# Changelog

## Score

- CAI 71 → 72 (+1.1)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 70 → 71 (+0.7)
- Architecture 96 → 98 (+1.7)
- Maturity 65 → 65 (-0.1)
- Readiness 83 → 82 (-0.3)
- Security 75 → 81 (+6.3)
- Performance 100 (new)

## Resolved (50)

- Boundary-crossing change coupling: tests.rs ↔ tests.rs (src/parameter_analysis/discovery/tests.rs)
- Boundary-crossing change coupling: tests.rs ↔ tests.rs (src/parameter_analysis/discovery/tests.rs)
- Change coupling: mutate.rs ↔ mod.rs (src/waf/bypass/mutate.rs)
- Duplicated block (10 lines × 2) (src/scanning/js_context_verify.rs)
- Duplicated block (10 lines × 3) (src/parameter_analysis/discovery/form.rs)
- Duplicated block (11 lines × 3) (src/scanning/url_inject.rs)
- Duplicated block (12 lines × 2) (src/utils/fs.rs)
- Duplicated block (12 lines × 3) (src/scanning/url_inject.rs)
- Duplicated block (12 lines × 7) (src/parameter_analysis/discovery/cookie.rs)
- Duplicated block (13 lines × 2) (src/cmd/scan/input.rs)
- Duplicated block (13 lines × 3) (src/scanning/url_inject.rs)
- Duplicated block (17 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
- Duplicated block (18 lines × 2) (src/parameter_analysis/mining/probe_body.rs)
- Duplicated block (18–19 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
- Duplicated block (20 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
- Duplicated block (20–25 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
- Duplicated block (21–24 lines × 2) (src/scanning/check_dom_verification.rs)
- Duplicated block (32–33 lines × 2) (src/mcp/mod.rs)
- Duplicated block (37–39 lines × 2) (src/mcp/mod.rs)
- Duplicated block (8–9 lines × 6) (src/parameter_analysis/discovery/cookie.rs)
- …and 30 more

## New (62)

- Boundary-crossing change coupling: tests.rs ↔ tests.rs (src/parameter_analysis/discovery/tests.rs)
- Duplicated block (10 lines × 2) (src/scanning/url_inject.rs)
- Duplicated block (11 lines × 3) (src/scanning/ast_dom_analysis/sinks.rs)
- Duplicated block (12 lines × 2) (src/utils/fs.rs)
- Duplicated block (13–14 lines × 3) (src/parameter_analysis/discovery/cookie.rs)
- Duplicated block (14 lines × 3) (src/scanning/ast_dom_analysis/sinks.rs)
- Duplicated block (15–16 lines × 2) (src/scanning/ast_dom_analysis/sinks.rs)
- Duplicated block (17 lines × 2) (src/scanning/ast_integration.rs)
- Duplicated block (22–27 lines × 2) (src/scanning/check_dom_verification.rs)
- Duplicated block (24–25 lines × 2) (src/mcp/mod.rs)
- Duplicated block (6 lines × 2) (src/scanning/ast_dom_analysis/sinks.rs)
- Duplicated block (6 lines × 2) (src/utils/xml.rs)
- Duplicated block (6 lines × 2) (src/utils/xml.rs)
- Duplicated block (7 lines × 2) (src/scanning/check_reflection.rs)
- Duplicated block (7 lines × 2) (src/scanning/url_inject.rs)
- Duplicated block (7 lines × 2) (src/utils/log.rs)
- Duplicated block (8–12 lines × 3) (src/scanning/check_dom_verification.rs)
- Duplicated block (9 lines × 2) (src/parameter_analysis/discovery/form.rs)
- Duplicated block (9 lines × 2) (src/scanning/check_dom_verification.rs)
- Duplicated block (9 lines × 2) (src/scanning/url_inject.rs)
- …and 42 more

## Changes since last survey

- 50 commits — 29 feature/other, 21 fixes

## By area

- (root) — 10 commits
- src/scanning — 10 commits
- docs/content — 6 commits
- src/cmd — 6 commits
- src/parameter_analysis — 5 commits
- .github/workflows — 3 commits
- src/mcp — 3 commits
- docs/static — 2 commits
- (repo) — 1 commit
- src/encoding — 1 commit
- src/job — 1 commit
- src/payload — 1 commit
- tests/functional — 1 commit

## Notable commits

- fix: Fix parameter discovery and request injection edge cases (#1484)
- fix: Publish structured MCP tool output and fix the server's own identity (#1466)
- fix: fix(dom-verify): false [V] on inert JS-string / data-block reflections, numeric A findings (#1478)
- fix: fix(encoding): send multi-URL pre-encoded path params with the probed layer count (#1479)
- fix: fix(http): honor request pacing and user-agent overrides (#1487)
- fix: fix(jobs): align reachability probes with CLI (#1491)
- fix: fix(mcp): protect draining jobs from deletion (#1474)
- fix: fix(output): preserve markdown fields and type descriptions (#1483)
- fix: fix(payload): repair generated HTML/attr payloads that could never DOM-verify (#1475)
- fix: fix(poc): make PoCs reproduce the request the scan actually sent (#1477)
- fix: fix(scan): preserve incomplete results and resume state (#1485)
- fix: fix(scanner): gate XSS findings by response content type (#1494)
- fix: fix(scanner): preserve URL semantics during injection (#1480)
- fix: fix(scanner): preserve payload selection and valid WAF variants (#1490)
- fix: fix(sxss): find and correctly attribute form-backed stored sinks (#1493)
- fix: fix: CSP meta/report-only precedence and WAF status misdetection (#1481)
- fix: fix: HPP form-action/pre-encoding drift and streamed AST duplicates (#1488)
- fix: fix: bug-hunt batch — blind XSS request builders, batch-mining attribution, server/MCP parity, and CLI silent-clean holes (#1476)
- fix: fix: follow a form action's same-host TLS upgrade (#1461)
- fix: fix: multi-policy CSP, quoted '>' in script tags, template-literal delimiter, credential-rotation resume, assigned-over parseInt (#1486)
- …and 30 more