Every Burp feature, graded against our source.

Where the work is

One bar per functional area, ordered worst-first. Click an area to filter the register.

Recently closed

Gaps reconciled since the audit, newest first, each with the date and the commit that made it true. Showing the 24 most recent of 410 reconciled since the audit; the full set is in the capability table below.

• 76c583ff 2026-09-11 Save/Resume attack present → present
  Existing manual SAVE/LOAD/RESUME is retained. Project switch and clean exit now save automatically; restoration remains idle and pending rows still need explicit Resume. CLI adds save/load/reset.
• 2026-09-11 [A36] Authenticated scanning: session-handling rules (macros)
  HTTP authenticated scan workflows verified, including form CSRF replacement, compressed token extraction, refresh cooldown, request fidelity and project isolation. Browser login execution remains a separate gap.
• 2026-09-11 [A37] Out-of-scope handling during scans present → present
  Full outbound scope boundary, live policy updates, full-URL redirect/crawler checks and visible validation errors.
• codex/workspace-recovery 2026-09-11 Cookie jar and session rules persist in the project file / user settings across restarts absent → present
  Cookie jars and session rules persist per project. Cookie changes autosave every two seconds and after shutdown workers drain; session-rule edits save when applied. Failed workspace writes remain visible and block project switching. Transient extracted session variables are intentionally cleared when changing projects.
• 2026-09-11 Recorded login sequences (browser-recorded login replayed by the scanner) for authenticate
  HTTP authenticated scan workflows verified, including form CSRF replacement, compressed token extraction, refresh cooldown, request fidelity and project isolation. Browser login execution remains a separate gap.
• 63ecda0e 2026-09-11 Annotations: per-item Notes column and colour highlighting on Proxy history / any message partial → partial
  Project-persisted comments and nine highlight colours synchronize across browser clients, survive restart/index rebuild, and round-trip through HAR. API/CLI field patches reject stale history generations. Selected-item XML and branch HTML reports include escaped notes. Legacy browser notes have an explicit migration action.
• f24543d3 2026-09-11 Project files: Repeater tabs, Intruder attack config and Sequencer state saved in the proj absent → partial
  Intruder configuration and result rows persist per project on switch/clean exit and restore idle. Browser drafts survive stale polls; rules/grep settings synchronize and stale project edits are refused. Runtime, browser and CLI checks pass. Sequencer persistence remains outstanding.
• 63ecda0e 2026-09-11 HTTP history filter bar (in-scope only / hide items without responses / MIME / status / re
  Annotation persistence caveat removed; unrelated filtering gaps remain documented.
• 63ecda0e 2026-09-11 HTTP history annotations: per-item highlight colours and comments, plus filter-by-annotati partial → present
  Project-persisted comments and nine highlight colours synchronize across browser clients, survive restart/index rebuild, and round-trip through HAR. API/CLI field patches reject stale history generations. Selected-item XML and branch HTML reports include escaped notes. Legacy browser notes have an explicit migration action.
• codex/control-responsiveness 2026-09-11 Repeater: multiple concurrent request tabs
  The GUI/control Repeater runs one request at a time on a worker, preserving UI responsiveness and edits made during a send. Busy/Stop states are exposed; Stop prevents subsequent redirects after the current response. Browser mutations are serialized and stale polls cannot overwrite pending edits. Tabs autosave per project. Independent concurrent sends across multiple tabs remain unavailable.
• codex/workspace-recovery 2026-09-11 Repeater: tab state persisted in the project file and restored on reopen present → present
  Repeater tabs save per project every two seconds when changed, before project switching, and after shutdown workers drain. Failed writes retain the current project and retry. Per-tab request history remains a separate capability.
• 63ecda0e 2026-09-11 Site map filter — by MIME type (HTML/Script/XML/CSS/Other text/Images/Flash/Other binary), present → present
  Annotation persistence caveat removed; unrelated filtering gaps remain documented.
• 63ecda0e 2026-09-11 Site map / history annotations: per-item Comment and Highlight (six colours), used to driv partial → present
  Project-persisted comments and nine highlight colours synchronize across browser clients, survive restart/index rebuild, and round-trip through HAR. API/CLI field patches reject stale history generations. Selected-item XML and branch HTML reports include escaped notes. Legacy browser notes have an explicit migration action.
• 2026-09-11 Advanced scope control: per-rule Protocol (HTTP/HTTPS/Any) + Host-or-IP-range (regex) + Po present → present
  Full outbound scope boundary, live policy updates, full-URL redirect/crawler checks and visible validation errors.
• 75e12cb 2026-09-03 [B5] Issue suppression / false-positive marking absent → present
  Wave 0 register-accuracy audit: upgraded partial -> present. The 2026-08-17 entry closed the backend (/api/findings/mark, /suppress-kind) and left the Issues-UI buttons as a named follow-on; grepping ui-v2/app.jsx today shows that follow-on is already fully wired (per-finding fp/del buttons, a severity-override select, and a per-kind mute button), calling all four persisted mutation routes and rendering their returned flags -- parity.json simply never caught up to that landing. No code changed in this commit; this is a state correction only.
• 827ab9e 2026-09-03 Out-of-scope handling: Burp logs everything by default and prompts "stop sending out-of-sc present → present
  Closes the last remaining gap on this item (the prompt itself; the per-row marker and per-project persistence of the toggle were already closed in prior waves). Pure frontend: a client-side banner in ProxyTab (ui-v2/proxy.jsx) computed from state already in the reducer (scope, logOutOfScope, history rows) -- no backend change, no C++ build needed to verify. Verified by: babel transform of proxy.jsx succeeding, and a standalone functional test of the extracted hostInScope/loadOosPromptDismissed/saveOosPromptDismissed logic (in-scope/out-of-scope/wildcard host matching, and sessionStorage dismissal round-trip) against a stub window.sessionStorage, all passing.
• e4243e7 2026-09-02 HTTP history persistence + search at engagement scale present → present
  Follow-up: closed the metadata half of the eviction gap left over from the 2026-08-13 DB Search wave -- DetailPane's own selectedRow lookup (distinct from the DB Search overlay's self-contained flow) had no cold-storage fallback, so a row selected before eviction would silently drop out of view. Wired the previously-orphaned GET /api/history/full/<id> via a new NL.historyFullById() accessor. Verified: bundled-babel transform of ui-v2/proxy.jsx succeeds; Node functional test of the row-shape mapping (path->url mirroring, null-on-missing/error) and the rows.find-then-fallback selection logic (present row never triggers fallback, evicted id does, null selection short-circuits); backend read directly from source (control_server.cpp:4607-4639) to confirm the endpoint's field set and SQLite cold-storage fallback match what the frontend now consumes. No C++ build available in this cloud session -- backend code itself was not touched, only its consumption.
• 692664f 2026-09-01 Site map contents table columns: Host, Method, URL, Params, Status, Length, MIME type, Tit partial → partial
  Closed the Title and Extension halves of this gap: control_server.cpp's buildSnapshot() now parses a response's <title> tag (decoded body, 16 KB cap, first match) into a new `title` row field; ui-v2/proxy.jsx's HistoryTable gained Title and Ext columns (Ext via the existing pathExtension() helper). Comment-as-column, Cookies-as-column, and show/hide/reorder/sort/copy-column remain -- state held at partial, gap text narrowed rather than closed. CI confirmed green on 692664f (all 8 ci.yml jobs, including build-windows' full regression-test suite and build-linux/build-macos): https://github.com/Bikebrainz/Nullock/actions/runs/33526543362.
• 9defca8 2026-08-31 [A2] Crawl: automatic form submission / registration during crawl
  Wave 0 register-accuracy audit: held at stub. Re-verified crawler_logic.cpp:90-114 extractFormGets -- GET forms only (methodGet.match guard at :103), field NAMES turned into empty-valued query params (:111 `q += ... + n + "=";`), never a POST, never a filled value, no registration flow. Line numbers unchanged, content unchanged. No code change this pass.
• 9defca8 2026-08-31 [A10] Passive audit: DOM-XSS source/sink detection
  Wave 0 register-accuracy audit: held at partial. Re-verified passive_scanner.cpp -- the DOM-XSS sink block (line drift 1076-1099 -> 1188-1213) is still a static QRegularExpression table (innerHTML<-location, eval/setTimeout<-location, postMessage '*', eval-of-responseText) run over `scanBody.left(1MB)` when `html` is true (:1189), gated by `scanBody.size() < 1MB` (:1189). No live DOM taint tracking, no runtime-reached-sink coverage, no external-JS fetch. Claim holds; evidence line refreshed 1083 -> 1196.
• 9defca8 2026-08-31 [A20] Active audit: server-side code / EL / OGNL injection
  Wave 0 register-accuracy audit: held at partial. Re-verified ssti_tester.cpp -- the `{ "%{", "}", "OGNL (Apache Struts2)" }` family (:32) is present and wired exactly as described, giving an active OGNL/Struts2 confirm via the arithmetic-polyglot proof. Generic non-arithmetic server-side code-eval (SpEL class access, raw eval() APIs, OGNL member-access chains) is still not actively probed -- grep for SpEL/T\(java\.lang\.Runtime confirms no such family exists. Claim holds, no drift.
• 9defca8 2026-08-31 [A32] Scan launch modes (crawl-only/crawl+audit/audit-selected/live-passive)
  Wave 0 register-accuracy audit: held at partial. Re-verified control_server.cpp -- /api/crawler/start (:4722, was :3959) and /api/audit/run (:7802) / /api/audit/all (:7855, was :6513) remain three independent entry points; no code path feeds crawler output into runDeepAudit, no named launch-mode selector exists. Claim holds; evidence line numbers refreshed.
• 9defca8 2026-08-31 [A35] Retest an individual issue
  Wave 0 register-accuracy audit: held at partial. Re-verified control_server.cpp -- /api/baseline/save (:4853, was :4074) and /api/baseline/diff (:4926, was :4147) remain the only baseline-related routes; grep for `retest` across control_server.cpp and ui-v2/ returns no per-issue retest endpoint or UI action. Claim holds; evidence line numbers refreshed.
• 9defca8 2026-08-31 [A38] Scan speed vs accuracy tradeoff settings
  Wave 0 register-accuracy audit: held at partial. Re-verified control_server.cpp /api/audit/all -- throttleMs default 150 bounded 0..60000 and limit default 50 bounded 1..200 (line drift 6524-6527 -> ~7866-7869), sweep dispatched via QtConcurrent::run but the target loop itself is still a single serial iteration with QThread::msleep(throttleMs) between targets (no thread-count knob, no fast/normal/thorough accuracy presets). Claim holds; evidence line numbers refreshed.

Register

How this stays true

The data lives in docs/roadmap/parity.json and this page is generated from it by scripts/parity_report.py. When a commit closes a gap it updates that item's state and records the commit, then regenerates — and CI fails the build if the committed page has drifted from the data. The bar for calling something present is the same one the audit used: reachable by a real user, handling what Burp handles, verified by reading the code. An inflated roadmap would be worse than none, because it hides the work.