Ryft ships continuous improvements — expect periodic feature and bug-fix updates throughout the year. Every release is listed here, newest first. Your license includes updates throughout your license year.
Smoother sends, projects that reopen exactly as you left them, clearer tabs, and a new JWT check.
Upgrades
Send-to now carries the whole request. Sending a request to the Fuzzer, Scanner, or Workbench brings the complete request with it — the full body and every header — so what you send is exactly what arrives.
Projects reopen exactly as you left them. Opening a saved project restores everything it holds: collections, environments, auth profiles, and workspaces.
Clearer tabs everywhere. Repeater, Fuzzer, and Scanner tabs are now named by endpoint path (e.g. “POST /v1/…/admin”), with long paths neatly collapsed so you can tell them apart at a glance.
Template variables read cleanly. {{variables}} show as written across tabs and target lists — no more %7B encoding.
New JWT check. The scanner now flags JWK-header injection — an attacker embedding their own verification key in the token header.
Sharper Reconstruct controls, resumable fuzzing, and a round of scanner and interface fixes.
New
Reconstruct — Refresh. A new ↻ Refresh button rebuilds the reconstructed API spec on demand as you capture more traffic and decode more client JavaScript.
Reconstruct — in-scope filter. Limit reconstruction to in-scope endpoints, so the rebuilt spec stays focused on your target instead of every host the browser touched.
Reconstruct — endpoint curation. Remove individual endpoints from the reconstructed set to keep the spec clean and deliberate.
SideCar — resumable runs. Start and Stop a fuzzing run and pick it back up where it left off, instead of restarting from zero.
Improved
SideCar results now render full-width, making long response bodies and wide result tables far easier to read.
Fixed
Scanner naming. Corrected labels in the scanner endpoint list and scan history for clear, consistent run and endpoint names.
Group-by dropdown. Fixed the Group-by dropdown so it no longer renders mis-sized.
The first public release of Ryft — the local-first API security bench that runs entirely on your machine.
Highlights
Global Session. Define a login recipe once, and every tool — scanner, proxy, fuzzer, Flows — tests as a logged-in user, with scope-gated tokens and automatic re-authentication when they expire.
Guided authenticated scanner. A wizard walks you through authenticated-by-default OWASP API Top 10 scans, so you test the API the way a real, logged-in client hits it.
GraphQL. GraphQL operations are first-class scan targets, including introspection and query testing, alongside REST.
Plus the full Ryft bench: an intercepting proxy & repeater, JavaScript and proxy intelligence, spec reconstruction, multi-credential BOLA, Flows, Cruise Control, a SideCar fuzzer, a JWT Lab, a headless CLI, and exportable reports — all running locally on macOS, Windows and Linux.
Updates arrive automatically: when a new version ships, Ryft shows an in-app update banner that links back to this page and the download.
