Changelog
What's new and improved in ShadowMap. This page is updated weekly with everything that shipped.
Week of 6 – 12 November 2026
4 stories across 3 areas of the platform.
Alerts & Findings Management
Automatic alerts for expiring certificates and aging findings Major
All regions now raise alerts when a certificate is 30 days or 7 days from expiry, or already expired, and when an exposure or alert stays open past its aging threshold, with a weekly digest of what is aging. Certificates shared across several companies alert each affected organisation, and alerts stay open while the condition lasts, so teams can act before a lapse becomes an outage.
3 changes · 12 commits
New alerts for AI-confirmed high-risk exposures Update
Eight new alert rules fire only on findings that AI has confirmed, covering leaked APIs, document leaks, public cloud storage, impersonation, Telegram mentions, breached passwords, ransomware chatter and critical ports. Teams spend their time on confirmed, high-confidence exposures instead of triaging raw matches.
1 change · 7 commits
Compromised Credentials & Data Breaches
Card numbers masked across findings, exports and alerts Major
Card numbers in compromised-card findings now show only the first six and last four digits in lists, detail pages, the activity log, exports and alert notifications. Only team members with write access can reveal a full number, and every reveal is recorded in the activity log with who did it and when, so sensitive breach data stays usable without becoming another leak path.
3 changes · 11 commits
Vulnerability Detection
Next.js apps checked for React Server Components flaw Major
ShadowMap now flags exposed Next.js applications affected by the React Server Components remote code execution vulnerability, including affected React 19 apps where the version can't be read. Findings appear alongside the rest of your inventory, so you can see which internet-facing apps need attention without a separate lookup.
2 changes · 2 commits
Week of 30 October – 5 November 2026
10 stories across 10 areas of the platform.
Alerts & Findings Management
Assign findings and alerts to owning teams Major
You can assign findings and alerts to the teams that own them from list, detail and bulk-action views, and manage those teams in one place. Team ownership works alongside individual assignments, so work stays with the right group as people change.
2 changes · 5 commits
Application & Technology Inventory
Your technology inventory is deeper, cleaner and current Update
Technology fingerprints now identify the runtime beneath applications, platforms and frameworks, and each product appears once per asset under a single standard name. Every application is re-crawled on a 30-day rotation, and a searchable hidden-technologies section explains why each item is classified that way. Reports, filters and CVE exposure now reflect the real framework-and-runtime picture of your estate.
9 changes · 11 commits
Attack Surface & Asset Discovery
Discovery sees more of your exposed attack surface Major
Subdomain discovery now sweeps every in-scope zone, retries temporary lookup misses and filters catch-all DNS names, while scans cover 62 additional service ports, retry missed checks and add SNMP exposure. Hosts serving HTTP also surface their HTTPS counterparts, and SNMP exposure appears in your services view. Your inventory gives a fuller, more accurate picture of what is exposed to the internet.
11 changes · 15 commits
Compromised Credentials & Data Breaches
Credential exposure is fresher and covers more sources Update
Compromised-credential and breach matches arrive during high-volume ingest windows instead of waiting for the next cycle, and stealer-log records land complete with their original inputs. Thirteen audit-verified stealer-log channels are now monitored, with new sources added only when there is clear evidence of stolen credentials. Your exposure findings start from current evidence and cover more places where leaks are traded.
10 changes · 17 commits
Data Exposure
Large scans now finish and keep finding exposures Update
Large code-leak scans now run to completion rather than stopping at a set time limit, and exposure scans covering very large accounts keep running until the work is done. Every sweep delivers its full secret detection, takedown and leaked-document findings, so large estates no longer leave gaps in coverage.
2 changes · 3 commits
Platform & Access
Search everything from one bar with complete counts Update
Universal search now returns matching assets, technologies, vulnerabilities, exposed data and findings from a single query, and names any module it cannot query. CVE and asset counts show full totals and search responds faster, so you spend less time moving between pages and more time acting on results.
4 changes · 4 commits
SSL/TLS Certificate Monitoring
Find certificate risks across more exposed hosts Update
Hosts that only answer plain HTTP on port 80 are now checked on their matching HTTPS ports, so expired certificates, name mismatches, weak ciphers and deprecated TLS versions no longer stay invisible. Self-signed certificates are flagged in listings, a dashboard KPI, a detail view and an export, so teams can isolate applications that are not using a publicly trusted certificate.
2 changes · 7 commits
Scan Scope & Intensity Controls
Scans respect your windows and apply rule changes fast Update
Scanning holds off whenever a host is inside a no-scan window, even when the queue runs behind, and paused assessments resume automatically. Changes to rate limits, exclusions and other scan rules take effect within five minutes, and crawling and path search stay within the limits you set.
11 changes · 12 commits
Vendor Risk Management
Set vendor assessment depth and see the evidence Update
Every third-party vendor can be monitored at intel, vulnerability or deep depth, so heavier assessment effort goes to the most critical suppliers and lighter coverage stays on the long tail. Vendor Risk Management also shows the domains matched to each vendor and the original monitored values, so you can trace the evidence behind a vendor's risk picture.
4 changes · 7 commits
Vulnerability Detection
Vulnerability alerts focus on live, proven exploits Major
Known-exploited-vulnerability alerts stay tied to live, actively scanned assets, close when an asset is gone, and resurface for assets marked reviewed or closed when urgent risk remains. Detection now reports exact versions for Pulse Connect Secure, Argo CD and Magento and gives PHP hosts clear verdicts. Teams can prioritise remediation around proven exposure instead of noise.
16 changes · 43 commits
Week of 23 – 29 October 2026
8 stories across 8 areas of the platform.
Alerts & Findings Management
ShadowMap on your phone, with alerts that reach everyone Major
ShadowMap can be installed on a phone with a layout built for small screens, and opted-in users get push notifications for Critical and High findings, known-exploited vulnerabilities and SLA alerts. Default known-exploited, supply-chain and threat-intel alert policies now apply to everyone in a company with per-user opt-out, each policy sends one digest per run, and SLA alerts reach shared team mailboxes. You learn about a critical exposure on the device in your hand, without duplicate emails or a desktop.
29 changes · 63 commits
Application & Technology Inventory
A complete technology inventory, with versions and packages Update
Runtime, framework and CMS details are read from the responses your applications already serve, including hosts behind redirects and CDNs, with every detection pinned to the exact host that served it. Each technology appears once under a single standard name with real versions for frameworks, CMS and JavaScript libraries, and PHP is shown behind WordPress, Drupal, Joomla and similar platforms. A software package inventory lists the third-party components each application ships, so your technology estate is complete enough to prioritise patching and assess supply-chain exposure.
27 changes · 53 commits
Compromised Credentials & Data Breaches
Review and action breach findings per company Update
Breach findings can be reviewed, assigned and actioned separately for each company, with list views, exports, dashboard counts, reports and activity history reflecting your own decisions, and breach records carry the named executives affected. The Compromised Users list opens in a fraction of a second even for organisations with millions of credentials, and a Removed From Scope tab lists every entry hidden from the default view.
28 changes · 83 commits
Dark Web Monitoring - Forums
Complete, de-duplicated dark web intelligence from live sources Update
Victims published on every ransomware leak site we monitor now land in your dark-web exposure view with screenshots intact, and the same victim appearing across several feeds is merged into one record. Repeated and low-value post titles are collapsed, so the view shows each piece of intelligence once.
14 changes · 18 commits
Reporting & Exports
Reports and exports match what you see in the platform Update
Generated reports now contain exactly the findings that are open at the moment the report is produced, including Investigating items, with analyst-closed and AI-dismissed findings handled correctly, accepted risk disclosed as a count and breach totals counting only unresolved exposures. Spreadsheet exports with more than 26 columns keep every column and its formatting intact, and exported alerts, code repositories, buckets, IP reputation and vendor risk rows carry the same Netblock, Source, Assigned To and score values as the dashboard. Shared deliverables reconcile cleanly with what analysts see, so audits and customer reviews need no manual cross-checking.
11 changes · 14 commits
Scan Scope & Intensity Controls
Control exactly what gets scanned, and see what doesn't Update
Teams can create, edit and remove reusable scan profiles, download the whole set as an Excel workbook, and add priority subdomains in bulk so the hosts that matter most are scanned first. Exclusion rules are honoured end to end, and Asset Explorer lists the declared hosts your rules hold back with the rule responsible and the date it took effect, alongside hosts paused by an open no-scan window. Compromise scans respect the same exclusions and active-scan opt-outs, so results always match the coverage you configured.
20 changes · 40 commits
Security Ratings
Security ratings now measure the findings your scans produce Update
Each rating category, from Vulnerability Management and Application Security to Encryption, Email & DNS and Network Security, is now scored from the findings the matching scans actually produce, with the methodology published and grades recalculated so customers and vendors are compared on the same footing. Breach triage work your team records in the platform counts toward the score, and grade changes phase in across a ten-week weekly series so movement reads as a trend rather than a one-day jump. Recency adjustments also apply proportionally when all open findings are medium severity, keeping grades steady and proportionate.
11 changes · 19 commits
Vulnerability Detection
Urgent vulnerabilities surface first and are checked same day Update
Anything on CISA's Known Exploited Vulnerabilities list now sits at the top of the risk scale, including findings detected from scan patterns alone and results from third-party scan sources, and those alerts stay open until the asset is re-read at a remediated version. Newly published CVEs are checked against your in-scope assets on a nightly cadence, and a new known-exploited or maximum-severity CVE is checked the same day. Coverage reaches every monitored company, and edge appliances whose firmware version cannot be read are still included.
20 changes · 38 commits
Updates are grouped by area. Stories roll up a week of changes; a shipped feature may span several days of work.