Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: Ghostwriter v7 is a major step forward for authentication and automation. This release replaces user-managed JWT API tokens with opaque credentials, introduces scoped service tokens for non-human integrations, and tightens how tokens are validated and used across the platform.
The result is a simpler, safer model for automation that opens up more possibilities for LLM-driven workflows, makes operation log utilities safer to deploy with narrowly scoped credentials, and makes token management much easier to understand in day-to-day use.
Introduction
We’re excited to share Ghostwriter v7.0.0! This release is all about making automation easier to use without asking you to trade away security. If you’ve been using Ghostwriter’s API tokens for scripts, integrations, or custom tooling, v7 brings a much cleaner model for managing those credentials. And if you’ve wanted a safer way to support non-human workflows, this release gives you first-class primitives for that.
The biggest shift is that Ghostwriter now separates user-bound automation from service-bound automation much more clearly. User-managed API tokens are now opaque credentials instead of JWTs, and service principals with scoped service tokens now provide a safer path for integrations that should not act as a full user. That includes narrow, purpose-built access patterns like operation log utilities and read-only project access.
Opaque API tokens make automation easier and safer
One of the headline changes in v7 is that user-managed API tokens are no longer user-managed JWTs. They are now opaque credentials …