Implemented

🕵️ Fraud risk center: We said it was coming, and it shipped. The new view groups open vulnerabilities into Account Takeover, Data Harvesting, Payment Fraud and Fake Accounts, and shows only those reachable from the internet that affect confidentiality or integrity. 

When a risk is urgent, you can request priority remediation for one affected system or all of them, and the responsible contacts are notified right away. Available on Essential and Advanced plans through the new read-only Fraud Analyst role. Give it to your fraud-prevention team, not just AppSec.

🔑 Secret verification: Secret Scanning (SS) now tells you which credentials still work. Many detection rules include a verifier that asks the provider whether the secret is still valid, and it runs automatically. Active secrets are reported with a CVSS v4.0 vector ending in E:A, and unverifiable ones with E:U. 

Inactive secrets are dropped from the results and don't count toward the vulnerability count. Each check sends one request, only to the provider that issued the secret.

🎯 VLAI severity: Two vulnerabilities of the same weakness can carry very different risk, yet scanner results used to inherit a fixed severity from their weakness. Vulnerability Language AI (VLAI) reads the description and context of each vulnerability, rates it Low, Medium, High or Critical, and shows a confidence percentage. 

The score now appears for every finding across all manual and automated testing techniques in ASPM, so your team can focus on the vulnerabilities that really matter.

🌐 Group content language: When you change a group's content language, the platform now translates the content the group already has: findings, comments, reattack comments, evidence captions and reports. Everyone on your team can read the full history in the language they work in.

⚙️ New sub-processor: We've extended our AI infrastructure with a new provider, giving us access to leading open-source models. 

As part of our commitment to transparency in customer data management, we would like to inform you that we have engaged Fireworks as a sub-processor. For a full picture, visit our Trust Center.

Upcoming

🗺️ Discovery: An organization-level map of every asset you have, such as repositories and environments, both inside and outside Fluid Attacks' testing scope. Available as a paid add-on feature.

⚠️ Action required: Azure DevOps reauthorization 

Microsoft will deprecate the Azure OAuth credentials that use a legacy method on December 31, 2026. The platform already works with the modern method, and reauthorizing switches your integration to it. 

The credential owner must complete this process:

•  For Azure Credentials, go to Credentials, find and select the credential, click Manage Credentials, and then click Reauthorize. 
• For Azure Issues, go to Integrations, open Azure DevOps, find the group, and click Reauthorize.

 See Microsoft's documentation and our reauthorization guide.

⚠️Fluid Attacks call notice⚠️

Our education specialists may call your team members to provide onboarding and adoption support for new platform features. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember, your review can also be in Spanish.

Implemented

🦀 Rust and Elixir are here: We said they were coming, and they shipped. Rust now has 37 new SAST rules (injection, path traversal, SSRF, weak crypto, session and header misconfigurations), and Elixir now has 19 more alongside reachability analysis for Hex packages. Your Rust and Elixir services are now covered by the same detection depth as the rest of your stack.

🌿 Multi-branch testing: The same repository can now be registered in more than one group, each tracking a different branch with its own findings and testing scope. Teams running long-lived and short-term branches can finally test them in parallel instead of choosing one. See the registration rules.

🚁 Peer Reviewer Assistant, now on GitHub, plus secrets scanning: The assistant runs SAST, SCA and the Secrets Scanner on pull request diffs across GitLab, GitHub and Azure DevOps. Hardcoded credentials and many other types of weaknesses get caught in review, before they reach your default branch. Available for Advanced plan groups on cloud-hosted repositories.

🎯 Sharper prioritization: Every vulnerability in our Database now carries a VLAI severity rating (Critical to Low), a dynamic score generated by a machine-learning algorithm that reads each vulnerability's details. You can filter by it alongside CVSS and EPSS when prioritizing fixes. Real-world exploitation activity is now surfaced as Signals, and the filter panel supports include and exclude modes for CWE and weakness, so you can scope a view to what your team actually owns.

⏱️ Stronger service commitments: Our maximum initial support response time went from 16 to 8 business hours, and the availability SLA now explicitly covers the platform API, not just the web application.

Upcoming

🕵️ A view for fraud teams: Fraud teams will be able to see which of the vulnerabilities reported in their organization are fraud enablers, and request priority attention on them.

🗺️ Discovery: An organization-level map of every asset you have, such as repositories and environments, both inside and outside Fluid Attacks' testing scope. Available as a paid add-on feature.

🧠 More AI SAST coverage: Expanding to weakness types where automation previously meant false positives.

⚠️Fluid Attacks call notice⚠️

Our education specialists may call your team members to provide onboarding and adoption support for new platform features. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link!  Remember, you can write your review in whichever language you prefer.

We are pleased to announce a significant improvement to our platform, which will empower Organization Managers with greater access and control.

Previously, Organization Managers could only access the groups they were specifically invited to. This restricted their power to make strategic, high-impact decisions across the organization. Additionally, as new groups were created, they did not automatically gain access, creating friction in administration.

Now, when an Organization Manager is invited from within the organization, they automatically gain access to all existing and future groups. In addition, they are assigned Group Manager privileges in each group, ensuring consistency and complete control.

This enhancement streamlines the management process and ensures that Organization Managers have the necessary visibility and authority to effectively oversee all aspects of their organization and groups within our platform.

We've recently streamlined vulnerability management on our platform. The options to request reattacks and accept treatments are now conveniently located in a single drop-down menu called "Vuln. Management." This menu is in the top right corner above the table of each type of vulnerability.

To reattack vulnerabilities and verify the success of your team's remediation efforts, click Vuln. Management and then select Reattack. Next, from the table, choose the vulnerabilities you wish to reattack and click Reattack again.

If you need to stop this process anytime, just click the Cancel button.

We hope this change simplifies your workflow and makes vulnerability management more efficient.

We're pleased to announce a powerful new feature of our automated tool that becomes tangible in our platform's Supply chain section: Reachability.

The Supply chain section shows your application's affected and unaffected third-party dependencies. Now, you can more efficiently prioritize and address dependencies with security issues by knowing which ones have exploitable vulnerabilities.

Here's how it works:

• Focused analysis: Reachability, a feature working with SAST, analyzes your application's direct dependencies reported by our SCA to determine whether their known vulnerabilities are actually exploitable in your specific case.
• Clear prioritization: In the Supply Chain section, look for the "Reachable" tag in the Status column. If it's there, prioritize remediation efforts for those tagged dependencies.
• Detailed vulnerability insights: For each reachable security issue, you'll see the location of the vulnerability within your code and a link to the vulnerability table of the corresponding type. This will help you thoroughly understand the vulnerability and prioritize it effectively in relation to the other reported issues.
• Reduced noise: No more guessing games! Reachability cuts through the noise of potential vulnerabilities and highlights the ones that need immediate attention.

Currently supported languages:

• Javascript
• Typescript
• Python

Coming soon:

• Java
• C#

Start prioritizing your vulnerability remediation today!

Log in to our platform and explore the new Reachability feature in the Supply Chain section.

Implemented

⚠️ Date limit on calendar for vulnerability acceptance: Whenever you enter a date earlier than the current day or that exceeds the number of days allowed by your organization's temporary vulnerability acceptance policy, you will see a message reminding you of the permitted range.

📃 Improved downloadable SBOMs: The SBOMs you can export from our platform in CycloneDX and SPDX formats now have new information. Beyond the default fields, you can now see, for each third-party component: its location, the latest version, and the time since that release. In case of associated security issues, you can see: the affected version, CVEs, their severity, and EPSS.

✅ New webhooks: We have added a couple of webhooks that will notify you when an event or a vulnerability has been closed within one of your groups.

🎯 More accurate and eye-catching event reports: The events reported were only associated with roots. We now make these reports more precise by indicating which specific environments are affected by those events. Additionally, we have improved the presentation tables of roots and environments with visual elements that contribute to prioritizing the resolution of open events.

Upcoming

📡 Reachability analysis: We'll add a new feature to our automated tool to better understand the impact of vulnerabilities in your software supply chain. The reachability module will analyze the components and dependencies listed in the Supply chain section and determine if any reported vulnerabilities actually pose a risk to your application. Since vulnerabilities often only become a threat when specific functionalities are used in your code, this analysis will help you prioritize which issues need immediate attention.

⏩ From CVSS 3.1 to CVSS 4.0: Mark your calendars! From April 4, 2025, we'll only use CVSS v4.0 for all vulnerability reports. This change implies that the toggle switch for CVSS v3.1 will be removed, and all our platform's resources, including the CI Agent for breaking the build, will work merely according to the new CVSS version. The final step of this transition will be completed on October 4, 2025, when the API is fully updated.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link!

✨Make your voice heard in the AppSec world!✨

Share your thoughts on Fluid Attacks' solution on Gartner Peer Insights and get a $25 gift card! It will only take 10-15 minutes to help shape the future of the application security industry.

Implemented

📈 Custom vulnerability prioritization: In the Policies section of the platform, you have the Priority option to choose different criteria for prioritizing vulnerabilities. These criteria range from attack vectors and vulnerability exploitability to the various impacts that your systems could receive in a cyberattack. Each criterion can be rated according to its importance for your company, and this will be reflected in the values shown for each vulnerability reported in the new "Priority" column. This will allow your teams to promptly address the most significant risks.

⛓️ Supply chain section: This section shows your application's affected and unaffected third-party components and dependencies. Because some may pose a risk to your company while others may not, we decided to separate these elements and security issues from the rest of the findings to make it easier to prioritize them for treatment. Currently, you can view them as a complete list or filter them by repository under evaluation.

🔬 Docker image scanning and SBOM: No matter where you store your Docker images, our tool can scan them for security risks. As long as your registry supports standard authentication (username and password), you can easily import your images. Simply provide the registry URL and credentials, and our platform will report a detailed software bill of materials (SBOM) for each image in the Supply chain section, highlighting any known security issues.

☁️ CSPM environment role status: We recently implemented alerts for those cases where users revoke or delete access roles in the cloud (e.g., STS in AWS), roles that allow us to request tokens to scan their infrastructure resources with CSPM. Not having these alerts could mean mostly incomplete or delayed vulnerability scans. Now, for each CSPM environment within the Scope section that presents this problem, you will see the message “Role status: Error”.

Upcoming

📡 Reachability analysis: We'll soon implement a reachability module in our automated tool. It will analyze the components and dependencies we currently report to you in the Supply chain section to confirm whether their vulnerabilities are putting your application at risk. This is because many times vulnerabilities only pose risks when specific functions of such components or dependencies are used in your code. Therefore, this feature will significantly contribute to your prioritization of vulnerability remediation in third-party software.

⏩ From CVSS 3.1 to CVSS 4.0: Mark your calendars! From April 4, 2025, we'll exclusively use CVSS v4.0 for all vulnerability reports in the platform. This change implies that the toggle switch for CVSS v3.1 will be removed, and all our platform's resources, including the CI Agent for breaking the build, will work only according to this new CVSS version. The final stage of this transition will wrap up on October 4, 2025, when the API is fully updated.

Implemented

🤖 PHP security scanning: Our SAST tool has leveled up! It can now scan codebases containing PHP to identify vulnerabilities specific to this language. This enhancement expands our testing scope to help you deploy even more secure applications.

🔬 Docker image scanning and SBOM: Now, our automated tool can scan your Docker images, which you can import from any registry that supports username and password authentication with no specific registry restrictions. You only need to provide the registry URL and credentials. Then, you can see in the Supply chain section of our platform a detailed listing (SBOM) of each package contained in the Docker image, including security issues associated with them.

⛓️ Supply chain section: You can see your application's affected and unaffected third-party components and dependencies in this section. We separated these elements and security issues from the rest of the findings because some may pose a risk to your company while others may not, making it easier to prioritize them for treatment. Nowadays, you can view such components and dependencies as a complete list or filter them by repository under assessment.

Upcoming

🧩 Enhanced IntelliJ plugin: We recently implemented our IntelliJ IDEA extension and are improving some of its features. Currently, we are establishing links so your development team can go from the IDE to the platform to see specific findings or receive descriptions of vulnerabilities and suggestions for fixing them in IntelliJ.

⏩ From CVSS 3.1 to CVSS 4.0: Mark your calendars! From April 4, 2025, we'll only use CVSS v4.0 for all vulnerability reports. This change implies that the toggle switch for CVSS v3.1 will be removed, and all our platform's resources, including the CI Agent for breaking the build, will work merely according to the new CVSS version. The final step of this transition will be completed on October 4, 2025, when the API is fully updated.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link!

Implemented

🔄 Legacy filters: We are currently adding legacy filters in the Vulnerabilities section to align with attributes from the Locations section. The filters already implemented correspond to vulnerability locations and techniques with which we detect them. So, for example, from the first section, if you select the DAST option in the Technique filter, you will see all types of vulnerabilities that have at least one case identified using DAST. Consequently, when you access one of these types, the Locations section will display only those vulnerabilities detected with DAST.

🚯 Prevent file deletion: We have implemented a restriction to prevent the deletion of application files linked to specific environments. This allows us to avoid these environments from running out of valid files and becoming unmanageable. In cases where you want to delete files, you must delete the entire environment.

⛓️ Supply chain section: This new section shows your application's affected and unaffected third-party components and dependencies. Because some may pose a risk to your company while others may not, we decided to separate these elements and security issues from the rest of the findings to make it easier to prioritize them for treatment. Currently, you can view them as a complete list or filter them by repository under evaluation.

Upcoming

🔬 Docker image scanning: Very soon, our automated tool will be able to scan your Docker images. It will not only list the dependencies within the images but also notify the existing security issues, all in our new Supply chain section.

🧩 Enhanced IntelliJ extension: We recently implemented our IntelliJ IDEA plugin and are improving some of its features. Now, we are establishing links so developers can go from the IDE to the platform to view certain findings or receive descriptions of and remediation suggestions for vulnerabilities in IntelliJ.

⏩ From CVSS 3.1 to CVSS 4.0: Mark your calendars! From April 4, 2025, we'll exclusively use CVSS v4.0 for all vulnerability reports in the platform. This change implies that the toggle switch for CVSS v3.1 will be removed, and all our platform's resources, including the CI Agent for breaking the build, will work only according to this new CVSS version. The final stage of this transition will wrap up on October 4, 2025, when the API is fully updated.