Every shipped version. No hidden updates.

New: 6 modern active attack tests (12 → 18)

The active pentest engine gained six current-generation techniques:

• GraphQL security — introspection & field-suggestion leakage
• NoSQL injection — MongoDB operator injection ([$ne], error & boolean signals)
• CRLF / HTTP header injection — response splitting, incl. unicode-CRLF bypass
• Prototype pollution — server-side __proto__ via query & JSON body
• Web cache poisoning — unkeyed X-Forwarded-Host / X-Host reflection
• Cloud-metadata SSRF — reaching AWS IMDS / GCP / Azure / Alibaba metadata

Improved: secret detection

Added 14 modern token formats to the search — GitHub fine-grained & app tokens, Google OAuth client secret, npm, DigitalOcean, Groq, xAI, Shopify, Postman, Telegram, Discord, Firebase FCM, and OpenSSH private keys.

New: command-terminal interface

A full black & phosphor-green terminal theme matching webironshield.com, with a wide, two-column scan-configuration screen so every option fits on one view.

Fixes

• Report / JSON / CSV export now writes UTF-8 — fixes silent "save does nothing" failures on Windows
• Settings and license activation now save reliably (UTF-8 + atomic write) with clear errors on failure

macOS build in progress.

New: 0-Day Anomaly Hunter

New Phase 4 of every scan with 10 independent hunters catching what rule-based checks miss:

• Stack traces & debug output across PHP, Python, Java, Ruby, .NET, Node
• Filesystem path disclosure (/var/www/..., cPanel paths, Windows paths)
• Suspicious response headers (version leaks, debug/staging markers)
• Dangerous HTTP methods accepted (PUT, DELETE, TRACE, PATCH)
• Default installation pages (Apache/Nginx/IIS welcome, Tomcat, Plesk)
• Debug & admin endpoint probing (40+ paths including /actuator/env, /.git/HEAD, /.env, /heapdump)
• HTTP parameter pollution behaviour
• Content-Type mismatches (JSON as text/html → XSS vector)
• Login timing oracles (user enumeration)
• Parameter reflection surfaces (XSS precursors)

New: History Click-to-Restore

Double-click any row in the History tab to restore full findings into the Issues tab. Every feature (detail popup, Verify Now, Copy Commands) works on restored findings exactly as on fresh scans.

Advanced Exploit Verification Engine

Replaced "No auto-verification" fallback with 9 category-specific verifiers. Each produces verdict + confidence + HTTP log + evidence + attacker walkthrough + copy-paste remediation code.

• Command Injection: canary + time-based blind (Unix & Windows)
• SQL Injection: error signatures (14 DB types) + boolean diff + time-blind
• Reflected XSS: 5 context-aware payloads with canary detection
• Path Traversal / LFI: 5 bypass payloads + content-signature matching
• Open Redirect, CORS, Security Headers, Exposed Files, Cookie Flags

Security

• Moved license signing secret from client to server (webironshield.com/api/)
• Auto-updater now verifies SHA-256 signature of downloaded ZIPs
• Added Zip-Slip path-traversal protection to update installer

Bug Fixes

• Fixed "Total issues: 0" when clicking findings during active scan
• Fixed Windows taskbar minimize/restore bug
• JWT weak-algorithm finding now includes weakness field in description
• Port scanner: removed dead StringVar never bound to any widget
• Replaced bare except: clauses so Ctrl+C works during scans

UI

• Custom shield icon on main window, tool popups, and installer
• New icon appears in taskbar, Start Menu, Desktop shortcut

Build System

• BUILD.bat now uses python -m PyInstaller (PATH-independent) — fixes the "pyinstaller not recognized" error
• Pip errors no longer hidden by 2>nul
• Python presence verified up front with clear error

Code Quality

• Removed 74 redundant f-string prefixes
• Removed ~20 unused imports and dead local variables