What's new in mlab.sh

The domain scan now checks far more of a domain's surface, and the report reads every subdomain, not only the main site.

• DNSSEC is validated along the whole chain, not only detected.
• SPF and DMARC are evaluated the way receiving mail servers apply them, with spoofing protection rated as a whole.
• Every subdomain reachable on the web gets its own grade, with the known CVEs of the software it exposes.
• The AI and MCP surface of a domain is mapped, and security.txt is checked against the standard.
• Findings from every check are gathered in one list with an overall score, worst first.
• A report made by the earlier scanner says so and offers a new scan to fill in the missing checks.
• The full report is available from the API and the MCP integration; the previous format stays unchanged for existing integrations.

Organizations can now connect their Microsoft 365 / Entra ID tenant from the Infrastructure page. Tenant scans come next.

• A tenant administrator grants read-only consent to the mlab-scan app, in one step from Microsoft's own consent page.
• The tenant is tied to your organization when one of its verified domains is a domain you already proved on mlab.
• A tenant can only belong to one organization.
• Consent is checked daily, and the page shows when it has been revoked or a permission is missing.
• Owners and Admins can check a tenant on demand or disconnect it.
• Scans of a connected tenant are not running yet: connecting now gets you ready for them.

mlab.sh/engineering publishes long-form notes from the team: internal studies, benchmarks and the details behind how the platform is built.

• Every note starts with its method: data set, versions, hardware and how each number was measured.
• Notes show raw numbers and say where mlab does worse, not only where it wins.
• Charts are interactive, and each one can show the raw numbers behind it.
• Search the notes and filter them by tag; a filtered list keeps its own link, ready to share.
• The first note replays eleven public supply-chain attacks against postmortem and reads five large open-source projects by hand.

The URL lookup now weighs everything it knows into one score from 0 to 100, and shows the arithmetic behind it.

• Each URL gets a band (clean, suspect, high, critical) with every weighted reason listed, so you can see why.
• The domain's registration date is now checked live with its registry, even when the domain was never scanned.
• A brand-new domain behind a link now counts heavily in the score.
• When the registration date cannot be found, the page says the score rests on the URL alone instead of calling it clean.
• The same score is returned by the API, the MCP integration and exports.

A file report now opens on what the analysis found, worst first, before the raw output of each tool.

• YARA matches, remote templates, macros, packers, structural anomalies and high entropy are listed as findings, each with what it means.
• A file a reputation feed knows as malicious, or as known-good software, says so at the top.
• Identifiers like the imphash and PDB path are grouped apart, ready to pivot on.
• Files are now checked against a large, curated set of YARA rules.
• Many more checks now run on every file: what an executable can do (with its ATT&CK technique), DDE and Excel 4 macros, remote templates, active PDF content, shortcut command lines, encoded scripts, QR codes in images and phishing forms in HTML.
• When nothing was flagged, the report says it is an absence of signal, not a clean result.

The crypto lookup now shows why an address scores what it scores, and no longer calls an unknown address safe.

• Every reason behind the score is listed: which sanctions authority, which label.
• An address that is on none of our lists now reads Not enough data instead of a green 0.
• When the chain had to be guessed, the page says so next to the score.
• The API, the MCP integration and exports return the same score, with the same bands as email and URL lookups.

The SMS threat score has been removed. IOC extraction from text is unchanged and keeps every indicator it found.

• The IOC extraction API now returns the extracted indicators only: the risk and country parameters are gone.
• The smishing_risk tool is no longer available in the MCP integration.

Repository scanning now has its own home at code.mlab.sh, so it can grow at its own pace with more room for new scanners and integrations.

• Sign in to code.mlab.sh with your mlab.sh account: same organization, same members, same roles.
• GitHub and GitLab connections, scans, results, badges, exclusions and alerts all live on code.mlab.sh now.
• Your webhooks and activity log stay on mlab.sh.
• The Source code page in RedKit now points you to code.mlab.sh.

mlab.sh feels quicker everywhere, from the first page you open to the last report you read.

• Pages load fewer files, so they show up sooner.
• Faster navigation from one page to the next across the whole platform.

Tidier navigation and a lighter home page.

• Redkit now has its own link in the top bar.
• Every mlab platform sits in a single Platforms menu, grouped by governance, detection, attack surface and training.
• A new About page tells who builds mlab.sh and how we work.
• A lighter home page, with straight access to search and file analysis.

The search box on the home page dresses up for the right days of the year.

• Halloween, Christmas, New Year, Valentine's Day and Easter each bring a small animation.
• So do the days the security community celebrates: Data Privacy Day, Pi Day, April Fools', World Password Day and Sysadmin Day.
• Animations never get in the way of a search, and stay off if your device asks for reduced motion.

A new Settings tab on every repository page decides what its scans keep and when they reach you.

• Path exclusions: drop every result under paths like */tests/* or */fixtures/*, with * matching anything.
• Rule exclusions: drop an advisory or a rule you know does not apply, such as GHSA-xxxx or aws-access-key.
• Each scan says how many results your exclusions skipped, and links to them.
• Alerts: send a finished scan to your webhooks every time, or only when it finds something new at or above a severity you pick.

Findings you triaged keep their tags from one scan of a repository to the next.

• False positive, accepted risk and review later carry over to the same finding in the next scan, even when its line moved.
• An accepted risk is asked again when the finding climbs to high or critical. Fixed never carries over.
• New Review later tag on code scans and web audits, in the tag menu, the filters and bulk tagging.
• Code scan webhooks now list what is new since the previous scan.

Show in your README that a repository is scanned by mlab.sh.

• Off by default, turned on per repository, with the Markdown to copy.
• Shows the date of the latest scan, or an A to F grade if you choose. Never the findings themselves.
• Until you turn it on, the badge address reveals nothing about the repository.

Every source code scan now uses a RedKit credit, whatever started it.

• Scans on push, on connect and on a schedule count like the ones you launch by hand.
• Scan on push is now off by default, so a busy repository does not spend your credits on its own. Turn it on in the Automation tab.

Findings you tag as false positive or accepted risk now leave the score, and the result page gets the tools to work through a long report.

• False positives and accepted risks no longer count in the score, the posture dashboard, comparisons, the PDF or the recap email.
• Filter findings by tag, hide dismissed ones, tag a selection in one go, and export what you see as CSV or JSON.
• Run again, schedule, cancel or delete an audit from its pages.

Every RedKit list is easier to read and to act on.

• History: filters by type (code scans included), status and date, the grade of each audit, and a one-click comparison with the previous one.
• Posture dashboard: score trend since the last audit, a marker on stale audits, and the verified domains never audited.
• Scheduled scans: edit a schedule, run it now, and open its latest result.
• Source code: last scan per repository, and filters, tags and export on findings.

Your past lookups are paged, searchable and one click away from a case.

• Scan history and bookmarks: real paging, type filters, copy, bookmark and add a selection to a case.
• IP results show when they were fetched, with a re-check once a day.
• Reverse DNS names and resolved addresses on IP pages open their own lookup.
• Pasting several indicators into search offers to triage them in batch.
• Batch triage: filters, CSV export, file part of the results into a case, and look up every unknown indicator in one go.

Adding indicators to a case works the same way everywhere, with a search across your cases.

• Search your cases, open ones first, or start a new one without leaving the page.
• Case list: search, status filter and sorting. Case page: filter and search indicators, copy them, and see what mlab already knows about each.

More control over what your organization runs.

• API keys: rotate or rename a key, and see when and by whom it was created.
• Webhooks: change the URL or format, rotate the signing key, filter deliveries, replay every dead delivery at once, and copy a delivery ID.
• Audit log: filter by member and target, with paging and links to what changed.
• Team: search, filter by role and see when each member was last active.
• Infrastructure: filters, re-check every pending domain at once, and open an asset's lookup.
• Usage shows your plan's limits next to what you used.

Pasting defanged text into IOC extraction now returns the real indicators, instead of missing them or returning a wrong one.

• hxxp:// and hxxps:// links are recognised as URLs.
• A link written with [.] comes back whole: http://evil[.]example[.]net/x used to come back as http://evil, and is now http://evil.example.net/x.
• Addresses written with [at], hosts written with (.) or [dot] and ports written with [:] are read too.
• Indicators exported defanged from mlab.sh read back as themselves when pasted into the extractor.
• Applies everywhere indicators are pulled from text: the API, the text scan, shell script analysis and the AI assistant tools.