What changed, and why.

1.2.12

2026-07-11

Fixed

• Path-probing agents (ReconBot, CrawlerBot) reported fake findings on any site with a catch-all/SPA-fallback handler. A site that serves the same page with HTTP 200 for every unmatched route was misread as "found /.env" (CRITICAL), fake Jenkins/phpMyAdmin/WordPress panels, and more — reproduced live: 28 fake findings, risk score 99/CRITICAL, on a static site with zero real exposure. Fixed with shared, correctly-truncated baseline-comparison helpers used by both agents. Verified: the same target now correctly scores 46/MEDIUM.
• The same false-positive class existed in three more agents, found via a full audit: AuthzTester (BOLA/BFLA), HeaderPoker (access-control-bypass-via-header), and Injector (time-based blind SQLi reusing a stale baseline timing). All three now confirm a genuine, baseline-distinct signal before reporting.
• Risk scoring itself was not miscalibrated — a single real HIGH-severity finding is deliberately meant to floor the score at 70+. The "always above 70" symptom was these false-positive findings manufacturing a floor that shouldn't have applied.

1.2.11

2026-07-11

Security

• Off-origin links/forms/redirects on a target page could enter the attack surface and be requested. Every request now enforces the exact scheme+host+port the operator authorized.
• TLS certificate verification and redirect-following were disabled on the main attack client — both are now on/off by default.
• The desktop app shipped with csp: null — replaced with a strict policy scoped to the app's own origin.
• Docker-compose sandbox runs now use a unique project name per run.

Added

• Live Attack has a working Cancel button.
• --max-requests hard cap on Phase 2 traffic, independent of the concurrency limit.
• argus benchmark --min-detection-rate gates a release on a genuine accuracy regression; the benchmark workflow now runs before the draft release is published, not after.

1.2.9

2026-07-11

Fixed

• Dashboard showed a different risk band than Reports for the same scan — a threshold mismatch between the frontend and backend, now matched exactly.
• "Strike the app" (Live Attack) showed nothing for a Docker-unavailable or URL-shaped target — both fixed: URL targets bypass Docker entirely, and a genuine skip now streams a real event instead of going silent.

Changed

• Settings: removed the Argus CLI section — no longer needed now that the backend is bundled directly inside the installer.
• Settings: pick your own local Ollama model instead of only ever seeing the one size-recommended default.

1.2.8

2026-07-11

Changed

• The desktop app now bundles the Argus CLI directly inside the installer instead of depending on a separately pip install'd argus reachable on PATH — the root cause behind every "argus not found" report.