Product Updates: More complete coverage, less set up.

No dark-mode styles — this email renders the same in a dark client.

Scans that reach more of your app, with less work to set up. Plus upgrade tips.

View in browser (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-8q5n4LbW8wM7ks6lZ3pkW2pt5xK58RZlNW8JD6gk8j43XFW1nl09y6c8gQFN1Q-jkjFX0HxW86w3lt19bfFYW8g6xTH7x6P4QW63q-FN62B3gqVYJsPd4b0NqKW84_db76qsbFpW304TMn6gLW9wW5cyt-x57SBbzW6lydYB2kWcSGW8zSklm18YkP8W3Cl7Gq2ZGVbhW9kf_t61_kKbJW2z1HR881RBrGN4FGdy3kv_r_W60DTS1369MFBW5DpKC79bfW34W2m-yh93VMTgRW6Dtk0f4qm4MqW3Pwf4s5-nHY9W6Tn1bx8pXqhGW6Mw8--8_qC3DN5tk7Jf2LxKrW1G7c1j3fCdqBW44k_dv7zQhRfW78vjT746GgrYW6x07J84gsxkKW21HhDJ2T7StcW4qcyV51zs-d7W4pYVC47_fckTW8sQ_vJ5xFyv1W5PPZ7M1Kxjz9W3CR0l27SYjb-W1vbNbv6GtzNdW1pZzFM2mPZ6WW3c-XrG4d8PBSW2yq9jW56LqbGN2Wsrk1Hsz6mW3_ggjM98YMQ4W6Fs9Cm5xnF7bV3-B3S909cJjN5p_1DKyNyy1f7qhWq-04 )

StackHawk Product Update (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-863pyd0W7Y8-PT6lZ3pjW5Q5MTw9l5dpQW2H2XxZ6x5N59W6VVwlH6dGkG6W4Xh32l226HTrW18RySK7Tx2GxW7RyF0x1BWk9FW2C6Krj7hrbfYW1xr6kT81lZqNN3V43f2JBc3mW5jcMgP3KvSgLVmTBj42Tnw7wW5vQg7Q2XRgv6W33Pq_j1GLSqQW1KDt3v2X1km5W7LCRv28nVxcBW8-JxCL8SVLrfW6MPWGf4J3zr7W3r4mmw7kYTrBW3tHH1s7j2ChpW1cq4YT7F4-9lW2bwxhs6N-jKbVZN8V15J3z7_W7rnPk043yxrFW5BjkjN2VZTTkW9fVG4m2HWd6-W6hKw5z1YqwqCf5wBGfz04 )

Hi there,

Your coding agent acts on what the scanner reports. So our latest feature releases focus on two areas: more complete coverage, and less setup to get it. Here is the short version.

Read the full update on the blog → (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-8K3gVDYW95jsWP6lZ3lfN4Dq7YHQG3dlV_GmqR27kSLsW5H8FP97XScD3W4DjWrN8g0m4dW5jq7HT8Kn-91W3Wbp207xt-HZW1H91bg1XyXRCW6lStFM5HbJcWW1f7RC_2gc2qXV2Vbm91Pn7N8W6vqk_9315QlCW11_m9m4mvbrxW24Mddg4LtXcpMxnLyGtSKRdW10_5Sk69X2mNW6lnRzm7Rq21dW6C3ycq5-BddFW90BK9p68FvKVW4f7XSN3sRZrhW5FF3ZG40lsttW5l-jY32P8gpFW89M10f7dgxgcW2pkYyQ2LfpWKW6WG3pn88-H68W172_TB5y89WbW6xzD0j3dVpkFW36Q2g41djvKMW1YBDWN83GzBqW386qBY8b6NjBW7N9_7b4CFP2Ff5C7H1Y04 )

More Complete Coverage

A scan can only find what it reaches. It now reaches more.

›
APIs behind a base path get tested. HawkScan reads the prefix from your OpenAPI spec and tests every route at its real URL.

›
Single-page apps get crawled from the pages you choose. The browser-based spider starts from your seed paths and reaches the deep views.

›
New guide: scanning services behind mutual TLS. Step-by-step setup for apps that require a client certificate, so internal services can be in scope.

Less Setup

Getting to a thorough scan takes less work.

›
Your agent sets up authorization testing. It reads your code, finds or creates test accounts, and runs your full policy and the authorization checks in one scan.

›
Findings land in GitHub code scanning. One alert per finding, next to your SAST and dependency alerts, in the tab your developers already check.

›
Wingman runs in Codex and GitHub Copilot. The full skill set, alongside Claude Code and Cursor.

See every change and how to turn it on → (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-8K3gVDYW95jsWP6lZ3lfN4Dq7YHQG3dlV_GmqR27kSLsW5H8FP97XScD3W4DjWrN8g0m4dW5jq7HT8Kn-91W3Wbp207xt-HZW1H91bg1XyXRCW6lStFM5HbJcWW1f7RC_2gc2qXV2Vbm91Pn7N8W6vqk_9315QlCW11_m9m4mvbrxW24Mddg4LtXcpMxnLyGtSKRdW10_5Sk69X2mNW6lnRzm7Rq21dW6C3ycq5-BddFW90BK9p68FvKVW4f7XSN3sRZrhW5FF3ZG40lsttW5l-jY32P8gpFW89M10f7dgxgcW2pkYyQ2LfpWKW6WG3pn88-H68W172_TB5y89WbW6xzD0j3dVpkFW36Q2g41djvKMW1YBDWN83GzBqW386qBY8b6NjBW7N9_7b4CFP2Ff5C7H1Y04 )

Before You Upgrade

These changes alter behavior or need something from you. Check them before you run hawk upgrade.

›
Your finding counts will move. Four single-identity authorization rules are retired in favor of multi-profile testing. Check dashboards and build thresholds.

›
Missing variables stop the scan. A ${VARIABLE} with no value now fails with a clear error. Use ${VARIABLE:} when you mean an empty value.

›
codeScanningAlerts is deprecated in the GitHub Action. Use --sarif-ghas with GitHub's upload-sarif action.

›
Bulk triage files are checked more strictly. Re-run any hawk op scan triage --from-file files you use and fix rejected entries.

›
API clients should handle 409. Conflicts now return 409 with the reason. They used to return 412.

›
Re-run Team assignments made by API before mid-August. The endpoint reported success without saving. It now saves.

›
OpenAPI base paths are now applied. If the path in your spec's servers[] entry is wrong for the environment you scan, set app.openApiConf.basePath.

There Is More in the Full Post

SSRF alerts confirmed before they fire. Organization-shared secrets. A one-line installer for every OS. Team ownership for every new app. Read-only access for auditors. And the full list of fixes.

Read the full update → (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-8K3gVDYW95jsWP6lZ3lfN4Dq7YHQG3dlV_GmqR27kSLsW5H8FP97XScD3W4DjWrN8g0m4dW5jq7HT8Kn-91W3Wbp207xt-HZW1H91bg1XyXRCW6lStFM5HbJcWW1f7RC_2gc2qXV2Vbm91Pn7N8W6vqk_9315QlCW11_m9m4mvbrxW24Mddg4LtXcpMxnLyGtSKRdW10_5Sk69X2mNW6lnRzm7Rq21dW6C3ycq5-BddFW90BK9p68FvKVW4f7XSN3sRZrhW5FF3ZG40lsttW5l-jY32P8gpFW89M10f7dgxgcW2pkYyQ2LfpWKW6WG3pn88-H68W172_TB5y89WbW6xzD0j3dVpkFW36Q2g41djvKMW1YBDWN83GzBqW386qBY8b6NjBW7N9_7b4CFP2Ff5C7H1Y04 )

We want to hear from you

Have product feedback or feature requests? Email us at product@stackhawk.com (mailto:product@stackhawk.com) .

StackHawk, 1580 N. Logan St, Ste 660 PMB 36969, Denver, Colorado 80203, United States, (720) 336-8596

Manage preferences (https://hs-7478034.s.hubspotemail.net/hs/preferences-center/en/page?data=W2nXS-N30h-MzW36jF4P3_DCbjW32svTt45pmmXW4kt6xb2xFY-zW1_rZHg4kMBg8W4hq1vv3ZHnJCW41Hp_73gw1yDW3JDc2X41Q1j5W1VsxqW30qGtDW3M5KhW47thy9W3SyZqV2WJ2bpW3R3CHD43yZ9xW3gd2XM49xtJlW30sPSl4hDGDRW3__cMP3bwWKMW1L5Sy_3K75xRW30yl7k4rnnwDW4cNDLQ2zG5vhW2vM6fZ1X0BHBW348sdT3GJBB9W4kD6132CWB4CW1VywZv1N61R3W20ZvBS2CJPwsW348srl1QxGPSW1W-ztS2CFWpTW2t5QBZ2r1V7-W1VcGGh36wpJNW2CPq-H4tf7nSW38t8yZ3C0BQnW2Wp_K94cvBGYW2WpFXv3dfVNSW3btNQ23BWsjnW2PKSqS1NDss0W1QDgvp41K3QhW3bwvg12PtZdMW2w5F-h3VxVX0W47QcDq3SzHM1W3QFgws38rYPNW3f_7j-368fTWW3P51YW2Kxw92W3g9XbW41yJ2BW1BHYbj3XxfpBW2YCJ9s4htjy5W32m8P_49Qp-NW329b663BLCxnW34jP544mJWMtW32JrpC4t7dPlW2KQtFt3Kd7JsW2nMFXg3Z-y3bW2MB8-13_v_T9W1Lhp9630JdgVW1XhC4J3b9xwCW3SZb422MH7mpW21jC6y2PvmQxW3zg7Rg3gw2lVW3b4_2M4kvrRNW32nplh3GTM5JW2FMt0j25cCHNW36DGZJ1SkFQfW2vM2jN3_rh4vW2WLXln38yPYMW3P2ZB7211HLkW1_9Nl93dhZxMW4phFVf3Hfvv10&_hsenc=p2ANqtz-9UTo_5ehVXXIRupLA-b3z1zYR9VyqhK3AKUWTPfLwoBM91PeatUd5M6oFWZhngeZ1tF1H03TO_oQYlUPLJZmGHgQXbDquZVQsCXfG6AGoQtwXBEFxuIgEoOWQtBcHksvR3igj9&_hsmi=449063774 )

LinkedIn (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-8q3pyd0W8wLKSR6lZ3pFW7ZwMsR2gv6SVW8bX89Z2nzDx-W6GbZVy6ZwwjgN2WwcWgJ4tzGW5Jp4108M45P3W5KTPQL1C23bRW8Qsx1x1KXmqwW1lWcqn5VyjJhW4RPnJ53bSVjCVHn54N2TWwNhW3H8n6S1lHZxqW1sqvh14gJkYCW8nFPrl8H1WtQW7JnxDN844cSxW6qXn046JvsC_W497gL34H2YpLW6rdfFb8mS21-W8hMB9L2XP0RsW2WZ8XJ52WCXXMfX11fHbjN6N1Gff6fxWrJJW8405Fg4GR3bMW874hL58nwC5KN7dSmhsXWYJHVrkybb4SXy5TW86qwqF38qp4nW3FgSL_6X7WY6N6w-h-SQyljxf8nRcRd04 )

X (https://cVvv604.na1.hubspotlinks.com/Ctc/I6+113/cVvv604/VWsZV83PZW4DW7mZt2f6862YDW8JC1R55Xhh76N3Bm-8q3pyd0W8wLKSR6lZ3nMW8HD-yN6ZHwCZW33qPc45HHGVNW7X92fN8r6-DRW2SYTZJ60pqssVpd3887yL959W5BPXcr5Ky45HN3wGHs39yw14W3-G7d54jGYQxW4XYzRJ45QKKgW6msy4c1861CBW8Gj3Xj6j_WvjW6PsMjp3PB7dVW2g40jd2C9Vr3W7gKNv72pdWs7VGCDK56c6b6VW20ZrKH10c4TMW11NC1L4rSqD7W571Lc-5CGMdjW4wzYCQ5Q2b_KW1fhsS197c9mvN6GVvfvZt_x2W5C_tSV86mRBGN8FPsnYMdyzvW5Pjhxz1nfsNvVgB1JH6YHNxlW1w7ftK3Nws2wW92ywkk2S2xmyN2g5wc6cz4q8f8x5BYC04 )

Accession

nse/stackhawk/2026-11-12/6839

From

StackHawk Product Team · product@go.stackhawk.com

Sent

12 November 2026 · 22:00 UTC