v0.0.9 (2026-08-25)¶

Security¶

• Web console authentication: set ZSANS_WEB_PASSWORD to require a password; all endpoints are blocked until authorized. Browsers log in via a dedicated page (HttpOnly session cookie); third-party clients authenticate via Authorization: Bearer <password> or X-API-Key headers. Login rate-limiting included
• Command injection fix: external tools (subfinder / EHole) are now always invoked with argument lists — the Windows shell=True string-concatenation paths were removed
• Web seed validation: seeds submitted via the Web console are strictly validated (domain/URL/IP format whitelists) before reaching tool command lines
• SSE log stream no longer sends Access-Control-Allow-Origin: *; request bodies capped at 2 MB

Fixed¶

• Seed scope: replaced the naive "last two labels" expansion with Public Suffix List-based registrable domain computation (bundled PSL, offline-capable). example.co.uk no longer expands to the public suffix co.uk, while www.example.com still covers example.com. New option asset_scope.seed_scope: registrable | exact
• Seed domains are now normalized to lowercase (-d EXAMPLE.COM previously broke relevance matching)
• Domain relevance checks use hostname instead of netloc, so port-bearing URLs like http://target.com:8443/ no longer get all their links misjudged as unrelated and silently dropped
• Proxy URLs with credentials are redacted before being written to logs
• Missing frontend i18n key (enter) added; strategy dropdown options localized

Changed¶

• Console log noise greatly reduced: per-asset/per-link logs demoted to DEBUG (still written in full to zsans.log), replaced by a progress heartbeat every 25 assets and a final scan summary line
• i18n coverage completed for remaining hardcoded strings (API error messages, CLI plugin listing labels, frontend alerts/confirms)

v0.0.7 (2026-08-12)¶

• Plugin Web config support: output/plugin_config/<name>.yaml, independent of the main configuration
• Plugin plugin_config configuration and plugin Web UI asset hosting
• Plugin schema auto-renders JSON-Schema forms
• Other plugin system enhancements and fixes

v0.0.6 (2026-08-11)¶

• Plugin system enhancements
• Web console improvements
• Other fixes

v0.0.5 (2026-08-09)¶

• Major enhancements to output and reporting
• Checkpoint / resume improvements
• Tool orchestration improvements

v0.0.4 (2026-08-09)¶

• Fixes and stability improvements

v0.0.3 (2026-08-09)¶

• Version iteration

v0.0.2 (2026-08-08)¶

• First fully functional version iteration

v0.0.1 (2025-08-15)¶

• Initial version