From 67050831190691abe9e8b36f2d5c080da342b877 Mon Sep 17 00:00:00 2001 From: setlin-hacktron <280193300+setlin-hacktron@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:00:07 +0000 Subject: [PATCH 1/2] docs: add changelog entry for October 9, 2026 --- changelog.mdx | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/changelog.mdx b/changelog.mdx index bff677a..fdd1ccd 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -4,7 +4,35 @@ description: "New features, improvements, and fixes to the Hacktron platform." rss: true --- -{/* CHANGELOG:INSERT last-prod-sha=9321818700667bd798dc9b6013da4d4320dc625d - the changelog workflow inserts new blocks directly below this line. Do not remove this marker. */} +{/* CHANGELOG:INSERT last-prod-sha=a9599d5d560ffeb6629766a1baeb078a7d2ef829 - the changelog workflow inserts new blocks directly below this line. Do not remove this marker. */} + + + ## Whitebox reports show live validation evidence and get a full refresh + + **Refreshed Whitebox report**: The PDF report now includes a methodology section built from what the scan actually analysed, a severity rubric, scope details (target URLs and testing window), limitations, and a confidentiality notice - ready to hand to a customer or auditor. + + **Live validation evidence in reports**: Each finding's Live Validation section now shows the established and not-established claims, the blocker, and the observed output from the exploit attempt - not just a verdict. + + **Browser authentication for dynamic validation**: You can now supply login credentials and instructions so the scan engine authenticates against your application before attempting to validate findings on protected pages. + + **Manual finding retests**: Request a retest of any Whitebox finding directly from the finding detail. The result and outcome appear in the retest report when the pentest team completes it. + + **Finding status synced to Jira and Linear**: When you triage, fix, or reopen a finding in Hacktron, the linked Jira issue or Linear ticket updates its status to match automatically. + + **Redesigned Integrations page**: Each provider now shows a status badge (Connected, Not connected, or an attention state), the connected account, a repository count, and a single primary action, with Disconnect tucked into an overflow menu. + + **GitHub repository selection in Hacktron**: Org admins can now enable or disable individual GitHub repositories for scanning directly in Hacktron, the same as GitLab, Bitbucket, and Azure DevOps. + + **@hacktronai review replies on scanned commits**: Requesting a review on a commit that Hacktron already scanned now gets an immediate reply with the existing result instead of silence. + + **Rebuilt People page**: Search, filters, role and seat filters, sorting, and pagination for your members list now run on the server, so the page loads quickly for large orgs and unlinked developers appear on every page. + + **Docs menu in the top nav**: The help icon now opens a dropdown linking directly to the docs for each product area, the API reference, the MCP server, and the changelog. + + **Repository page revamp**: The Repositories table now splits the repo column into Repository and Owner, scopes the platform filter to the providers your org has connected, and adds Open Findings and Last Scan columns. + + **[Start a Whitebox scan →](/white-box-pentest/quickstart)** · **[Connect integrations →](/platform/integrations)** · **[See billing and plans →](/platform/billing)** + ## A rebuilt findings view, and fix PRs that close themselves From 176a472a2daf8b9902a398c5601ae88c834c76b1 Mon Sep 17 00:00:00 2001 From: "Zeyu (Zayne) Zhang" Date: Wed, 14 Oct 2026 14:11:58 +0100 Subject: [PATCH 2/2] docs: reconcile September and October changelog entries --- changelog.mdx | 47 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 14 deletions(-) diff --git a/changelog.mdx b/changelog.mdx index fdd1ccd..bffd403 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -6,32 +6,51 @@ rss: true {/* CHANGELOG:INSERT last-prod-sha=a9599d5d560ffeb6629766a1baeb078a7d2ef829 - the changelog workflow inserts new blocks directly below this line. Do not remove this marker. */} - - ## Whitebox reports show live validation evidence and get a full refresh + + ## See what a Whitebox scan actually established - **Refreshed Whitebox report**: The PDF report now includes a methodology section built from what the scan actually analysed, a severity rubric, scope details (target URLs and testing window), limitations, and a confidentiality notice - ready to hand to a customer or auditor. +**Reports describe the assessment**: Whitebox PDF reports now include the repositories and targets in scope, the testing window, a severity rubric, limitations, and a confidentiality notice. Where scan coverage is available, the methodology and coverage detail show which code the analysis passes selected for review. - **Live validation evidence in reports**: Each finding's Live Validation section now shows the established and not-established claims, the blocker, and the observed output from the exploit attempt - not just a verdict. +**Live validation evidence**: Findings with recorded live-validation evidence now have a Live Validation section in the PDF report showing what the attempt established, what it did not establish, and any blocker. Successful exploit attempts can also include the observed output. - **Browser authentication for dynamic validation**: You can now supply login credentials and instructions so the scan engine authenticates against your application before attempting to validate findings on protected pages. +**Jira and Linear status sync**: Sync finding status changes to linked Jira and Linear issues, and bring supported issue status changes back into Hacktron. Organization admins can enable or disable each direction separately in the integration settings. Jira updates follow the transitions available in your project's workflow. - **Manual finding retests**: Request a retest of any Whitebox finding directly from the finding detail. The result and outcome appear in the retest report when the pentest team completes it. +**Integration settings in one place**: The Integrations page groups providers into a list with connection details, repository counts where applicable, and a Connect or Manage action. Connected providers show a status badge; connections needing attention show the action to resolve it. Open a provider to manage its settings or disconnect it. - **Finding status synced to Jira and Linear**: When you triage, fix, or reopen a finding in Hacktron, the linked Jira issue or Linear ticket updates its status to match automatically. +**Docs from the top navigation**: The help menu links directly to each product's documentation, the API reference, the MCP server, and the changelog. - **Redesigned Integrations page**: Each provider now shows a status badge (Connected, Not connected, or an attention state), the connected account, a repository count, and a single primary action, with Disconnect tucked into an overflow menu. +**[Start a Whitebox scan →](/white-box-pentest/quickstart)** · **[Connect Jira →](/platform/project-management/jira)** · **[Connect Linear →](/platform/project-management/linear)** · **[Manage integrations →](/platform/integrations)** - **GitHub repository selection in Hacktron**: Org admins can now enable or disable individual GitHub repositories for scanning directly in Hacktron, the same as GitLab, Bitbucket, and Azure DevOps. + + + + ## Choose GitHub repositories without leaving Hacktron + +**GitHub repository selection**: Organization admins can select which repositories to enable from the GitHub integration in Hacktron, within the access granted to the GitHub App. Repositories added back to the App installation are selected again automatically. + +**Separate repository access from PR reviews**: Keep a repository available to Hacktron while switching its automatic PR reviews on or off. The Repositories table now shows Repository and Owner separately, alongside Open Findings, PR Scans, and Last Scan. Its platform filter lists only providers your organization has connected. + +**Replies to explicit review requests**: When you post `@hacktronai review` for a commit with an existing review, Hacktron replies with the completed result or tells you that the review is still in progress. + +**Contact the team for large estimates**: For organizations using the large-estimate approval flow, Whitebox estimates above 5,000 credits prompt you to contact Hacktron before starting the scan. + +**GitHub.com reviews on appliances**: Self-hosted Hacktron deployments can connect a customer-owned GitHub App and review GitHub.com pull requests on their own infrastructure. + +**[Set up GitHub →](/platform/repositories/github)** · **[Manage repositories →](/platform/repositories)** · **[Configure Code Review →](/code-review/config)** · **[Configure self-hosting →](/platform/on-premises)** + + + + + ## Check your fixes without repeating the full assessment - **@hacktronai review replies on scanned commits**: Requesting a review on a commit that Hacktron already scanned now gets an immediate reply with the existing result instead of silence. +**Request a finding retest**: On a completed hosted Whitebox scan, choose **Retest findings**, select the findings to check, and provide instructions about your fixes. The Hacktron pentest team reviews the request and records each finding's outcome and notes. Completed retests are available in the scan's retest history and PDF report. - **Rebuilt People page**: Search, filters, role and seat filters, sorting, and pagination for your members list now run on the server, so the page loads quickly for large orgs and unlinked developers appear on every page. +**Preview login for dynamic validation**: Where dynamic validation is enabled, add login instructions and test credentials in the Whitebox scan wizard, then preview the browser session before starting. Hacktron uses those instructions to authenticate against your deployed targets when validating findings. - **Docs menu in the top nav**: The help icon now opens a dropdown linking directly to the docs for each product area, the API reference, the MCP server, and the changelog. +**Find developers across the People list**: Search by name, email, or SCM username, filter by role or Code Review seat, and sort and page through the results. Search and filters cover the full member list rather than only the rows already loaded. - **Repository page revamp**: The Repositories table now splits the repo column into Repository and Owner, scopes the platform filter to the providers your org has connected, and adds Open Findings and Last Scan columns. +**[Prepare scan scope and access →](/white-box-pentest/quickstart#add-runtime-context)** · **[Manage Code Review seats →](/code-review/people)** - **[Start a Whitebox scan →](/white-box-pentest/quickstart)** · **[Connect integrations →](/platform/integrations)** · **[See billing and plans →](/platform/billing)**