We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Inline Code Support

We already supported code blocks, but now, you can use @ symbols to create in-line code inside of your Dradis project:

Custom Tag Management

Previously, you could create custom tags by editing the XML of the project template directly. That’s still an option if you happen to enjoy dealing with XML. Otherwise, you can now use the UI for that whole process. There’s even a color picker so that you can get just the right shade for your custom tags.

From the project level, you can also manage your tags and create, edit, or delete them as needed:

Opt-in Usage Analytics

Prior to v4.7, we had no way to receive usage data from your instance other than a ping to our licensing server when you first activate the instance. In v4.7, we have rolled out optional usage analytics that you can share with us. Yes, optional!

For full transparency, you can see exactly what you would be sending to us in the event log. It’s all anonymized data like “someone exported a Word report” or “someone logged in as a contributor” that is designed to help us understand how teams are using Dradis and should not reveal anything sensitive, not even your email address.

Of course, you can always opt out of sharing this data with us if you prefer. We’re excited to have a bit more information about how you’re currently using Dradis so that we can make the product even better for everyone in the future.

Release Notes

• Configurations: Add usage tracking and sharing
• Content Blocks:
  • Add auto-caching
  • Add image upload button to source view toolbar
• Issues: Display the results from importers in a Datatable
• Rubocop CI:
  • disable EnforcedShorthandSyntax rule under Style/HashSyntax cop
• Tylium:
  • Add breadcrumbs to Revision History view
  • Add secondary sidebar toggling functionality
  • Remove Recent Activity tabs and add View History link to the dots menu
  • Tags: Add tag management
• Nginx:
  • Remove support for TLSv1.0 and TLSv1.1
  • Add support for TLSv1.3
• Integration enhancements:
  • Burp: Add support for large base64 response
  • Nessus: Clean up code tags in description fields
  • Netsparker: Add issue.classification_owasp2021 as a new avaiable field
  • JIRA: Fix configurations page requiring JIRA token
  • Remediation Tracker
  • Add a sidebar with a back link and info pane for contributors
  • Hide ticket actions from other addons for contributors
  • SAML: Fix assets on login for some providers
• Upgraded gems:
  • nokogiri, rails, rails-html-sanitizer, sanitize, sinatra
• Bug fixes:
  • Business Intelligence: Prevent tracking of discarded projects/teams in dashboard
  • Issues: Prevent multiple action cable subscriptions when going back to the issues table
  • Project: Pre-select the project template when project creation fails
  • Methodologies: Ensure params are validated when moving list/card
  • Issuelib: Avoid partial matches being found when importing tool output
• Reporting enhancements:
  • Word:
    • Add support for inline code
    • Ignore character properties inside Code paragraphs
    • Use ‘DradisData’ as sheet name for embedded chars
• REST/JSON API enhancements:
  • Author: Add author field for content blocks, notes, issues, and evidence

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Integration and Tool Manager

Now you can install and upgrade integrations (such as DuoWeb and Jira) and tools (such as the Gateway and the Remediation Tracker) directly in the Dradis application – no need to use ssh or the command line! Simply browse to the Integration and Tool Manager in Dradis v4.6, Get the tool, and then Enable it. Then you should be good to go!

Instance Dashboard

Want a better overview of what is going on in your Dradis instance after login? The new Instance Dashboard gives you an at-a-glance overview of Projects, Tickets, and Tasks assigned to you; a list of the newest unread notifications; and and overview of what’s new in the latest version of Dradis.

As a new feature, please do let us know if there are other things you would like to see or change on the instance dashboard once you start using it.

Permanently delete items in Trash

As of v4.2 of Dradis, you could soft-delete projects and teams so they end up in an Instance Trash. However, to permanently delete items in trash, you needed to use the command line. Not anymore! Now you can permanently delete items in Trash straight from the UI.

New Kits

We have long had a few templates and kits available for download at the Dradis Users Portal. We have overhauled some of these kits and made them available directly from the Dradis UI. Simply go to Templates –> Kit Upload, and either upload a kit file as you normally would, or click the Upload button under your preferred preinstalled testing kit.

Release Notes

• Dashboard: See active projects, notifications, assignments, and what’s new in one view
• Integration and Tool Manager: Add UI for installing and managing integrations
• Kits:
  • Add selection of kits to choose from
  • Enable import of kit with no templates
• Mintcreek: Adjust element contrast ratios to be WCAG 2.1 compliant
• Navbar:
  • Split the Addons menu into Integrations and Tools menus
  • Remove inaccessible addon’s menu items for contributors
• Notes: Remove category selection from form UI
• Projects: Update active projects empty state
• Trash: Delete projects and teams permanently
• Rubocop: lint changed files since previous commit
• Upgraded gems:
  • nokogiri
• Bugs fixes:
  • Comments: Align comment header content in Safari
  • Content Blocks: Fix revision history links
• New integrations:
  • Core Impact
  • Veracode
• Integration enhancements:
  • Implement enable/disable feature for Gateway, JIRA, Remediation Tracker, Scheduler, and VSTS
  • JIRA:
    • Add view for editing configuration
    • Hide link in addons menu for contributors
  • VSTS:
    • Add view for editing configuration
    • Issues: add WorkItem Status and Comment feed
• REST/JSON API: new v2 released
  • Projects: undiscard and permanently delete from trash.
  • Teams:
    • Undiscard and permanently delete from trash.
    • Deprecate the “/clients” endpoint, use “/teams”
    • Deprecate the “client_since” attribute, use “team_since”

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

CSV Importer

Dradis can now import CSV files into projects! Some vulnerability scanners produce output in CSV format rather than e.g. XML or JSON. You can now import these (and other) CSV files into Dradis, and configure which column to assign to which field in your Dradis projects on a per-file basis. Simply go to “Upload”, select the CSV importer, upload a file, and you will be redirected to an interface to assign data to fields. As with other plugins, you can create Issue, Evidence, or Node data and fields.

This is v1 of the CSV importer, so we look forward to your feedback on what works for you and what you would like to see in the future from this feature!

Note that for the sake of internal naming consistency, we have renamed the CSV exporter plugin with this change, so if you have the CSV exporter installed, you will need to reinstall the plugin as dradis-csv_export.

JIRA bulk send

Do you use our JIRA integration? If so, you can now bulk-send issues to JIRA. Simply select multiple issues from your project in the “All Issues” view, and click “Send to JIRA”:

That will send all your selected issues to the Dradis-JIRA interface. Pick the destination project, issue type, and other required fields for each item, and you’re done!

Bug fixes and quality-of-life improvements

Another focus of the v4.5 release is working through some bug reports and lower-level requests we have accumulated over time.

Bug fixes include multiple items relating to attachment validation and export, Node labels linking to external resources (so e.g. clicking on a Node label of “www.google.com” will no longer redirect you to Google instead of the Node in Dradis), and the Rules Engine matching against IssueLibrary entries without trailing empty lines.

Quality-of-life improvements include adding Revision History for Content Blocks and improved error messages in the Output Console on Word report export. Check our release notes for more detail!

Release Notes

• Content Blocks: implement Revision History
• Upgraded Dradis Pro to run on ruby 3.1.2
• Upgraded gems:acts_as_tree, bootsnap, bundler-audit, factory_bot, paper_trail, rails, rails-html-sanitizer, timecop, thor, unicorn, unicorn-worker-killer
• Bug fixes:
  • Attachments: Fix attachments not showing, validating, or exporting correctly
  • Evidence:
    • Add validation for creating evidences in the issue view
    • Set correct localStorage key to prevent pre-populating incorrect content at the issue level
  • Issue Library: Render colored badges in the Tags column of the entries table
  • Nodes: Prevent evidence labels linking to external resources
  • Rules Engine: Fix the Rules Engine not matching Issue Library entries with no trailing empty lines
• New integrations:
  • CSV Importer
• Integration enhancements:
  • JIRA:
    • Add support for datepicker custom fields
    • Add Bulk Send To support
    • Update JIRA setup instructions
  • Rules Engine: Prevent subsequent rules from running after a discard action
  • Qualys: Wrap ciphers in code blocks for the Vuln Importer
• Reporting enhancements:
  • CSV Export: Rename integration to dradis-csv_export
  • HTML Export: Add :rtp plugins feature
  • Word:
    • Fixes “-” in hyperlinks displaying HTML entity
    • Fixes duplicated relationship Ids when adding relationships
    • Fixes text with double exclamation marks breaking report
    • Show error message in export logs when populating multi-paragraph content in inline content controls
    • Show error message in export logs when removing invalid screenshots
• Security Fixes:
  • Medium: Authenticated author broken access control: read access to issue content

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Plugin Manager Validation

The Plugin Manager has new validation! Previously, you’d need a file like issue.txt to use when configuring the Plugin Manager. Now, you can simply associate the Plugin Manager with one of the report templates on your Dradis instance. You’ll see a validation check on the right that will tell you about any missing fields as you configure.

Rules Engine Population

Remember that after a tool file is uploaded, the data runs through the Plugin Manager, then hits the Rules Engine. So, we’ve also updated the Rules Engine so that when you build out new Rules, the Match Field trigger is populated with a dropdown of fields that matches what you configured in the Plugin Manager. No more double-checking field names, capitalization, or anything else like that.

Duplicate a Project

Want to start over with a copy of one of your existing projects? Previously, we had the project import/export feature that would work for this but the new Duplicate button streamlines the process significantly. For retests or just starting over with a copy of a project, just hit the Duplicate button and a new project will be automatically created that is identical to the old one.

Bulk Update Issues and Evidence fields

Have you ever run into a situation where you wished that you could edit multiple Issues or instances of Evidence at once? You can now! Just select multiple Issues or instances of Evidence:

Release Notes

• Login View: Design update
• Plugin Manager: Add ability to validate plugin templates with report templates
• Projects: Add ability to clone projects
• Tylium:
  • Implement bulk updating for issues/evidence fields
  • Improve mobile experience
  • Show the resource title in the header when viewing a resource
• Upgraded gems:
  • nokogiri, rack, sinatra
• Bugs fixes:
  • Cards: Prevent adding ‘card’ class to card comments
  • Login: Add button styles for 3rd party login addons
• Integration enhancements:
  • Rules Engine: Matching fields are now based on the fields defined in the Plugin Manager
• Reporting enhancements:
  • Word: Assign unique Word IDs to each element in the document.

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Auto-update Charts in Word

Previously, to include charts in Word templates, VBA macros were necessary to be able to update the charts in exported reports. This was a problem for the Mac users among us, as the relevant VBA is not supported in Office for Mac. We have now tweaked the reporting engine so that the source Excel sheets for charts in Word can be filled in with filters so they will auto-update during the export process from Dradis. The supported filters support the majority of use cases we have seen, such as issue counts by CVSS score, severity, type, category, host, etc.

Gateway comments

Do you use the Dradis Gateway? We have now improved this collaboration feature! Comments are already supported within Dradis projects, but now comments have reached the Gateway as well. If you are an Admin or Author on a project, you can choose to make a comment public (available on Gateway) or not (only visible to your team members within the project). Gateway contributors are able to view your public comments and submit their own comments on issues and other content inside the Gateway.

Qualys Asset Scans

Dradis now supports Qualys Asset Scans! This expands our Qualys coverage to include:

• Qualys Vulnerability Scans (Vuln)
• Qualys Web Application Scans (WAS)
• Qualys Asset Scans (ASSET)

Release Notes

• Comments: Show public comments for issues in a project
• Mintcreek: Add breadcrumb navigation
• Uploads: Allow subsequent file uploads from the same scanner without needing to re-select the scanner
• Upgraded gems:
  • nokogiri, rails
• Bugs fixes:
  • Document Properties: Set focus to property name/value inputs when clicking the edit icon
  • Editor:
    • Add keyboard shortcut support for windows and linux
    • Allow comparing document property values with “==” operator
    • Allow text selection expansion using shift-click
  • Issues: Show correct links in the “Send To” menu
  • Subscriptions: Show correct Subscribe/Unsubscribe link after a new comment is posted
  • Tables: Prevent columns state from resetting after 2 hours
  • Teams: Prevent displaying trashed projects
  • Tylium: Remove extra left padding from the first line of content in a code block
  • Upload: Show pre upload validation for Qualys
• Integration enhancements:
  • Openvas: Update Node label parsing. Include :hostname and :asset_id properties.
  • Qualys: Add Qualys Asset Scanner (ASSET) support
• Reporting enhancements:
  • Word: Charts in Word can now be exported without the need for macros
• Security Fixes:
  • Low: Password reset token can be reused in a 5-minute window

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Project Soft-Delete and Instance Level Trash

Previously, once you deleted a project or a team, it was gone forever! We have now added soft-delete and an instance-level trash. So, if you delete a project or team, you can find it in your instance’s Trash, and you can recover it from there.

Choose Which Fields to Display by Default in Projects

In recent versions of Dradis, new projects will display all fields for Issues and Evidence in their respective tables by default. This can lead to a cluttered view. You can update which columns to display, but this is stored on a per-project basis. Now, you can select which Issue and Evidence fields to display by default in the Report Template Properties for your project’s associated report template in Templates –> Reports. Simply switch the toggle to “Show” to whichever fields you want to display by default, and that will apply instance-wide from then on. Of course, if you have project-specific preferences, or if you have multiple people working on the same project but with different preferences of which columns to display, each user can still manually set their preferences on a per-project basis as before.

Improved Evidence Creation from the Issue Level

Dradis lets you add Evidence directly from Issues by going to the Evidence tab of an Issue and hitting the “+ New Evidence” button. Previously that only allowed you to add a blank piece of Evidence or adding a Note template with no customised content. Now, you can customise the content right in the “Add New Evidence” form and choose where to put it, including in new nested Nodes.

Release Notes

• Editor: Support fields with the same name in the Fields View
• Increased table loading performance on Issues, Evidence, and Notes for projects with a lot of issues, evidence, or notes
• Issues:
  • Display evidence in a table
  • Load evidence tab content asynchronously
  • Multi-delete evidence at the issue level
  • Update evidence content while creating evidence records at the issue-level
• Notifications Navbar Dropdown:
  • Improve font-sizes
  • Wrap long notifications links
• Projects:
  • Generate default report content when updating the report template
  • Truncate long team name badges in active project cards
• Report Templates: Add Show option to display certain evidence and issue fields by default in tables
• Trash: Allow projects and teams to be soft deleted
• Tylium:
  • Import CSS manifests from addons
  • Move ‘…’ (more actions) menu closer to the content affected by the actions of the menu
  • Move the ‘Edit’ action out of the ‘…’ (more actions) menu for issues, evidence, notes, etc.
  • Remove extra left padding from the first line of content in a code block
  • Remove height restriction from code blocks
  • Simplify issues table columns
  • Updates focus state outline color
• Upgraded gems:
  • mini_racer, puma, rails
• Bug fixes:
  • Comments: Show sticky toolbar when adding long comments
  • Issues: Send To menu updates when new plugins are installed
  • Fixes background services from not restarting after upgrades
  • Liquid drops: Allow author collection to be called in ProjectDrop
  • Methodology: Fix misformatted cards when saving a methodology as a template
  • Redirect back to issue when updating evidence from the issue level
  • Rules Engine: Allow authors with “update” permission to sort rules
  • Tables: Prevent the select all button from selecting filtered out rows when a filter is been applied
  • Subscriptions: Fixed a caching issue preventing users from subscribing or unsubscribing after the first cache was stored
• Integration enhancements:
  • Dradis Projects:
    • Fixes missing parent nodes during template and package imports
    • Fixes missing nodes for attachments during template and package imports
  • Gateway:
    • Bug fixes:
      • Fixes ‘authors’ call for the atlantia theme
      • Fixes missing attachments crashing Gateway
      • Select a default pane when Authors edit a Gateway project instead of loading a mostly blank screen
  • Nexpose:
    • Add the Hostname Node property from the name rather than site-name tag
  • Nipper:
    • Add Nipperv1 fields to issues
  • PDF Export:
    • Add Thor task for console export
    • Add view hook for Export#index
  • Qualys:
    • Add ‘element.qualys_collection’ as issue field
    • Add Qualys Web Application Scanner (WAS) support
  • Remediation Tracker:
    • Bug fixes: Hide the tickets’ “edit” and “delete” buttons for unauthorized users
  • SAML:
    • Add PingIdentity support
    • Add SAML logo to Log in button
    • Increases log verbosity on errors
  • Scheduler
    • No longers shows disabled projects in the calendar
  • VSTS:
    • Format issue content when sending to VSTS
• REST/JSON API enhancements:
  • Projects/Teams:
    • Discard Projects through the DELETE endpoint
    • Hide discarded projects/teams from endpoints
• Security Fixes:
  • Low: Authenticated author broken access control: read access to screenshots

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Move Evidence

Previously, you could only move Notes from one Node to another. Now, we’ve extended this behavior to Evidence as well. Have an instance of Evidence that actually belongs to a different Node? Just open the instance of Evidence, click Move (it’s in the 3 dots icon in the top right of the screen) and move it to the correct Node. That’s it!

Download Report Templates

Do you need to make a report template update or send us a copy of the report template? What happens if you didn’t create the report template to begin with or the template is old enough that you don’t even know where your local copy could be hiding? Previously, SCP was your only option to download a copy of a report template on your instance. Now, just head to Templates > Reports in the header and click the download button next to any report template to get your own local copy.

IssueLibrary Templates + Comments

IssueLibrary entries are great! But, creating them from scratch can be a pain without a format to work with. Now, when you create your IssueLibrary entries, you can select a Note template. No more blank page paralysis or trying to remember whether that field is called “Recommendation” or “Recommendations”, you can select your Issue template and just populate it with the data that you need.

Then, once your IssueLibrary entries are created, you can use comments to have a conversation with the rest of your team. Ask questions, offer suggestions, or just leave celebratory emoji comments! 🎉

Release Notes

• Contributors:
  • Create a new Team (optionally) when creating a new Contributor
• Editor:
  • Insert an appropriate single or multiline tag for blockquotes and code blocks
  • Limit the content height for easier access to the Create/Update button
  • Quote text from comments and resource content (cards, evidence, issues, notes, etc)
• Evidence:
  • Create a new issue (optionally) when creating new evidence
  • Move evidence across nodes
• Liquid drops:
  • Add available_properties method to DocumentProperties drop
• Projects:
  • Sort templates by title in project form
• Project Validation:
  • Add missing attachments validation for Textile screenshots
• Report templates:
  • Add functionality to download templates
• Report Template Properties validation
  • Disable bulk validation in Issues and Evidence tables if the “Validation” column is hidden
  • Move bulk validation in Issues and Evidence tables to a background job
• Tables:
  • Add selector to change the number of records displayed
• Tylium:
  • Import CSS manifests from addons
  • Remove height restriction from code blocks
• Upgraded gems:
  • brakeman, nokogiri, puma, rails
• Bugs fixes:
  • Account Lockout:
    • Send password reset instructions on account lockout
  • Conflict resolver
    • Apply the correct warning when a conflict happens on edit
  • Custom Properties:
    • Remove Custom project properties header in team show
  • Document Properties
    • Allow document properties to have a value and be nested at the same time.
  • Methodologies:
    • Ensure boards don’t nest when the instance has been inactive
  • Nodes:
    • Remove extra HTML tag causing the methodology tab to break after a board is added
  • Tables
    • Prevent columns state from resetting
• Integration enhancements:
  • CVSS Calculator:
    • Settings: show/hide the calculator in the Issues view
    • Toggle between CVSSv3.0 and CVSSv3.1
  • Dread Calculator:
    • Settings: show/hide the calculator in the Issues view
  • Gateway
    • Deliverables:
      • Allow macro enabled word and excel filetypes
      • Allow the CSV filetype
    • Projects:
      • Add “Created” and “Updated” columns to the Gateway projects table
      • Show theme versions when selecting a project theme
    • Themes:
      • Atlantia:
        • Check for the existence of document properties before rendering the value
        • Remove newlines from issue titles
        • Show untagged issues
        • Wrap text in code blocks
    • Bug fixes:
      • Allow Authors to enable their own projects for Gateway
  • Issue Library:
    • Add comments to entries
    • Add subscriptions to entries
    • Create entry from note templates
    • Notify users of updates
  • Jira:
    • Bugs fixes:
      • Issue form: Prevent app from crashing when submitting without project or issue type
  • Nessus:
    • Add product_coverage & cvss3_impact_score as available Issue fields
  • Nexpose:
    • Update HTML tag cleanup to better cover UnorderedList and URLLink tags in the solution field
  • Qualys:
    • Add dd, dt support
    • Remove orphaned b tags
  • Remediation Tracker: Tickets: Create new categories and states (optionally) when creating new tickets
• Reporting enhancements:
  • Word:
    • Adds EvidenceCounter controls support to not nested in an Issue controls
    • Fixes exporting with missing attachments
    • Fixes invalid predicate error by escaping control characters in XML attributes
    • Fixes links inside inline controls
    • Fixes numeric values for non-range filters
    • Fixes “frozen string” error when exporting nodes without a services table
    • Move image captions to their own paragraph
• Security Fixes:
  • High: Authenticated author broken access control: read access to issue content

Not using Dradis Pro?

We’re heading to Singapore for Black Hat Asia 2025, and we’ll be showing off the latest in streamlined reporting and collaboration at our Dradis Arsenal demo. We’re excited to be part of the Black Hat Arsenal, demoing how Dradis helps security teams collaborate and report more effectively.

Catch us here:

🧪 Dradis @ Black Hat Arsenal  
Business Hall – Arsenal Station 3
📅 April 3, 10:05am-11:20am

Learn how our most recent updates—which include in-app quality assurance workflows, easier deployment with Docker, and AI-driven enhancements—allow for the creation of reports faster and with greater quality.

📍 See our Arsenal session

When we’re not presenting, we’ll be diving into the briefings, trainings, and executive summits across AI, exploit development, cloud, and physical infrastructure. Here’s what we’re most excited about.

Gateway Themes

One of the biggest changes in Dradis Pro v.4.0 is the move from a single HTML Gateway template to Liquid themes. Create a dynamic, info packed, theme to deliver assessment results dynamically in Gateway using Liquid. Multiple Gateway themes means each project can use a different theme that’s appropriate to the engagement. Two new Gateway themes are included with Dradis Pro v4.0 to get you started.

Liquid has a well supported and documented history for creating robust templates. This will make it easier for teams to create and support their own well organized, customized templates.

Are you currently using a customized Gateway HTML template? Reach out to our team with your existing template so we can help convert it to Liquid before you upgrade any production instances.

Downloadable Assets

In addition to reviewing the results of an assessment dynamically in Gateway, contributing users can securely download assets that have been added to their project. Deliver final reports, scope documents, and other assets directly from Gateway keeping everyone out of their inboxes and project details centralized.

Simple Team Setup

Getting started using Dradis Pro is simple. Once deployed to your environment, the super-admin for the instance is created during the first run and can quickly set up the rest of the team through this new guided walk-through.

Maximum Login Attempts

Configure the number of maximum login attempts to help prevent brute-force attacks on your Dradis instance. The default is set to 3 attempts before the account is locked. Admins can increase or decrease the number of attempts to align with their team’s policies.

Release Notes

• Projects:
  • Cleanup the New/Edit view
  • Create and remove the results portal from the Edit view
  • Dashboard: Add Default issue entry to menu when project is empty
  • If there is only one RTP, select it by default
• Setup: new initial Team and User wizard
• Teams: cleanup the New/Edit view
• Users: account gets locked after too many failed sign in attempts
• Upgraded gems: addressable, nokogiri, papertrail, puma
• Bugs fixed:
  • Better support for characters inside textile linked text
  • Display placeholder text for issue sorting dropdown when no field has been selected to remove confusion about default options that are not yet applied
  • Fix issue library entries action buttons not appearing due to caching
  • Fix revisions with “destroy” event not removed from the database after deleting a project
• Integration enhancements:
  • Acunetix:
    • Add support for Acunetix 360
    • Make Request and Response fields available at the Evidence level
  • Gateway 🍾
    • Moved project contributor assignment to Gateway management
    • Deliverable upload management
      • Your contributors can now download assets directly from your results portal!
    • Themes!
      • Gateway now supports theme management and the ability to apply different themes to different projects
  • IssueLib entries#index API now supports pagination
  • Nessus:
    • Add age_of_vuln, exploit_code_maturity, threat_intensity_last_28 threat_recency, and threat_sources_last_28 as available Issue fields
  • Nexpose:
    • Update HTML tag cleanup
  • Nipper:
    • Include multiple paragraphs when importing fields.
  • Remediation Tracker
    • Use Datatables for the Tickets#index table
• Reporting enhancements:
  • Word:
    • Add support for template syntax within resources exported in Word reports
    • Fix exporting node labels with links
• REST/JSON API enhancements:
  • Update the API to handle pagination
• Security Fixes:
  • Medium: Authenticated (contributor) information disclosure
    • After a contributor was assigned Gateway access to a project by an admin user they may retain access to the project after the projects team has been changed.

Not using Dradis Pro?