords.
• Create Profiles Without Starting the Scan: Scan profiles can be created without automatically starting the scan.
• Configure Safety Rules: Check the box during scan profile setup to only perform read-only and safe operations during scans
• Rate Limiting and Scheduling During Profile Creation: Configure scan rate limiting and set scheduling preferences directly while creating the profile, saving time and making setup smoother.
• Fetch API Schema from Different Locations: Fetch API schemas from locations other than the app’s schema—useful if the API schema is stored separately.

All of these new creation steps are available via Escape API.

This new form simplifies and streamlines the process of creating and configuring scan profiles, ensuring that you can set up your scans with all necessary parameters from the start.

#132 · Enhanced Scan Failure Visibility

We are excited to introduce a new feature that brings instant visibility into scan failures. This feature allows you to easily identify which scans have failed and understand the reasons behind these failures.

Historically, when a scan failed, it was often unclear why, forcing users to dive deep into logs for answers. This new feature provides clear, actionable insights directly from the scan results, saving time and reducing frustration.

Key Benefits:

1. Instant Visibility on Failures: Immediately see which scan profiles have failed, enabling you to prioritize troubleshooting efforts and reduce downtime.
2. Actionable Insights for Faster Investigation: View detailed failure information, including direct links to event logs, to help you investigate the root causes quickly and efficiently.
3. Accessible Through API or within the Escape Platform: All failure feedback is available via our public API, making it easy to integrate into your existing tools and workflows. You can also view failure details either on a summary page or as alerts on a list of scan profiles.

1. Smarter Configuration Management: Detect misconfigurations or incomplete scan setups early, saving time for both users and support teams in preventing recurring issues.

Types of Issues Flagged

With the new scan failure visibility, users will now see failures categorized by key areas, including:

• Private Location Failures (e.g., unreachable proxies or locations)
• Authentication Failures (e.g., configuration errors, invalid credentials)
• Configuration Issues (e.g., rate limits, invalid patterns, permission errors)
• Schema and Service Unreachability (e.g., invalid GraphQL/OpenAPI schemas, unreachable assets)
• Timeout and Integration Errors (e.g., scan duration limits, CAPTCHA or security blocks)

These categories will help you quickly identify the nature of the problem, so you can act swiftly to resolve the issue.

Next Steps

1. Provide Feedback

   We encourage all Escape users to provide feedback on the errors being reported to help us refine and improve the feedback mechanism. This ensures that the issues flagged are helpful and relevant! Feel free to reach out to your dedicated Escape contact via in-app chat, email, or on Slack/Teams channels.

2. Upcoming Feature - Automated Notifications

   In November, we’ll be introducing automated outbound notifications for specific scan failures. This will allow users to receive immediate alerts when a scan encounters an issue, streamlining the debugging process.

   Stay tuned for more updates! And for now, stay secure! Your Escape team

#128 · Save and Share Your Favorite Scan Profile Filters as Views

We’ve just rolled out a new feature that lets you save your favorite scan profile filter combinations as custom views for quick access and easy sharing! Now, you can tailor your workflow to fit your needs and interact with your scan data more efficiently.

Key Features:

• Save Your Favorite Filters: You can now save filter combinations (e.g., scanner type, risk level, initiator, status, tag, etc.) as views, making it easy to access your personalized scan tables at any time.
• Share Links with Pre-filled Filters: Want to share your specific view with others? Simply build a filter and copy your link, and it will include all your filter settings as URL parameters—allowing others to see exactly what you see, no setup required.
• Reorder Views: Organize your saved views with drag-and-drop functionality. Rearrange them to match your preferred order and keep your workflow seamless.

How to Access:

1. Go to: app.escape.tech/profiles
2. Create and save your custom views based on the filter combinations you use most.
3. Share the link with your team or stakeholders, and drag-and-drop your views for easy customization!

We hope that this update will help you and your team work faster and more collaboratively by streamlining access to your favorite scan profiles.

What’s next?

And this is just the beginning! In the future, these saved views will be integrated into workflows and reporting, allowing you to apply them in even more areas of your process for enhanced efficiency and consistency.

#127 · New Compliance Frameworks, Standards, and Resources Support

We are excited to announce the addition of 7 new compliance frameworks, standards and resources to our platform! This update helps ensure you have even more options to meet various regulatory and security requirements - whether you’re based in the US or the EU or working internationally.

What's New?

We’ve added support for the following compliance frameworks and resources:

1. OWASP ASVS - Application Security Verification Standard with requirements for secure development.
2. WASC - Best-practice security standards for web application security.
3. MITRE ATT&CK - A knowledge base of adversary tactics, techniques, and procedures (TTPs), helping you understand and defend against cyber threats.
4. IEC 62443 - Industrial automation and control systems security standards.
5. HITRUST CSF - A framework for regulatory compliance and risk management in healthcare and beyond.
6. CRA - EU Cyber Resilience Act, establishing cybersecurity requirements for products with digital elements.
7. DORA - Digital Operational Resilience Act, ensuring that financial entities can withstand ICT-related disruptions.

Important Notes:

Some of these frameworks are OFF by default to keep your matrix manageable. You can enable them manually from the Reporting Settings page.

A full list of supported compliance standards can be found here.

We hope this update helps streamline your compliance and security efforts. Happy securing!

#125 · AI-Powered Exploit Validation and Remediation Guidelines

We’re excited to introduce a significant enhancement to help you validate discovered vulnerabilities and remediate them.

With our AI-powered proof of exploit and remediation guidelines, we’ve evolved from static code snippets tailored to specific frameworks to dynamic, context-aware solutions generated by a specially trained Large Language Model (LLM).

This update puts intelligent remediation and validation front and center, giving teams precise, actionable guidance with proof that the vulnerability can be exploited.

What’s Included:

• Minimal Reproducible Test Cases: Clear, concise test cases to validate the vulnerability and remediation.
• Validation Steps: Step-by-step guidance to ensure remediation is correctly implemented.
• Expected Observations: Key things to expect after remediation to confirm effectiveness.
• Actionable Remediation Instructions: Contextual, tailored fixes that go beyond generic advice.

Key Benefit:

By leveraging AI, we generate remediation actions tailored to your environment and the specific vulnerability, backed by proof of exploit. This significantly reduces guesswork and ensures that the provided fixes are both effective and applicable. You can apply these solutions with confidence, knowing that the vulnerability has been thoroughly validated and addressed.

For instance, when addressing an SSRF vulnerability triggered by the Referer header in a JavaScript (jQuery) environment, the new guidelines show how this vulnerability can be exploited and will:

1. Help you whitelist valid Referer headers
2. Guide you in server-side validation to reject invalid requests
3. Ensure internal access control to limit exposure to unauthorized service calls

Why This Matters:

These updates streamline remediation and validation, ensuring accuracy, efficiency, and confidence in your security fixes. Teams can spend less time guessing and more time building, while knowing vulnerabilities are effectively mitigated.

Try it out for yourself!

#122 · Escape CLI – New Features with Escape Public API v3

We’re also excited to announce that the Escape CLI now fully supports all the new capabilities introduced in Public API v3. This brings enhanced functionality, making it easier for your team to interact with the platform directly from the command line.

What's New in the CLI?

1. Full API v3 Support
   • The CLI now provides full access to all the new features in API v3, ensuring you can manage assets, profiles, issues, events, scans, and more directly from your terminal.
   • This brings a streamlined experience for users already familiar with the API, allowing for a unified interaction between the CLI and the API.
2. Autocompletion Support
   • With the new CLI version, you can now generate autocompletion scripts for your shell (Bash, Zsh, Fish, etc.).
   • This saves time and reduces errors by providing suggestions as you type, improving productivity and helping your team navigate commands more efficiently.
3. Colour-Coded Display
   • For better visibility and organization, the CLI now supports color coding of various lists (assets, profiles..) when displayed in the terminal.
   • This makes it easier to quickly differentiate between asset and scan types, statuses, and categories, enhancing the overall user experience, especially when managing large datasets.

These updates will improve your team’s workflow, making the CLI more powerful and user-friendly. For more details on how to get started, check out the updated CLI documentation.