Yogesh Ojha 9f1ee01c2f feat(vulnerability_scan): drop injection matches that only echo the request URL ...

An injection-echo template (command injection, RCE, SSTI, shellshock) proves
itself with a token echoed into the response body. A page that reflects the
requested URL into a canonical or og:url tag satisfies that matcher without a
command running. The guard drops such a match for those template classes only,
after URL-decoding both sides, and never for XSS or out-of-band checks. Each
drop is counted on the coverage row and shown in the coverage strip.

2026-09-25 08:22:04 +05:30

..

__init__.py

perf(read-path): stored scan deltas, live-scope cache and cheaper aggregates at millions of rows

2026-09-25 05:40:01 +05:30

_tztypes.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

activity_log.py

imorove app sidebar

2026-09-02 13:04:50 +05:30

ai.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

api_key.py

feat(remote-control): drive reNgine from a paired Telegram chat

2026-09-16 06:05:04 +05:30

asset_query.py

perf: make the read path scale with the estate

2026-09-12 08:49:41 +05:30

bgp_summary.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

bounty_program.py

feat(bounty-hub): HackerOne reports and earnings with program cross-links

2026-09-24 17:51:30 +05:30

bounty_report.py

feat(bounty-hub): HackerOne reports and earnings with program cross-links

2026-09-24 17:51:30 +05:30

compare.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

connector.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

crosslink.py

feat(web-assets): say when another target carries the same value

2026-09-12 23:35:34 +05:30

cve_exposure.py

feat(cve): CVEs become a surface of their own

2026-09-12 18:28:41 +05:30

dashboard.py

feat(dashboard): reachability replaces the funnel, counted as is:web

2026-09-16 08:45:38 +05:30

dns.py

perf(db): a primary key is already an index, so the second one on id was write cost for nothing

2026-09-10 21:24:43 +05:30

domain_posture.py

fix(posture): mail rows judged on sender checks only, ranked MX sweep

2026-09-15 12:38:47 +05:30

endpoint.py

perf(read-path): stored scan deltas, live-scope cache and cheaper aggregates at millions of rows

2026-09-25 05:40:01 +05:30

estate.py

feat(targets): rebuild the target page as the dashboard bento and add the estate engine

2026-09-14 19:06:07 +05:30

export.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

hosting.py

refactor(hosting): replace the sankey with a fronting split over ranked networks

2026-09-13 19:09:42 +05:30

http_asset.py

feat(ai-detection): identify AI services on web assets with julius

2026-09-25 08:02:29 +05:30

instance_settings.py

feat(scans): concurrent scan limit with a launch-order queue

2026-09-25 05:38:23 +05:30

interest.py

feat(tables): select rows and act on them from one action bar

2026-09-15 07:38:48 +05:30

ip_address.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

ip_asn_range.py

add ip-> asn, ip->cc, and global geo distribution map

2026-09-03 16:31:43 +05:30

note.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

notification_channel.py

feat(nuclei): monitor targets against new checks, and a review pass on the pipeline

2026-09-20 09:02:17 +05:30

notification.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

oast.py

feat(oast): an instance-owned callback server, and a tier that pays the wait once

2026-09-21 20:53:01 +05:30

organization.py

perf(db): a primary key is already an index, so the second one on id was write cost for nothing

2026-09-10 21:24:43 +05:30

port.py

perf(db): a primary key is already an index, so the second one on id was write cost for nothing

2026-09-10 21:24:43 +05:30

project.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30

proxy.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

recheck.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

relations.py

feat(bounty-hub): say which program covers a target

2026-09-12 23:05:47 +05:30

report.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

ripestat.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

scan_activity.py

perf(db): a primary key is already an index, so the second one on id was write cost for nothing

2026-09-10 21:24:43 +05:30

scan_command.py

perf(db): a primary key is already an index, so the second one on id was write cost for nothing

2026-09-10 21:24:43 +05:30

scan_context.py

feat(context): make the HTTP protocol setting restrict what is probed

2026-09-13 11:38:29 +05:30

scan_correlation.py

feat(ai-detection): identify AI services on web assets with julius

2026-09-25 08:02:29 +05:30

scan_delta.py

perf(read-path): stored scan deltas, live-scope cache and cheaper aggregates at millions of rows

2026-09-25 05:40:01 +05:30

scan_engine.py

feat(engine): run the HTTP probe automatically on every run above passive

2026-09-24 21:56:14 +05:30

scan_preview.py

feat(targets): store the assets you already know and seed every scan with them

2026-09-13 07:21:10 +05:30

scan_schedule.py

feat(bounty-hub): watch a program

2026-09-12 21:51:18 +05:30

scan_surface.py

feat(vuln): plan what each scanner is handed — typed inputs, origin clusters, tiers, dalfox

2026-09-14 09:35:19 +05:30

scan.py

feat(scans): concurrent scan limit with a launch-order queue

2026-09-25 05:38:23 +05:30

secret.py

feat(tables): select rows and act on them from one action bar

2026-09-15 07:38:48 +05:30

software.py

perf(read-path): stored scan deltas, live-scope cache and cheaper aggregates at millions of rows

2026-09-25 05:40:01 +05:30

subdomain.py

feat(ai-detection): identify AI services on web assets with julius

2026-09-25 08:02:29 +05:30

surface.py

feat(tables): select rows and act on them from one action bar

2026-09-15 07:38:48 +05:30

tag.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

target_asset.py

fix(search): reject a filter field that does not exist

2026-09-13 05:15:59 +05:30

target_seed.py

feat(targets): store the assets you already know and seed every scan with them

2026-09-13 07:21:10 +05:30

target_summary.py

copy: state the fact, delete the explanation

2026-09-12 11:35:07 +05:30

target.py

feat(nuclei): monitor targets against new checks, and a review pass on the pipeline

2026-09-20 09:02:17 +05:30

threat_intel.py

feat(arsenal): exploit intel sources as one table with vulnx as a provider row

2026-09-24 18:37:42 +05:30

types.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

user.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

viewdns.py

perf(db): a primary key is already an index, so the second one on id was write cost for nothing

2026-09-10 21:24:43 +05:30

vuln_template.py

feat(oast): an instance-owned callback server, and a tier that pays the wait once

2026-09-21 20:53:01 +05:30

vulnerability.py

feat(vulnerability_scan): drop injection matches that only echo the request URL

2026-09-25 08:22:04 +05:30

watch.py

chore: production-readiness review across the tree

2026-09-13 18:03:29 +05:30

whats_new.py

feat(whats-new): activity lanes, expandable events and whole-run counts

2026-09-24 21:51:06 +05:30

whois.py

fix(targets): widen the AS range columns and stop showing a traceback

2026-09-13 05:11:10 +05:30

wordlist.py

style: strip explanatory comments across the codebase

2026-09-11 14:11:23 +05:30