Every Burp feature, graded against our source.

Where the work is

Start with the September 29 build follow-up for reproduced gaps, priorities and acceptance checks.

One bar per functional area, ordered worst-first. Click an area to filter the register.

Recently updated

Capabilities reconciled since the audit, including closed gaps and corrections, newest first. Each entry records its date and source or verification commit. Showing the 24 most recent of 410 reconciled since the audit; the full set is in the capability table below.

• 432ff192 2026-09-30 Repeater: per-tab request history with back/forward (< >) navigation through previously se present → present
  Refresh stale pre-history evidence and verify byte-preserving navigation. History is session-only; current-response persistence is separate.
• 432ff192 2026-09-30 Repeater: response "Render" tab (renders the HTML response) absent → present
  Refresh the obsolete claim that no renderer exists; state the static sandbox limit and corrected CRLF body extraction.
• 432ff192 2026-09-30 Repeater: message editor views — Pretty / Raw / Hex for both request and response absent → present
  partial -> present after native, live API, persistence and Chromium download verification. Current responses persist; past sends remain session-only. Hex previews 64 KiB and downloads retain all selected bytes.
• 432ff192 2026-09-30 Repeater: "Unpack gzip / deflate" in the response view present → present
  Keep compressed wire bytes separate from the inspection body and recognize valid empty compressed streams. Existing decompression limits and unsupported encodings remain unchanged.
• 0665e41b 2026-09-29 [A4] Passive audit: missing security headers (CSP/HSTS/XFO/XCTO/RP/Permissions-Policy/COOP present → present
  Hardened active and passive security-header parsing for repeated fields, fallback policies and malformed whitespace. Native regressions and pinned Chromium comparisons cover effective values. Existing capability remains present.
• b392a63b 2026-09-29 [A12] Active audit: reflected XSS present → partial
  Correct 66 browser/analyzer mismatches involving custom tag names, iframe fallback text and abrupt comment closure. Add 95 pinned-browser context comparisons and five public-API fixtures. Downgrade present to partial after separately reproducing template and SVG context gaps; those cases remain follow-up work.
• 784284db 2026-09-29 Proxy listener > Certificate > Generate CA-signed per-host certificate (per-host leaf mint present → present
  Declare leaf key identifiers explicitly so strict TLS clients accept LibreSSL-generated certificates. Runtime regression exercises real proxy HTTPS with strict validation enabled on every Python version.
• 4c44d3c0 2026-09-29 CA certificate: leaf caching across restarts
  Verify the current CA, private key and requested DNS/IP subject alternative name before disk-cache reuse. Strict HTTPS regressions cover wrong and missing SANs; focused checks retain valid DNS, IPv4 and IPv6 leaves.
• c2af0a33 2026-09-29 CA private key hardening on disk exceeds → present
  Reconciled against current source and focused CLI, application and browser checks. Correct stale behavior/evidence and state the remaining limits. Grade changed from exceeds to present.
• 697499b7 2026-09-29 Repeater: send a captured message to Repeater from other tools
  CLI file and stdin input preserve raw body bytes. Empty input clears the draft, omitted input preserves it, and invalid base64 is rejected before mutation. Existing missing tool pivots keep the grade partial.
• 927aed0e 2026-09-29 Repeater: out-of-scope send guard exceeds → present
  Rechecked the existing shared scope implementation and reran 41 live scope checks. Removed obsolete API-only and queued-tab-switch claims; use present rather than an unverified comparison-based exceeds grade.
• 99bfaf7f 2026-09-29 Repeater: headless / scriptable driving of the tool exceeds → present
  Verified the CLI through owned API fixtures and a real app: history IDs, asynchronous sends, Stop, binary file/stdin input and tab response state. Replaced stale defect descriptions and removed an unverified exceeds comparison. Empty requests and blank targets now fail explicitly; real-app CLI regressions cover both.
• c2af0a33 2026-09-29 Repeater: automatic "Update Content-Length" when the body is edited present → present
  Reconciled against current source and focused CLI, application and browser checks. Correct stale behavior/evidence and state the remaining limits.
• c2af0a33 2026-09-29 Repeater: cancel an in-flight request; non-blocking send
  Reconciled browser/API/CLI asynchronous sends and Stop, while recording the native QML synchronous-send path separately. Immediate socket cancellation and concurrent sends remain incomplete; grade stays partial.
• 76c583ff 2026-09-11 Save/Resume attack present → present
  Existing manual SAVE/LOAD/RESUME is retained. Project switch and clean exit now save automatically; restoration remains idle and pending rows still need explicit Resume. CLI adds save/load/reset.
• 2026-09-11 [A36] Authenticated scanning: session-handling rules (macros)
  HTTP authenticated scan workflows verified, including form CSRF replacement, compressed token extraction, refresh cooldown, request fidelity and project isolation. Browser login execution remains a separate gap.
• 2026-09-11 [A37] Out-of-scope handling during scans present → present
  Full outbound scope boundary, live policy updates, full-URL redirect/crawler checks and visible validation errors.
• 17d6c051 2026-09-11 Cookie jar and session rules persist in the project file / user settings across restarts absent → present
  Cookie jars and session rules persist per project. Cookie changes autosave every two seconds and after shutdown workers drain; session-rule edits save when applied. Failed workspace writes remain visible and block project switching. Transient extracted session variables are intentionally cleared when changing projects.
• 2026-09-11 Recorded login sequences (browser-recorded login replayed by the scanner) for authenticate
  HTTP authenticated scan workflows verified, including form CSRF replacement, compressed token extraction, refresh cooldown, request fidelity and project isolation. Browser login execution remains a separate gap.
• 63ecda0e 2026-09-11 Annotations: per-item Notes column and colour highlighting on Proxy history / any message partial → partial
  Project-persisted comments and nine highlight colours synchronize across browser clients, survive restart/index rebuild, and round-trip through HAR. API/CLI field patches reject stale history generations. Selected-item XML and branch HTML reports include escaped notes. Legacy browser notes have an explicit migration action.
• f24543d3 2026-09-11 Project files: Repeater tabs, Intruder attack config and Sequencer state saved in the proj absent → partial
  Intruder configuration and result rows persist per project on switch/clean exit and restore idle. Browser drafts survive stale polls; rules/grep settings synchronize and stale project edits are refused. Runtime, browser and CLI checks pass. Sequencer persistence remains outstanding.
• 63ecda0e 2026-09-11 HTTP history filter bar (in-scope only / hide items without responses / MIME / status / re
  Annotation persistence caveat removed; unrelated filtering gaps remain documented.
• 63ecda0e 2026-09-11 HTTP history annotations: per-item highlight colours and comments, plus filter-by-annotati partial → present
  Project-persisted comments and nine highlight colours synchronize across browser clients, survive restart/index rebuild, and round-trip through HAR. API/CLI field patches reject stale history generations. Selected-item XML and branch HTML reports include escaped notes. Legacy browser notes have an explicit migration action.
• c30a3eae 2026-09-11 Repeater: multiple concurrent request tabs
  The GUI/control Repeater runs one request at a time on a worker, preserving UI responsiveness and edits made during a send. Busy/Stop states are exposed; Stop prevents subsequent redirects after the current response. Browser mutations are serialized and stale polls cannot overwrite pending edits. Tabs autosave per project. Independent concurrent sends across multiple tabs remain unavailable.

Register

How this stays true

The data lives in docs/roadmap/parity.json and this page is generated from it by scripts/parity_report.py. When a commit closes a gap it updates that item's state and records the commit, then regenerates — and CI fails the build if the committed page has drifted from the data. The bar for calling something present is the same one the audit used: reachable by a real user, handling what Burp handles, verified by reading the code. An inflated roadmap would be worse than none, because it hides the work.