Roadmap

Truth-and-safety release, no new scan checks.

• • Ownership consent gate for aggressive mode. Aggressive checks run only against targets you have marked as owned (--owned, the WPSECSCAN_OWNED_TARGETS environment variable, or wpsecscan owned add); otherwise the scan runs passive and records why. The REST API gets an owned field plus a target allowlist, and the daemon config takes owned: true.
• • Python 3.10/3.11 import fix for the PDF and attestation reporters.
• • False-positive fixes for high/critical findings: EOL banner parsing, JWT alg=none confirmation, and pre-release core version comparison.
• • CVE-matching fixes: a plugin with an unknown version no longer matches every CVE, and version ranges written as 2.0.0 now include 2.0.
• • --help now works on every subcommand.
• • One source of truth for the version number, and removal of package-manager manifests for channels we never published to (distribution is pip, GitHub release binaries, and source).
• • Documentation corrected to match what the code does, with a claims-check script and test that fail the suite when README/FEATURES numbers disagree with the code.
• • CI lint now gates the build (it previously could not fail).

Quality release, no new feature surface: 3 Critical, 10 High and 7 Medium bugs fixed, plus a Python 3.10/3.11 CI repair.

• • Critical: a race on the GUI prefs lock that could corrupt prefs.json; WAF auto-skip never applied in parallel-groups scan mode; report snapshots could be left without their signature and then reported as tampered.
• • Mobile API: the per-finding endpoint was unreachable and now works; OPTIONS is scoped to /api/*; POST /api/scan allows 3 concurrent scans and returns 429 when full; the per-finding path-traversal guard now matches the parent endpoint's. The QR code no longer embeds the token.
• • Check fixes: a Cloudflare marker in cdn_edge_audit fired on every Cloudflare-fronted site; /cart/ was never probed in payment_commerce_deep; false counts in the GraphQL alias and SAML endpoint checks.
• • Atomic writes for sites.json and a lock around the credentials-vault fallback.
• • Python 3.10/3.11: a backslash inside an f-string expression in reporters/gdpr_dsr_report.py was a SyntaxError at import on those versions and broke their CI legs.
• • Housekeeping: CodeQL alert cleanups, README/FEATURES drift, duplicate CHANGELOG headers.

GUI-focused quality + UX. 2 Critical + 7 High + 12 Medium/Low bugs (grid overlap, multi-target window crash, prefs corruption, filter persistence, patchstack token wiring, exit-during-scan thread join, mobile_api CORS). 10 UX wins (4 new keyboard shortcuts, sash position persistence, multi-select, "Copy CLI" + "★ Star" toolbar buttons). The GUI now surfaces the emit/push/ai families (14 export formats + 16 push providers + 7 AI helpers) via Export As… / Push to… submenus + right-click context items. Mobile PWA gained POST /api/scan, per-finding detail, OPTIONS preflight, and a QR-code launcher; v2.8.5 then fixed the per-finding route (unreachable in v2.8.4), scoped OPTIONS to /api/*, and made POST /api/scan return 429 when its 3 scan slots are in use.

Bug-fix + dead-code-cleanup + test-coverage-boost. 5 new checks (Interactivity API XSS, WC Stores API rate-limit oracle, HPOS drift, cookie cosmetic-vs-blocking, plugin slug-squat). 3 new integrations (Sentry / DataDog / DefectDojo). 1 new AI helper (LLM-generated WAF rules). 9 UX wins: wpsecscan init, check disable/enable, benchmark, export-config, compare-pypi-version, SOCKS5 proxy fix, GUI Quick-scan button + severity legend, --single-page-html.

Hotfix + dead-code wiring. Fixed v2.8.1 CI progress-callback signature regression + argparse --out/--output abbreviation conflict. Wired the v2.8.1 SDK modules to real CLI surface: wpsecscan emit (14 export formats), push (13 integrations), ai (6 LLM helpers).

17 new WP/WC defensive checks (cart-abandonment XSS, Stripe Connect state-CSRF, ActivityPub leak, FSE global-styles, multisite IDOR/RBAC, Next.js secret leak, AI-agent tool injection, WC multi-vendor IDOR, WebAuthn RP-ID, WC refund-flow IDOR …). 13 new integrations (GitLab CI / CircleCI / Azure DevOps / Buildkite / Shortcut / Plane / Nuclei / OSV / ExploitDB / Wiz / chat / hosting / automation). 11 AI features (agentic remediation loop, prompt-injection detector, cheaper-model fallback, drift alert …). 16 compliance and enterprise features (HIPAA §164.312 safeguards, GDPR Art. 35 DPIA pre-screen, FedRAMP Moderate baseline, UK Cyber Essentials Plus, Australia Essential 8, SPDX SBOM, CEF/LEEF export, risk register, CMMC 2.0 Level 2 evidence ZIP …).

Third mega-audit pass. 57 fixes/additions: 46 bugs + 5 features (WC coupon-enum, headless CORS lockdown, Trusted Types CSP, 5-tier smart-explain, interactive HTML dashboard with filter+search) + 8 UX wins.

15 new integrations: Vault/1Password secret read, Snyk import, HackerOne template, VirusTotal/urlscan enrichment, MSFT Sentinel KQL, AWS Security Hub, GCP SCC, PagerDuty AIOps, statuspage, Linear/Asana/ClickUp/Monday push, Teams reaction snooze. 12 new reporters, a GH-Pages-hosted check marketplace with cosign signature verification, and companion plugin 1.4.0. PyPI publishing moved to Trusted Publishing (OIDC). v2.7.1–v2.7.3 were three security/bug-fix audit releases on top.

v2.4.0: 66-item audit delivery (10 new check files, 7 new subcommands, policy engine, direct issue-tracker push, GitHub PR commenter, GUI pause/resume and minimize-to-tray). v2.5.0: login robustness for hardened sites, 12 new companion-plugin REST endpoints, live SIEM forwarders, GitHub Check Run, creds CRUD with OS keychain, SAML/OIDC configure flow, mobile companion PWA. v2.6.0: 42 new checks (226 → 268) weighted toward current threats (AI plugin prompt injection, MCP endpoint exposure, WP Playground database exposure, Block Bindings, Interactivity API …).

Group C — 10 AI-triage features (opt-in, behind Advanced AI options panel). Opt-in transparent local-first usage analytics.

165 features across 18 groups: consent-gated verification helpers (later reworked — see v2.9.0), threat-intel integrations, 26 new attack-surface checks, and enterprise-mode scaffolds.

8-source nightly CVE aggregator. Per-source counts are published in the feed header.

WP companion plugin. Licensing: AGPLv3 from v1.9.0 onward (earlier versions were MIT). Check-level compliance mappings now cover 12 frameworks.