Changelog: July 15, 2026

[maekuss]

• Date: July 15, 2026
• Commit: df2c8ebd

Documentation TODOs

These shipped features still need docs. The changelog links only to pages that already exist - add or update these, then link them:

• Interactive taint trace reader: explain the step-navigation UI, how to jump between source/propagation/sink nodes, and what the annotated code view shows
• Findings export (UI): document the CSV/JSON/SARIF export buttons on the findings page and how active filters affect what is exported
• Findings export API endpoint: document GET /rest/findings/export - authentication, filter params (severity, state, scan_id, scan_type, repo_url, found_since/until), and response formats (CSV, JSON, SARIF)
• Bitbucket PR scanning: add Bitbucket to the integrations docs - OAuth connect flow, repository sync, and automatic PR scan setup
• Model tier selection: document the Default vs. Legacy model tier picker on the cost estimation step and what each tier means for scan quality and cost
• PR filter rules (authors and labels): document skip.authors, include.authors, and include.labels fields in .hacktron/config.yaml
• GitHub file-level comments: note in the GitHub integration docs that findings without a line number now post as file-level PR comments

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 262dfadfba

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Use the public export endpoint path

This advertises GET /rest/findings/export, but the public API docs define endpoints relative to https://api.hacktron.ai/v1 and the OpenAPI path is /findings/export (api-reference/introduction.mdx:10-16, openapi.json:544). In the public API context, readers will try /v1/rest/findings/export, which is not one of the documented REST paths; the changelog should point to GET /findings/export or the full public URL instead.

Useful? React with 👍 / 👎.