docs: supply-chain incident intel (6.10.0)
- Supply-Chain-Scanning: new "The incident catalog (threat intel)" section
(sync command, the six knobs, what it adds, the three things it deliberately
does not do, and the honest scope note that this catches the browser-side
class rather than supply-chain attacks in general). Adds the two new project
toggles, the Incident column on the Verdicts sheet, and the ThreatPulse /
CONTACTS_MALICIOUS_HOST half of the graph model.
- Project-Settings-Reference: scaIntelCorrelationEnabled (default ON) and
supplyChainTyposquatEnabled (default off, gates only the fuzzy check).
- TrafficMind: the ioc flag chip and the per-user ignore list, including that
clearing the box restores the shipped list rather than disabling suppression.
- Red-Zone: Threat Intel now has a third kind of row (BaseURL / Contacted host)
and why the edge type keeps it from reading as "your host is an indicator";
the SCA Verdicts sheet gains the Incident column.
- Attack-Surface-Graph: the new relationship in the chain, typosquat as a
source_tool, and the incident_* properties.
- Recon-Pipeline-Workflow: what GROUP 5.5 now does beyond the OSV verdict.
docs: repoint remaining reorganization paths (blob URLs, deploy, scanners, kb, internal)
Absolute github blob/tree URLs and inline path references that still pointed at
the pre-6.9 top-level layout: readmes/ -> docs/readmes/, deploy/single-host ->
tooling/deploy/single-host, guinea_pigs -> testing/guinea_pigs, knowledge_base ->
services/knowledge_base, the scanner dirs -> scanners/<name>, and internal/ +
validation-benchmarks -> _local/.
docs: remove Tor/proxychains recon-routing references
The "route reconnaissance traffic through Tor" feature was removed from the
product. Scrub the wiki of the removed setting and its behaviour:
- drop the "Use Tor for Recon" project-setting rows (Creating-a-Project,
Project-Settings-Reference)
- delete the naabu and puredns "Tor / proxychains" paragraphs
- graphql-cop always runs --network host now (no -T / -x / HTTP_PROXY)
- reword masscan raw-SYN notes and stealth/preset copy to drop Tor framing
Kept: CriminalIP threat-intel "Tor/VPN/proxy" TARGET detection, PDCP
anonymous-mode API access, and captured tool --help in session transcripts
(all unrelated to the removed routing feature).