What's new in PandaONE

SSRF probe improvements, GitHub Actions integration, and auto-cycle in the console demo.

• NewSSRF probe now tests cloud metadata endpoints (AWS, GCP, Azure) by default.
• NewGitHub Actions integration — run PandaONE as a step in any workflow.
• ImprovedAgent swarm rebalanced: IDOR agents now chain across 3+ hops before confirming.
• ImprovedConsole demo auto-cycles through scan scenarios after completion.
• FixedFixed false positive in JWT 'alg:none' check when server returns 400 before 200.

Swarm architecture rewrite, pull request auto-fix, and self-hosted deployment option.

• NewSwarm v2 — parallel specialized agents now run concurrently per target.
• NewAuto-fix PR — every confirmed finding now generates a ready-to-merge patch.
• NewSelf-hosted deployment option available on Business plan.
• NewSlack + Discord alert integration for real-time finding notifications.
• ImprovedSQLi payloads updated with 40 new blind injection variants.
• ImprovedDAST mode now reads OpenAPI specs to expand surface automatically.
• FixedResolved edge case where redirect chains caused duplicate findings.

XSS and auth bypass improvements, plus executive PDF reports.

• NewExecutive briefing report — HTML and PDF export for non-technical stakeholders.
• NewAuth bypass suite — tests OAuth misconfigurations, JWT weak signing, and session fixation.
• ImprovedXSS agent now tests DOM-based injection paths, not just reflected.
• FixedFixed timeout race condition on slow targets during SSRF probe.