CHANGELOG

    What’s new in Onyx.

    Product updates in plain language — new capabilities, improvements, and fixes as they ship.

    1. New

      Refreshed site & navigation

      • A rebuilt marketing site with a dropdown mega-menu (Product, Solutions, Resources) and standalone Pricing, Security, and Changelog pages.
      • New homepage sections walking through authenticated scanning, OWASP API Top 10 coverage, CI/CD, and a live console replay.
    2. New

      CLI & GitHub Action

      • Run scans from your terminal with `onyx scan` — table, JSON, or SARIF output, and fail-on-severity gating for any CI.
      • A GitHub Action that runs Onyx on your pull requests, comments findings inline, and ships SARIF straight to your GitHub Security tab.
      • Long-lived API tokens you can mint and revoke for CI and automation.
    3. New

      OWASP API Top 10 mapping

      • Every finding is now labeled with its OWASP API Security Top 10 (2023) category, API1 through API10.
      • Reports and PDF exports include a coverage section so you can see what was tested at a glance.
    4. New

      Authenticated scanning

      • Test what's behind the login: authenticate with a bearer token, API key, or cookie.
      • Dynamic auth with OAuth2 client-credentials and full login flows, including automatic token refresh when a session expires mid-scan.
      • Missing-auth probes that strip credentials on purpose to catch broken access control.
      • Auth credentials are encrypted at rest and never written to logs.
    5. Improved

      Evidence-based detection

      • Onyx now captures a benign baseline for each endpoint and diffs attack responses against it.
      • This confirms time-based and blind injection with real evidence and cuts false positives.
    6. Improved

      Broader attack coverage

      • Payloads now target GET and DELETE requests, not just bodies on writes.
      • Query, path, and header parameters are tested — not only the request body.
    7. Improved

      Reliability & safety

      • Structured logging and error tracking for faster diagnosis.
      • Sensitive values are redacted from stored evidence, so secrets never land in your reports.
      • Safer, versioned database migrations behind the scenes.
    Read the docsFollow along on GitHub