What's New in Dino
Release notes and thoughts.
A refused credential or Target Connection now stops a scan before discovery and before any test request, and discovery can use the scan's credential. dino login --api-url signs in to that API and opens your browser. dino credential set no longer takes --har.
In this issue
- The runner settles its credential before it tests your API
- Discovery uses the scan's credential
- dino login --api-url signs in to that API
- dino credential set no longer takes --har
Past Dispatches
Dino findings in your GitHub Security tab, and an alert only closes when it was re-tested
dino scan --format sarif and the GitHub Action's format: sarif put API findings into GitHub code scanning. A partial scan carries untested alerts forward instead of closing them. Also: dino credential set, and the runner reports authentication for every scan.
Read more →dino verify tells your pipeline why it couldn't prove a result
dino verify ends in a declared exit code: 0 verified, 3 not proven, 5 the runner can't be verified yet, 2 the scan wasn't found. The npm package now installs with zero runtime dependencies and documents the whole CLI.
Read more →When Dino stops, it tells you whose problem it is
A mistake in your command or config now exits 2 or 5 with what to fix, never "Dino crashed". Tenant auth reaches every probe, a bad credential stops the scan instead of becoming a finding, and Dino reports fewer false findings.
Read more →dino diff meets your latest scan
`dino diff` now compares against your latest scan, macOS binaries are correctly code-signed, and new versions become available only once every download is ready.
Read more →From plan to proof
Dino now accounts for the full verification run: what it planned, what ran, what passed, what failed, what could not be verified, and the canonical evidence behind the verdict.
Read more →dino init, now driven by an agent
Headless `dino init`: an autonomous agent or a CI job can configure Dino end to end with zero prompts, one round-trip validation, and machine-readable results.
Read more →Accurate package metadata
Housekeeping: the npm package description and maintainer details now read correctly.
Read more →Linear-time output scanning
A hardening fix: Dino's output leak-check now runs in guaranteed linear time, closing a potential ReDoS flagged by CodeQL.
Read more →Output you can pipe, diff, and trust
Every command now separates the verdict from the noise: clean JSON on stdout, honest exit codes, and a permanent contract that keeps Dino's output machine-readable.
Read more →Onboarding, OAuth2, and REST everywhere
A one-step dino init with authenticated local tests, OAuth2 client-credentials, and full REST coverage across docs, watch, and change tracking.
Read more →Clean scan output
dino scan now prints only your report. Every spinner, notice, and engine log moved to stderr, so piping and redirecting a scan finally do exactly what you expect.
Read more →Dino CLI 1.0
The Dino CLI is now stable and generally available, with a hardened dino login and a committed versioning contract you can pin in CI.
Read more →Dino's one promise
Dino exists to tell you the truth about your API. 0.5.0 is the release where that became the thing everything else answers to.
Read more →The gap where API incidents hide
Most API incidents aren't exotic exploits, they're the slow drift between what your API promises and what it actually does. Here's where that gap hides, and how to close it.
Read more →Documentation Refresh
The docs catch up to REST: docs.usedino.dev and every README rewritten, plus the v0.4.1–v0.4.4 release-pipeline hardening rolled up.
Read more →REST API Scanning
Dino now scans REST end to end: OpenAPI discovery, 19 fuzz strategies across 6 attack surfaces, response validation, and a real --fail-on-high CI gate.
Read more →CLI UX Patch
Fewer mystery failures: dino init warns before a bad URL, and scan timeouts now tell you what to do. Plus the groundwork for REST.
Read more →Rich Terminal UI
An Ink-powered terminal UI with a real design system, an ESM bundle a quarter of the size, and a tag-based release pipeline. Node 22 required.
Read more →Zero-Config Scanning
Point Dino at an endpoint and it just works: resilient introspection, operations generated from the live schema, and clean, pipeable output.
Read more →Socket.dev remediation
A security housekeeping release: four Socket.dev supply-chain findings remediated, and npm audit back to clean.
Read more →First public release
Dino is on npm as @dino-hq/cli. Install it globally, point it at a GraphQL endpoint, and get a real quality report in your terminal.
Read more →