NotoriousRebel
2440b2b932
refactor: own API runtime state in app lifespan
2026-08-27 15:42:00 -04:00
NotoriousRebel
50669f2704
docs: align fail-closed proxy contract
2026-08-25 23:11:03 -04:00
NotoriousRebel
414276e330
fix: fail closed when required proxies are unavailable
2026-08-25 22:59:06 -04:00
L1ghtn1ng
f2efcb5b99
fix: canonicalize hostname scope and IP results in one helper
...
Put IDNA and label validation in normalize_scoped_hostname so the
runner, parser, and storage path share one authorized-target boundary.
Drop IPv6 zone identifiers at collection instead of failing finish(),
and remove leftover BuiltWith and Shodan aliases now that www. is part
of the explicit target.
2026-08-25 02:02:35 +01:00
L1ghtn1ng
86c2c5f979
fix: enforce discovery security boundaries
...
Keep proxy identities stable across provider conversations, preserve exact target scope, canonicalize evidence, secure first-run config creation, and retain legacy source-name compatibility.
2026-08-25 01:29:05 +01:00
NotoriousRebel
c3ec07b593
Clarify partial source outcomes
2026-08-23 18:00:26 -04:00
NotoriousRebel
5c74e1a03d
Allow uncapped discovery and report source yield
2026-08-23 17:24:08 -04:00
NotoriousRebel
2c6c5bff4a
refactor: use SQLAlchemy for HarvestView schedules
2026-08-20 16:01:55 -04:00
NotoriousRebel
d875f3ac21
fix: recover persisted run evidence idempotently
2026-08-20 12:28:30 -04:00
NotoriousRebel
8bdbca217c
feat: extend HarvestView schedule management
2026-08-20 11:11:25 -04:00
NotoriousRebel
ca1cb72ec6
fix: reconcile superseded schedule reservations
2026-08-20 10:02:40 -04:00
NotoriousRebel
a1d794d5af
feat: add persistent HarvestView scheduling
2026-08-20 01:21:09 -04:00
NotoriousRebel
9b982db7b6
fix: report provider collection outcomes truthfully
2026-08-16 21:31:08 -04:00
NotoriousRebel
c91456531c
feat: export completed runs as SQLite
2026-08-16 14:41:19 -04:00
NotoriousRebel
de60af1f17
fix: reject removed adapter lifecycle state
2026-08-16 00:49:16 -04:00
NotoriousRebel
2ac59f3a38
refactor: centralize source execution lifecycle
2026-08-16 00:32:22 -04:00
NotoriousRebel
6e0e761661
fix: close provider contract review gaps
2026-08-15 22:28:14 -04:00
NotoriousRebel
c1101ca73a
test: harden provider contracts and offline coverage
2026-08-15 21:26:35 -04:00
NotoriousRebel
df1933b345
fix: preserve provider sessions across pagination
2026-08-15 13:20:26 -04:00
NotoriousRebel
ef212e135f
Merge remote-tracking branch 'upstream/dev' into codex/upstream-harvestview-impeccable
...
# Conflicts:
# CHANGELOG.md
2026-08-15 11:56:04 -04:00
Matt and GitHub
01f5561284
Merge pull request #2545 from NotoriousRebel/codex/upstream-takeover-evidence
...
Replace takeover fingerprints with typed DNS-first evidence
2026-08-15 11:52:11 -04:00
NotoriousRebel
bbc7832c8f
fix: reuse bounded takeover transport
2026-08-15 11:44:18 -04:00
NotoriousRebel
2691f0d258
fix: make HarvestView source readiness actionable
2026-08-15 11:43:32 -04:00
NotoriousRebel
4bcf2ceae9
fix: restore conservative source-worker default
2026-08-15 11:41:06 -04:00
NotoriousRebel
ea9dab4b87
feat: replace takeover fingerprints with typed evidence
2026-08-15 03:30:33 -04:00
Matt and GitHub
f44807a046
refactor: run discovery sources with TaskGroup ( #2544 )
...
* refactor: run discovery sources with TaskGroup
* fix: preserve source runner compatibility diagnostics
* feat: add configurable source workers
2026-08-15 01:48:33 -04:00
Matt and GitHub
4fef2c5e3b
refactor: bound screenshot lifecycle ownership ( #2543 )
...
* refactor: bound screenshot lifecycle ownership (#293 )
* fix: retain HTTP error screenshots (#293 )
2026-08-14 23:10:34 -04:00
Matt and GitHub
38e32de023
fix: complete API endpoint scans by default ( #2539 )
...
* fix: complete API endpoint scans by default
* refactor: reuse shared cancellation cleanup
2026-08-14 23:03:28 -04:00
Matt and GitHub
1a9b114a5d
fix: complete DNS enumeration by default ( #2542 )
...
* fix: complete DNS enumeration by default
* test: avoid URL substring sanitizer alert
2026-08-14 22:54:25 -04:00
Matt and GitHub
bb77613a05
fix: call Censys Platform API directly ( #2537 )
...
* fix: call Censys Platform API directly (#295 )
(cherry picked from commit 7ce361413ad35471ab0b6878382f3548b0918dbe)
* docs: clarify Censys global search entitlement
2026-08-14 22:44:45 -04:00
Matt and GitHub
b8a8f7c7ca
fix: move Shodan discovery into adapter ( #2535 )
...
* fix: move Shodan discovery into adapter (#283 )
* docs: clarify Shodan transport and persistence
* fix: query every Shodan-resolved IPv4
* fix: call Shodan Host API directly
* fix: serve HarvestView assets locally
* Revert "fix: serve HarvestView assets locally"
This reverts commit 413e8b25ab
2026-08-14 21:11:12 -04:00
Matt and GitHub
259455f1c1
fix: remove Windvane DNS guessing fallback ( #2541 )
2026-08-14 15:14:53 -04:00
Matt and GitHub
7c4420150d
Add route-aware no-host result filtering ( #2534 )
2026-08-13 11:14:55 -04:00
Matt and GitHub
624066a3e8
Add RouteViews enrichment and sourced ASN organization attribution ( #2528 )
...
* Add RouteViews network enrichment
* Add authenticated RouteViews API access
* Restrict RouteViews to explicit network pivots
* Restore discovered ASN RouteViews enrichment
* Retain sourced ASN organization attribution
* Avoid dangling and repeated ASN attributions
* Keep automatic RouteViews evidence target-relevant
* Complete target-relevant RouteViews enrichment
* Clarify automatic RouteViews IP pivots
2026-08-13 10:46:54 -04:00
Matt and GitHub
1db27309dd
Remove duplicate Chaos discovery source ( #2533 )
2026-08-12 18:47:34 -04:00
Matt and GitHub
aed50e0b0d
Add crt.name composite hostname discovery ( #2531 )
2026-08-12 17:05:12 -04:00
Matt and GitHub
4643f6f0f9
fix: use explicit provider and browser user agents ( #2530 )
2026-08-12 17:01:57 -04:00
Matt and GitHub
38524ab674
Add Sourcegraph hostname candidates from indexed code ( #2524 )
...
* feat: add bounded Sourcegraph discovery
Use the documented anonymous streaming API with explicit keyword, result, timeout, and line-match bounds; retain only scoped hostname and email evidence with truthful source outcomes.
* Harden Sourcegraph hostname discovery
* Raise Sourcegraph recall budget to 5000
* docs: clarify Sourcegraph candidate semantics
* test: account for combined source catalog
2026-08-12 12:14:02 -04:00
Matt and GitHub
91ed6c1d9f
Add APIs.guru hostname, email, and URL discovery ( #2525 )
...
* feat: add bounded APIs.guru discovery
* docs: clarify APIs.guru result boundaries
2026-08-12 12:06:04 -04:00
Matt and GitHub
f13280ddad
Add typed ASN-prefix routing evidence ( #2527 )
...
* Add typed network evidence foundation
* Deepen network evidence accumulation
* Bound network evidence accumulator limits
* Make nested JSON rejection test version tolerant
* Keep network evidence in unreleased schema v8
* Clarify structured result persistence dispatch
2026-08-12 10:49:16 -04:00
Matt and GitHub
ac3c543768
Add bounded provider response streaming ( #2526 )
...
* Add bounded provider response streaming
* Add bounded provider JSON fetching
2026-08-12 09:41:13 -04:00
Matt and GitHub
fa8afa5e46
Add bounded virtual-host discovery ( #2517 )
...
* Add bounded virtual-host discovery
* Document virtual host probe boundary
2026-08-11 00:43:04 -04:00
Matt and GitHub
0d2ab5a0b3
Add the HarvestView web application ( #2512 )
...
* feat: add HarvestView operator UI
* Use JSONL-only HarvestView file flows
* Drive HarvestView activities from the API catalog
* Add result action controls
* Render shared DNS resolver defaults
* Clarify resolver cardinality in HarvestView
* Load Tabulator from CDNjs
* Fix HarvestView wiki link
* Align HarvestView with execution status contract
* Add HarvestView import and action controls
* Harden HarvestView browser assertions
* Simplify HarvestView run selection
* Show truthful HarvestView execution outcomes
* refactor: show canonical URL results in HarvestView
* Show canonical hostname results in HarvestView
* test(harvestview): remove browser error race
2026-08-10 00:08:05 -04:00
Matt and GitHub
1fd5749e52
Add an authenticated durable run API v1 ( #2511 )
...
* Model active evidence in result persistence
* Expose active action diagnostics
* Persist truthful DNS action evidence
* Persist direct action evidence
* feat: add authenticated durable run API v1
* Make API file interchange JSONL-only
* Harden API evidence boundaries
* Remove API rate limiter
* Unify API runs with result persistence
* Support target action runs
* Keep DNS resolver selection action-neutral
* Add action-neutral CLI resolver selection
* Preserve API evidence across JSONL round trips
* Complete HarvestView API run parity
* Harden HarvestView run API contracts
* Remove obsolete bundled network snapshots
Delete the unused bundled AWS IP-range and resolver snapshots while preserving operator-supplied resolver file input.
* refactor: canonicalize URL results
* docs: define a bounded test budget
* Standardize hostname and IP result names
* fix(api): avoid duplicate evidence conflicts
2026-08-10 00:08:04 -04:00
Matt and GitHub
e4d37b05a8
Persist per-source run provenance ( #2516 )
...
* Persist per-source run provenance
* Keep the first JSONL contract unversioned
* Explain source yield counts
2026-08-09 11:50:08 -04:00
Matt and GitHub
c4af833da0
Use SQLAlchemy for async result persistence ( #2515 )
...
* Use SQLAlchemy for async result persistence
* Explain persistence ORM records
* Clarify persisted run schema
* Clarify legacy schema migration
* Consolidate result persistence
* Preserve incomplete legacy observations
2026-08-09 00:50:39 -04:00
Matt and GitHub
6b02dbddc9
Share safe enumeration execution across transports ( #2507 )
...
* feat: share safe enumeration execution across transports
* fix: clarify safe scan contracts
* fix: preserve public screenshot redirects
* fix: restore operator-controlled active requests
* fix: allow operator-selected API scan targets
2026-08-07 16:02:16 -04:00
Matt and GitHub
7a854eda95
Contract DeHashed and LeakIX evidence ( #2506 )
...
* Contract DeHashed evidence handling
* Align LeakIX with its documented API
* Update provider capability selection
* Require REST auth for DeHashed results
2026-08-07 00:25:54 -04:00
Matt and GitHub
30ac342d9d
Remove unavailable Venacus source ( #2505 )
2026-08-07 00:04:47 -04:00
Matt and GitHub
ce791dcaca
Contract Leak-Lookup evidence handling ( #2504 )
...
* Contract Leak-Lookup evidence
* Preserve additional API compatibility
2026-08-07 00:01:26 -04:00
NotoriousRebel