diff --git a/changelog.mdx b/changelog.mdx index f031c93..dd9dba9 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -9,27 +9,28 @@ rss: true ## Findings get an identity, a history, and a command palette - **Human-readable finding IDs**: Every finding now has a short, stable ID that appears at the top of the row, in the panel, on the full page, and in the URL. Click the ID to copy it. +**Human-readable finding IDs**: Every finding now has a short, stable ID that appears at the top of the row, in the panel, on the full page, and in the URL. Click the ID to copy it. - **Finding activity timeline**: The finding detail panel gains an Activity tab that shows the full history of a finding: when the engine detected it, which scans sighted it (collapsed into "Detected again in N scans" when consecutive), and every status or severity edit by a team member, with the actor and changed fields on each entry. Switch to the Comments view to see only the thread. +**Finding activity timeline**: The finding detail panel gains an Activity tab that shows the full history of a finding: when the engine detected it, which scans sighted it (collapsed into "Detected again in N scans" when consecutive), and every status or severity edit by a team member, with the actor and changed fields on each entry. Switch to the Comments view to see only the thread. - **Finding actions in the command palette**: With a finding open, the command palette leads with a group of actions for it - change status, change severity, mark or unmark as duplicate, create a ticket, start remediation, copy its ID, copy its link, and open it on the full page. +**Finding actions in the command palette**: With a finding open, the command palette leads with a group of actions for it - change status, change severity, mark or unmark as duplicate, create a ticket, start remediation, copy its ID, copy its link, and open it on the full page. - **New finding filters and multi-ID search**: The findings list gains Source, Reopened, and Date range filters, each saved in the URL. Paste two or more finding IDs into the search box to filter to exactly those findings. +**New finding filters and multi-ID search**: The findings list gains Source, Reopened, and Date range filters, each saved in the URL. Paste two or more finding IDs into the search box to filter to exactly those findings. - **CWE name on hover**: The CWE badge on a finding now shows the full weakness name in a tooltip so you know what you are looking at without leaving the page. +**CWE name on hover**: The CWE badge on a finding now shows the full weakness name in a tooltip so you know what you are looking at without leaving the page. - **Whitebox retest wizard**: Request a retest for a completed scan directly from the scans list or the scan detail page. The retest covers every reported finding except false positives and accepted risk, and the scan detail shows the retest status and results once it is complete. +**Whitebox retest wizard**: Request a retest for a completed scan directly from the scans list or the scan detail page. The retest covers every reported finding except false positives and accepted risk, and the scan detail shows the retest status and results once it is complete. - **Clearer whitebox report coverage**: The Methodology section of a whitebox scan report now shows how many functions each area selected, instead of an arbitrary list of five names. Coverage Detail caps the unselected entry-points table at 50 rows rather than listing every one. +**Clearer whitebox report coverage**: The Methodology section of a whitebox scan report now shows how many functions each area selected, instead of an arbitrary list of five names. Coverage Detail caps the unselected entry-points table at 50 rows rather than listing every one. - **Inline browser-auth instructions in the scan wizard**: The browser-auth audit instructions in the whitebox scan wizard's target step now appear directly on the page with live verification status, instead of opening in a separate modal. +**Inline browser-auth instructions in the scan wizard**: The browser-auth audit instructions in the whitebox scan wizard's target step now appear directly on the page with live verification status, instead of opening in a separate modal. - **PR Review setup vs. active**: The Repositories page now shows a notice when PR Review is toggled on for a repo but no active trial or subscription is backing it, with a direct link to start a trial for owners. +**PR Review setup vs. active**: The Repositories page now shows a notice when PR Review is toggled on for a repo but no active trial or subscription is backing it, with a direct link to start a trial for owners. - **On-prem GitHub.com reachability check**: An on-prem appliance that cannot reach GitHub.com now disables the GitHub.com integration card with a clear reason (DNS, blocked, or TLS) instead of letting you start the setup flow and failing at the code exchange. +**On-prem GitHub.com reachability check**: An on-prem appliance that cannot reach GitHub.com now disables the GitHub.com integration card with a clear reason (DNS, blocked, or TLS) instead of letting you start the setup flow and failing at the code exchange. + +**[See findings →](/api-reference/findings/list-findings)** · **[Start a Whitebox scan →](/white-box-pentest/quickstart)** · **[Set up GitHub →](/platform/repositories/github)** - **[See findings →](/api-reference/findings/list-findings)** · **[Start a Whitebox scan →](/white-box-pentest/quickstart)** · **[Set up GitHub →](/platform/repositories/github)** diff --git a/code-review/overview.mdx b/code-review/overview.mdx index 94be089..db183a0 100644 --- a/code-review/overview.mdx +++ b/code-review/overview.mdx @@ -71,3 +71,11 @@ Use Code Review for continuous security coverage on day-to-day development. For Manage and provide feedback on findings directly from Slack. + +## Scan limits + +Each PR or MR scan supports **up to 500 changed files**. Hacktron skips larger +PRs and MRs. + +We recommend [enabling reviews on all PRs and MRs](/code-review/setup#configure-code-review) +so smaller changes get reviewed before they reach a large deployment PR. diff --git a/code-review/troubleshooting.mdx b/code-review/troubleshooting.mdx index 47adaa6..f3e699b 100644 --- a/code-review/troubleshooting.mdx +++ b/code-review/troubleshooting.mdx @@ -13,6 +13,7 @@ Check these first: - The repository appears in **Repositories** - The repository is enabled for Code Review - The pull request or merge request targets a covered branch +- The pull request or merge request changes no more than 500 files - The organization has trial or paid review capacity available - The organization has not reached its pooled review limit, or spillover is enabled on a paid plan - For GitHub, the GitHub App installation includes the repository @@ -43,6 +44,13 @@ Check **Billing** to confirm the organization has trial or paid review capacity If auto-assigned seats are enabled and a new developer did not get assigned a seat, you may need to [increase the auto-assignment seat limit](/code-review/people#configure-the-seat-limit). +## Pull request or merge request is too large + +Hacktron skips PRs and MRs with more than **500 changed files**. + +[Enable reviews on all PRs and MRs](/code-review/setup#configure-code-review) +so smaller changes get reviewed before they reach a large deployment PR. + ## Review limit is reached Code Review uses a pooled organization review limit each billing period. If the limit is reached: diff --git a/docs.json b/docs.json index 8182e5a..ad21c55 100644 --- a/docs.json +++ b/docs.json @@ -140,6 +140,10 @@ "group": "Getting started", "pages": ["white-box-pentest/quickstart"] }, + { + "group": "After the scan", + "pages": ["white-box-pentest/retests"] + }, { "group": "Credits and billing", "pages": ["white-box-pentest/billing"] diff --git a/white-box-pentest/billing.mdx b/white-box-pentest/billing.mdx index 62593de..1ae0dd8 100644 --- a/white-box-pentest/billing.mdx +++ b/white-box-pentest/billing.mdx @@ -87,6 +87,11 @@ organization has insufficient Whitebox Scan credits. updated. +## Retests + +Each pentest includes **one free retest**, with no extra Whitebox Scan credits +deducted. See [Retests](/white-box-pentest/retests) for how to request it. + ## Refunds and cancellations If a started scan cannot launch successfully after credits are deducted, diff --git a/white-box-pentest/overview.mdx b/white-box-pentest/overview.mdx index ffd2fdc..eb7c723 100644 --- a/white-box-pentest/overview.mdx +++ b/white-box-pentest/overview.mdx @@ -37,6 +37,11 @@ White-box Pentest is a good fit when you need: +## Verify your fixes + +Each scan includes **one free retest**. [Request a retest](/white-box-pentest/retests) +after fixing your findings to get an updated report. + ## Run status | Status | Meaning | diff --git a/white-box-pentest/retests.mdx b/white-box-pentest/retests.mdx new file mode 100644 index 0000000..7fbb7c3 --- /dev/null +++ b/white-box-pentest/retests.mdx @@ -0,0 +1,65 @@ +--- +title: "Retests" +description: "Ask Hacktron to verify your fixes and download an updated pentest report. Each scan includes one free retest." +--- + +After fixing your pentest findings, ask the Hacktron team to verify them. + + + Each scan includes **one free retest**. Submit once your fixes are ready; you + cannot request another retest for the same scan. + + +## Before you request a retest + +Retests are available on the hosted platform for completed White-box Pentests +with triage finished and at least one reported finding. You need a **Member** +role or higher to request one. Viewers can read the results. + +## Request a retest + + + + In **Whitebox Scans**, open the scan and click **Request retest**. + + + Choose the branch containing your fixes for each repository. To add commit + SHAs under **Commits**, press Enter after each one. This is optional. + + Optionally, add **Deployment URLs** and a **Summary of fixes** to help + the team check your changes. + + For uploaded code, describe the changes in the summary; you cannot + attach a replacement archive. + + + + Findings marked **False positive** or **Accepted risk** are excluded. + Check the list and update any statuses before submitting. + + + Click **Request retest**. The scan shows **Retest pending** while the + team checks your fixes. + + + +### Request limits + +- Up to 50 commit SHAs per repository +- Up to 20 deployment URLs +- Up to 10,000 characters in the summary of fixes + +## Read the results + +When the scan shows **Retested**, open **Retest result** for verification +notes and the outcome of each finding: + +| Outcome | Meaning | +| ------------------ | ---------------------------------------------- | +| **Verified fixed** | Open findings are marked **Resolved**. | +| **Not fixed** | The issue remains. Read the notes for details. | + +You'll also get an email if notifications are enabled. + +After the retest, a new report is added with fix notes showing which findings +were fixed.