Website and documentation: every public page and documentation page was checked against the application and corrected. Exports are CSV (assets also as tab-separated text), workspace invitations are in-app rather than emailed, audit logs are append-only and are kept after a workspace or account is deleted, and the privacy policy now names the DNS, GeoIP, WHOIS, and AI providers Hawkra uses and the IP address and browser details stored with each terms acceptance.
Screenshots: new product screenshots on the home page, the Features page, and throughout the documentation.
Self-hosted docs: update instructions now use the real MASTER_ENCRYPTION_KEY name and image tags without a v prefix, note that Nmap must be reinstalled after the backend container is recreated, and the team management steps match the Add Member form.
CheatSheet: a new CheatSheet page in the top navigation lists ready-to-run connection commands for common services, with the target host and port filled in and one-click copy. It is free for every user. You can also click Connect on any open port on an asset to see the commands for that service with the asset's address already substituted.
Admin-managed catalog: admins curate the services and their commands under Admin > CheatSheet, and can export or import the whole catalog as JSON. New installs ship with SSH, HTTP, HTTPS, and Telnet.
Safe substitution: substituted hostnames and targets are shell-quoted, and the page leaves a command's placeholders unfilled rather than risk an unsafe paste.
Hawkra Host (self-hosted): every workspace now has a built-in WingSpan agent that scans from the Hawkra server itself. No download or approval is needed; click New Scan on the Hawkra Host row. It needs a Linux Docker host. Anyone who can edit a workspace can scan anything the server can reach, so read the WingSpan guide first.
Admin switch: Hawkra Host can be turned off under Admin > Settings > Scanning > Enable Hawkra Host Scanning. It is on by default.
Hardened scanner container: the Hawkra Host scanner runs with only the raw-socket capability, cannot gain privileges, and is capped at 256 processes.
Docs: the WingSpan guide was corrected. It previously described Nmap scanning and now covers WingSpan agents.
Security: fixes for sign-in, password reset and account verification. Updating is recommended.
Verification codes: a mistyped code can be corrected without starting over, and asking for a code again re-sends the same code, so the one already in your inbox keeps working.
Rate limits: if a code step is rate limited, you are returned to the login page with a clear message.
Recovery codes are accepted in upper or lower case.
Security: fixes for sign-in, MFA and account settings. Updating is recommended.
Changing your email now needs your MFA method and a code sent to the new address. You are then signed out everywhere, and the old address is notified.
Authenticator app users can now reset a forgotten password and confirm account changes, and the email MFA method can be removed from Account Settings.
Email addresses are no longer case-sensitive. If two accounts differ only by letter case, the newer one is renamed during the upgrade and the server logs a warning.
Maintenance mode: admins keep full access while it is on.
Self-hosted: public registration is now off by default, including on upgrade unless an admin turned it on. Enable it in Admin > Settings > Access Control. Unverified sign-ups no longer use licence seats and are removed after 24 hours.
Compliance: HIPAA, CMMC Level 1, and NIST CSF 2.0 assessments, tracked per objective.
TalonStrike: cleaner live output, a "thinking" indicator, and support for slower local AI models.
Faster sign-in when returning after being away.
MFA: "Remember this device" lasts 7 days by default and can be changed in Admin Settings.
MFA: admins can require MFA for all users; email can be used as an MFA method.
Licensing: a license that cannot be verified no longer stops the server; it shows as Invalid until a valid file is uploaded, and uploads keep a backup of the previous file. Signing-key rotation is supported.
Hawkra Cloud: subscription grace and suspension states, self-hosted license renewal from the account page, and consistent Premium-only gating of collaboration, compliance and chat.