* fix: make archived log shard connections concurrency-safe and recoverable
* fix: build the WebSocket online table before its consumers start
* perf: cap stored payloads, index log lookups by IP and rule, batch IP tag writes
* fix: keep archived log shards readable when the live table gains a column
* feat: merge IP tag history when their database location changes
* refactor: move request payloads out of the access log into their own table
* feat: scope log database export to a time range and selected tiers
* feat: add an IP watchlist that full-captures watched IPs
* feat: split log storage into security events, access rows, and payload tiers
* feat: roll up requests per actor and path into daily analysis tables
* fix:actor key by ip
* feat: add a source and path analysis page over the daily rollups
* feat: exclude chosen source IPs from web log recording
* docs: add upgrade notes for the analysis page and log IP exclusion
* feat: derive the log partition from the time range and look up identifiers across all of them
* feat: add time partition verbs and the period naming they share
* feat: cut log archives per month and expire them by dropping partitions
* feat: manage log partitions, and answer why an IP has no logs
* fix: read archived SQLite log shards read-only and choose tiers by data
* fix: count the live log shard from access_log instead of a stale snapshot
* fix:export db bug
* fix: default backend keep-alive pool (512/128/90s) to stop connect-close churn under load
* chore: gen_swagger.bat outputs json only, syncs doc site, runs route test
* feat: pin web frontend version and embed it into the binary
Detection engine:
- Normalize request data (body, cookies, form and JSON values, request headers)
before inspection instead of only the URL query string, so encoded variants
are evaluated consistently.
- Extend XSS / SQLi / command-injection inspection to request bodies and to
custom request headers; bodies and headers are scanned per value rather than
as one blob to keep false positives low.
- Add a configurable body inspection mode (body_detect_mode: observe/block/off,
default observe) so the new deep checks record rather than block until an
operator confirms them, plus body_detect_field_exclude to skip fields that
legitimately carry rich text.
- Keep false positives down on the new paths: skip structured values, require a
corroborating signal before flagging body/header XSS, and leave dual-use
keywords out of the fallback lists.
- Path traversal is now normalized and judged on whether it escapes the site
root instead of matching literally; this also clears a long-standing false
positive on legitimate in-site relative paths. Adds a sensitive-file list.
- Scanner detection now covers all request headers and known probe paths.
Plugins:
- Suspend plugin loading pending signing and admission work. The code path is
retained but gated off, and shipped disabled by default.
Validated against a local test corpus and a 33k real-traffic benchmark:
detection improved across every category while the real-traffic false-positive
count stayed flat.
samwaf