What’s New at StackHawk: More Complete Coverage, Less Setup

Your coding agent acts on what the scanner reports. If a scan misses part of your app, nothing there gets fixed. And if a scan is hard to set up, it does not get run.

A lot tuning went into two things: making every scan cover more of your app, and cutting the setup it takes to get there.

This post covers recent product updates: the HawkScan 6.5 and 6.6 releases, a run of Agent Skills updates, and improvements to the web app and API. Run hawk upgrade to get the scanner changes. If you read only one section, read What Changes When You Upgrade.

More Complete Coverage

A scan can only find what it reaches. These changes get HawkScan to more of your app.

API Routes Behind a Base Path Get Tested

HawkScan now reads the base path from your OpenAPI servers[] entry or Swagger 2.0 basePath. You can also set it directly with app.openApiConf.basePath. A path already set in app.host still takes precedence, so existing setups keep working. Read Docs

Why you care: if your API lives under a prefix like /api/v2, every route in your spec is tested at its real URL. No more editing the spec or working around it in app.host.

JavaScript-Heavy Apps Get Crawled From the Pages You Choose

The ajax spider now loads each hawk.spider.seedPaths entry in its browser.

Why you care: point the scanner at the deep pages of a single-page app and it starts there, reaching views a crawl from the home page would miss.

Scan Apps That Require a Client Certificate

HawkScan has long been able to scan applications behind mutual TLS using the network.clientCertificates.* settings and a PKCS#12 bundle. The docs now walk through it, including the OpenSSL steps to convert PEM files. Read Docs

Why you care: internal services locked behind mTLS are often the ones nobody tests. Now they can be in scope.

Less Setup

A thorough scan should not take a week of configuration. These changes cut the work to get there.

Your Agent Sets Up Authorization Testing for You

The HawkScan agent skill now configures multi-profile BOLA and BFLA scans on its own. It reads your code for authorization signals (object-ID routes, ownership checks, role guards, tenant scoping), finds or creates test accounts (or asks you for them), and runs the scan as multiple identities. Your full scan policy and the BOLA and BFLA checks run together, so there is no separate authorization scan. Credentials stay in a gitignored env file, never in stackhawk.yml. Requires Agent Skills 2.7.0 or later, HawkScan 6.4.0 or later, and two or more accounts.

Why you care: the most valuable test in API security used to be the hardest to set up. Now you ask your agent for it.

Better Skills Coverage in the Agent You Already Use

The StackHawk Wingman plugin now installs with its full skill set in Codex and GitHub Copilot, alongside Claude Code and Cursor. Skills also install with one command, npx skills add stackhawk/agent-skills-marketplace --all, and update with npx skills update. Every docs page is now available as clean Markdown and listed in llms.txt, so your agent reads current StackHawk guidance directly.

Why you care: with skills loaded, your agent runs the full find, fix, verify workflow the way we built it, whichever agent your team picked.

Connect Your Coding Agent From Application Details

In the StackHawk UI, the “Run a Scan via the hawk CLI” dialog is replaced by a guided “Set up Agent Skills” flow that connects StackHawk’s agent skills to your coding assistant.

Why you care: the path from a new app to an agent running find, fix, verify starts in the product, with no docs hunt.

Findings Land in the GitHub Security Dashboard

--sarif-ghas writes a SARIF file built for GitHub Advanced Security: one alert per finding, links to the Vulnerability Index, and fingerprints that stay stable across upgrades. In HawkScan 6.6.0.

Why you care: runtime findings sit next to your SAST and dependency alerts, in the tab developers already check. No new dashboard to adopt.

Store a Secret Once, Use It in Every Scan

${VARIABLE} references in stackhawk.yml now resolve against organization-shared secrets. Local environment variables and ${VARIABLE:default} values still come first, and personal secrets win over organization secrets. Requires HawkScan 6.5.0 or later. Read Docs

Why you care: no more copying scan credentials into every pipeline and rotating them in ten places.

Install in One Line, on Any OS

A curl script for Linux and macOS, PowerShell and cmd.exe scripts for Windows. Every install verifies SHA-256 checksums. Pin a version with HAWK_INSTALL_VERSION.

Why you care: CI jobs get a fast, verified install without pulling a Docker image.

Every New App Starts With an Owner

Building on August’s Team ownership work. Users who cannot manage Teams now pick one of their Teams when they create an app. If you belong to only one Team, it is picked for you. The Team picker is also in Application Settings, and moving an app between Teams no longer requires removing it first. Enterprise and Teams plans.

Why you care: new apps do not end up unowned, so it is clear who fixes what.

Auditors Can See Scan Configurations and Policies

View Only users can open scan configurations and organization scan policies read-only, with edit actions disabled. Enterprise.

Why you care: compliance reviewers get the visibility they need without edit rights, and without asking an admin for screenshots.

What Changes When You Upgrade

These changes alter behavior or need something from you. Check them before you roll the upgrade into CI.

• Your finding counts will move. Four single-identity authorization rules (40051, 40054, 40055, 40056) are retired in favor of multi-profile testing. Dashboards and build thresholds may need a look.
• Missing variables stop the scan. A ${VARIABLE} with no value now fails with a clear error. Before, the scan ran with a blank. Use ${VARIABLE:} when you mean an empty value. A default, even an empty one, is used before any platform secret is checked.
• OpenAPI base paths are now applied. If your spec’s servers[] entry includes a path, routes are tested under it. If that path is wrong for the environment you scan, set app.openApiConf.basePath, or set app.openApiConf.disableServerBasePath to true.
• codeScanningAlerts is deprecated in the GitHub Action. Use --sarif-ghas with GitHub’s upload-sarif action.
• Bulk triage files are checked more strictly. hawk op scan triage --from-file now requires findingHash and a valid status, and reports bad entries. Before, an unrecognized status could reset findings to New without telling you. Re-run any triage files you use and fix rejected entries.
• API clients should handle 409. Conflicts, such as a delete that cannot proceed, now return 409 with the reason. They used to return 412 or an empty 500. Timeouts return 504, temporary outages return 503, and bad input returns 400.
• Re-run Team assignments made by API before mid-August. PUT /api/v1/org/{orgId}/team/{teamId}/application reported success without saving. It now saves. Re-run those calls.

Additional Refinements

• A native scan engine: since HawkScan 6.6, hawk scan runs on a native engine and no longer starts a separate Java bootstrap process. The stricter handling of missing variables comes with it.
• Dependency security patches: HawkScan 6.5.0 updates BouncyCastle, Netty, and Apache HttpClient to address reported CVEs.
• SSRF alerts are confirmed first: the API SSRF rule (40048) verifies out of band and against a baseline response before it alerts.
• Clear errors on unsupported versions: when the platform rejects an out-of-support CLI, HawkScan says why and exits non-zero.
• Works behind your proxy: the scan engine’s calls to StackHawk use the CLI’s outbound proxy and trusted certificates.
• A fix loop that knows when to stop: the HawkScan skill ends the fix loop on a verifying scan, with one clear cap on retries.
• Post-commit scans fire only on real commits: the agent hook no longer triggers on commands like git log.
• Fixes: hawk rescan keeps headers like Content-Type on replayed requests. hawk validate auth no longer fails right after a good login. Multi-profile scans report their full duration.
• API: GET /api/v2/org/{orgId}/envs accepts unassignedApps=true. The current-findings report is much faster, same response shape. The organization’s last Owner can no longer be removed.
• Datadog: updating an existing integration works again, and failures show Datadog’s actual message.
• Web app: Scans that ended in an error no longer show partial severity counts. An app’s Scans tab stays scoped when you filter. The Audit Log loads and searches faster.
• Triage and tips: path triage notes open on hover and click. The Technology Flags recommendation considers the policy your scan used. The Top Vulnerabilities widget ranks Critical first.
• Exports and scoring: the Scans CSV export includes every row, not just the first 100. Sensitive-data scoring covers every eligible repository.
• Attack Surface (Enterprise): repositories link straight to their GitHub or GitLab source, and the repository drawer shows severity badges. The PDF follows your filters. The Repositories page and large-org PDFs are much faster.
• Platform: clearer Azure DevOps Boards errors on an expired token.