Implemented

🕵️ Fraud risk center: We said it was coming, and it shipped. The new view groups open vulnerabilities into Account Takeover, Data Harvesting, Payment Fraud and Fake Accounts, and shows only those reachable from the internet that affect confidentiality or integrity. 

When a risk is urgent, you can request priority remediation for one affected system or all of them, and the responsible contacts are notified right away. Available on Essential and Advanced plans through the new read-only Fraud Analyst role. Give it to your fraud-prevention team, not just AppSec.

🔑 Secret verification: Secret Scanning (SS) now tells you which credentials still work. Many detection rules include a verifier that asks the provider whether the secret is still valid, and it runs automatically. Active secrets are reported with a CVSS v4.0 vector ending in E:A, and unverifiable ones with E:U. 

Inactive secrets are dropped from the results and don't count toward the vulnerability count. Each check sends one request, only to the provider that issued the secret.

🎯 VLAI severity: Two vulnerabilities of the same weakness can carry very different risk, yet scanner results used to inherit a fixed severity from their weakness. Vulnerability Language AI (VLAI) reads the description and context of each vulnerability, rates it Low, Medium, High or Critical, and shows a confidence percentage. 

The score now appears for every finding across all manual and automated testing techniques in ASPM, so your team can focus on the vulnerabilities that really matter.

🌐 Group content language: When you change a group's content language, the platform now translates the content the group already has: findings, comments, reattack comments, evidence captions and reports. Everyone on your team can read the full history in the language they work in.

⚙️ New sub-processor: We've extended our AI infrastructure with a new provider, giving us access to leading open-source models. 

As part of our commitment to transparency in customer data management, we would like to inform you that we have engaged Fireworks as a sub-processor. For a full picture, visit our Trust Center.

Upcoming

🗺️ Discovery: An organization-level map of every asset you have, such as repositories and environments, both inside and outside Fluid Attacks' testing scope. Available as a paid add-on feature.

⚠️ Action required: Azure DevOps reauthorization 

Microsoft will deprecate the Azure OAuth credentials that use a legacy method on December 31, 2026. The platform already works with the modern method, and reauthorizing switches your integration to it. 

The credential owner must complete this process:

•  For Azure Credentials, go to Credentials, find and select the credential, click Manage Credentials, and then click Reauthorize. 
• For Azure Issues, go to Integrations, open Azure DevOps, find the group, and click Reauthorize.

 See Microsoft's documentation and our reauthorization guide.

⚠️Fluid Attacks call notice⚠️

Our education specialists may call your team members to provide onboarding and adoption support for new platform features. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember, your review can also be in Spanish.

We've extended our AI infrastructure with a new provider, giving us access to leading open-source models.

⚙️ New sub-processor: As part of our commitment to transparency in customer data management, we would like to inform you that we have engaged DeepInfra as a sub-processor. DeepInfra hosts the open-source AI models. For a full picture, visit our Trust Center. 

Implemented

🦀 Rust and Elixir are here: We said they were coming, and they shipped. Rust now has 37 new SAST rules (injection, path traversal, SSRF, weak crypto, session and header misconfigurations), and Elixir now has 19 more alongside reachability analysis for Hex packages. Your Rust and Elixir services are now covered by the same detection depth as the rest of your stack.

🌿 Multi-branch testing: The same repository can now be registered in more than one group, each tracking a different branch with its own findings and testing scope. Teams running long-lived and short-term branches can finally test them in parallel instead of choosing one. See the registration rules.

🚁 Peer Reviewer Assistant, now on GitHub, plus secrets scanning: The assistant runs SAST, SCA and the Secrets Scanner on pull request diffs across GitLab, GitHub and Azure DevOps. Hardcoded credentials and many other types of weaknesses get caught in review, before they reach your default branch. Available for Advanced plan groups on cloud-hosted repositories.

🎯 Sharper prioritization: Every vulnerability in our Database now carries a VLAI severity rating (Critical to Low), a dynamic score generated by a machine-learning algorithm that reads each vulnerability's details. You can filter by it alongside CVSS and EPSS when prioritizing fixes. Real-world exploitation activity is now surfaced as Signals, and the filter panel supports include and exclude modes for CWE and weakness, so you can scope a view to what your team actually owns.

⏱️ Stronger service commitments: Our maximum initial support response time went from 16 to 8 business hours, and the availability SLA now explicitly covers the platform API, not just the web application.

Upcoming

🕵️ A view for fraud teams: Fraud teams will be able to see which of the vulnerabilities reported in their organization are fraud enablers, and request priority attention on them.

🗺️ Discovery: An organization-level map of every asset you have, such as repositories and environments, both inside and outside Fluid Attacks' testing scope. Available as a paid add-on feature.

🧠 More AI SAST coverage: Expanding to weakness types where automation previously meant false positives.

⚠️Fluid Attacks call notice⚠️

Our education specialists may call your team members to provide onboarding and adoption support for new platform features. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link!  Remember, you can write your review in whichever language you prefer.

Implemented

🪎 Improved AI SAST scanner: We have expanded the scope of our AI SAST to cover more types of vulnerabilities (weaknesses) for which automation was not previously possible without introducing false positives:

• Privilege escalation
• Improper authorization control for web services
• NoSQL injection

This improvement allows us to further reduce the time it takes to detect vulnerabilities.

🔎 Secret scanning: We have implemented and are optimizing a new secret scanner. On the platform, you can view vulnerabilities reported using this technique by applying the "SS" filter (see our database as well).

✌🏼 Enhanced IDE plugins: First, we've enabled SCA Autofix. Support is available for JavaScript and Python, and their following package managers: npm, Yarn, Bun, pip, Poetry, Pipenv, and uv.

Second, we've standardized the features across VS Code and IntelliJ, so you can now perform the same actions in both IDEs.

🎯 Accuracy SLAs in ASPM: We have enabled the display of accuracy SLAs on the platform. Specifically, in your organization's view, you can track our progress toward meeting these SLAs.

⚙️ New sub-processor: As part of our commitment to transparency in customer data management, we would like to inform you that we have engaged Refiner as a sub-processor. For a full picture, visit our Trust Center. 

Upcoming

🔡 Support for new languages: Elixir and Rust.

🚁 Peer Reviewer Assistant on GitHub.

🌳 SCA: We are working on supporting language runtimes for vulnerability detection. 

⚠️Fluid Attacks call notice⚠️

Our education specialists may call your team members to provide onboarding and adoption support for new platform features. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember, your review can also be in Spanish.

Implemented

🎓 Enterprise-grade security and compliance certifications: Fluid Attacks obtained ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certification, controls aligned with ISO/IEC 27017:2015 and ISO/IEC 27018:2019, a SOC 2 Type II attestation and SOC 3 report, PCI DSS v.4.0.1 validation, and measures designed to support GDPR compliance.

🪽 Migrate platform authentication to Auth0: We replaced in-house Google, Microsoft, and Bitbucket authentication flows with Auth0, removing the need for one-time passwords (OTPs) to log in to the platform and generate reports, thereby providing a simpler authentication experience.

⚙️ Two new subprocessors: As part of the previous implementation, we now use Auth0 as a subprocessor to manage user identities, ensure secure logins and token-based access control, and store user profiles and credentials. In addition, we use the AI-powered platform Iru, which unifies identity and access management, endpoint security and management, and compliance automation.

Upcoming

🌳 SCA Autofix from VS Code and IntelliJ extensions.

🔡 Support for Rust as a new language, with full coverage: vulnerability detection, package managers, reachability, and fixes.

🎯Accuracy SLA on the platform for Advanced plan customers.

✌🏼 Two new security testing techniques: Secret scanning and DAST API.

⚠️ Fluid Attacks call notice ⚠️

Our education specialists may be calling your team members to offer onboarding and adoption support for new features on our platform. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨ Have 10-15 minutes to spare? ✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember, your review can also be in Spanish.

🌳 Extended Custom Fix in IDE for vulnerable dependencies: In our VS Code extension, from the Custom Fix panel, you have two types of update suggestions for third-party software packages to address vulnerabilities identified by our SCA:

• Safe update: Implements the next available version of the package that fixes the reported vulnerability without introducing new ones.
• Complete fix: Implements the next available version of the package with no known vulnerabilities.

📡 Percentage of attack surface coverage: At the top of your organization’s groups section on our platform, you can see what percentage of your repositories are being covered in our assessments, how many are out of scope, and a summary of vulnerabilities reported across all your groups.

🗃️ Improvements to the Lines table: The Lines table in the Inventory section now includes two new columns: “Supported” and “Tested.” The former lets you know whether Fluid Attacks supports the language of the file in question, and the latter indicates whether that file has already passed any of our automated tests.

🔙 Two rolled-back deprecations: We had previously announced that Docker image scanning and CSPM testing for all cloud providers would be deprecated. However, we ultimately decided not to proceed with the former and to keep CSPM available only for AWS. Therefore, you can resubmit these types of assets for our security assessment.

❌ Redundancy elimination in VS Code: Our VS Code and Cursor plugins automatically detect the active repository, so they do not display a pop-up window asking you to select the repository to scan.

🌱 New documentation site: All Fluid Attacks documentation is now available in one place: docs.fluidattacks.com.

⚠️Fluid Attacks call notice⚠️

Our education specialists may be calling your team members to offer onboarding and adoption support for new features on our platform. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember, your review can also be in Spanish.

Implemented

🔧 Smarter package update recommendations: We used to show you a single fix per package. Now you get three options so you can pick the right trade-off for your situation:

• Minimal fix: Patches the reported vulnerable part but may introduce new vulnerabilities.
• Safe update: Patches the vulnerable part without introducing new ones.
• Complete fix: Is the closest version that is entirely free of known vulnerabilities.

This works for both direct and transitive dependencies. For the latter, we show you which direct package pulls in the vulnerable dependency, along with the three remediation versions regarding the transitive dependency, so all you need to do is verify parent compatibility or bump it to the minimum supported version.

Need help understanding this and other features we're bringing? Meet with our Education Specialists for guidance.

✨ Already enjoying AI SAST? Our AI-powered scanner is already finding critical vulnerabilities in groups subscribed to the Advanced plan, with over 90% precision. It does multi-file analysis and works for all our supported languages. Now is the time to update to this plan and start getting those reports!

🤖 Remember to use our Peer Reviewer Assistant: Get it now to comment on GitLab or Azure DevOps merge/pull requests, right on the lines that need attention. This way your team can quickly understand how secure your contribution is. Also, if your team requires all comments to be resolved before merging, it becomes a security gate. 

📦 New package managers supported: We added support for CocoaPods (Podfile parser), Bun, and RubyGems (.gemspec).

🧭 CI Gate setup moved to DevSecOps: The CI Gate token management and installation guide have been relocated from Scope to DevSecOps.

📱 MAST technique in the platform: Findings in mobile apps that were previously marked as 'DAST' are now reported as 'MAST'.

🎨 Severity icons in IntelliJ sidebar (IDE plugin): The IntelliJ plugin sidebar now shows severity icons next to the name of reported weaknesses, so you can compare them more easily.

🔐 More login options for docs and DB: You can now sign in to these websites with Google, Microsoft, LinkedIn, and Bitbucket.

Upcoming

🛠️ New package update options in your IDE: The three fix options we just shipped on the platform will soon be available directly from your IDE.

📚 Embedded library excluded: Our SCA scans depend on libraries being versioned through package managers. If a library's source code is embedded directly in your codebase (i.e., copy-pasted rather than installed as a dependency), it falls outside SCA's detection scope. We'll be reaching out to affected clients to coordinate the necessary adjustments.

Upcoming deprecations

🐳 Docker image scanning: Read the rationale here.

Key info:

• Final deprecation date: March 31
• No action required.

☁️ CSPM (AWS, Azure, GCP): Read the rationale here.

Key info:

• Final deprecation date: March 31
• No action required.

📱 Move now from APK to MAST image: Read the rationale here.

Key info:

• Final deprecation date: April 30
• Use MAST image instead of APK image.

⚠️Fluid Attacks call notice⚠️

Our education specialists may be calling your team members to offer them onboarding and adoption of new features on our platform. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember your review can also be in Spanish.

Catching vulnerabilities after a merge is no fun. We have developed a new way to prevent you from injecting them in the first place. Fluid Attacks' Peer Reviewer Assistant spots vulnerabilities during code review and posts SAST and SCA findings as inline comments on your MR/PR, right on the lines that need attention. Reviewers see exactly what vulnerabilities a change would inject, so they can approve or reject with full context. Our Assistant won't block merges on its own, but if your team requires all comments be resolved before merging, it effectively becomes a security gate.

Comments show the security vulnerabilities with a link to our docs, which include recommendations. No separate dashboard to check: The alerts land where you're already at.

What it catches and how:

• SAST scans the changed files for vulnerabilities in your own code.
• SCA checks your dependencies in the same diff.
• Each finding tells you where (file path), what (suggested weakness title), and which line, so reviewers can make informed calls on whether the code should be merged.
• Want to exclude paths? Read our docs to learn how.

Setup takes a minute:

1. Go to the Integrations section on the Fluid Attacks platform.
2. Scroll to the Peer Reviewer Assistant cards.
3. Click Use integration on either the Azure DevOps or GitLab card.

For GitLab, you'll need a Project Access Token per request. For Azure DevOps, it uses OAuth2 Client Credentials (tenant ID + client ID/secret). 

The Peer Reviewer Assistant is a complementary feature, exclusively included in the Advanced plan. Currently available for Azure DevOps and GitLab integrations.

Security feedback, right where code gets reviewed. Set it up now.

Implemented

🤖 Peer Reviewer Assistant: We're bringing tighter security before you go live! This complementary feature adds comments directly to your pull requests with alerts and actionable recommendations, having scanned your would-be contribution with SAST and SCA. This way, it helps reviewers to assess risk before code is merged.

Currently available for Azure DevOps and GitLab integrations. Advanced plan exclusive.

📚 New documentation site is live: All Knowledge Base articles have been migrated to docs.fluidattacks.com. The new website gives us more configuration options that result in a more comfortable browsing experience.

☑️ Prevent accidental rejection of access invitations: We added an extra confirmation step to the platform's invitation flow. This avoids accidental rejections caused by automated email link scanning.

⚠️ Cost warning when changing branches: When you modify branches from a repository in the Scope section, you'll now see a warning and checkboxes clarifying that this action can impact the cost of the service.

Upcoming deprecations

🐳 Docker image scanning: Read the rationale here.

Key info:

• Final deprecation date: March 31
• No action required.

☁️ CSPM (AWS, Azure, GCP): Read the rationale here.

Key info:

• Final deprecation date: March 31
• No action required.

📱 Move now from APK to MAST image: Our mobile app testing image was named "apk," but it also tests .ipa files. Of course, this confused you. We renamed it to MAST (meaning mobile application security testing), in line with industry terminology. Start using the new image from here, as the old one will be deprecated.

Key info:

• Final deprecation date: April 30
• Use MAST image instead of APK image.

Additional information

🤝 New sub-processors: As part of our commitment to transparency in customer data management, we want to inform you that we have engaged new sub-processors. We added Rudol and Logfire, and removed Langchain. For a full picture, visit our Trust Center.

🍪 Cookie policy update: We've expanded our cookie policy. Check it out and reach out to help@fluidattacks.com if you have questions.

⚠️Fluid Attacks call notice⚠️

Our education specialists may be calling your team members to offer them onboarding and adoption of new features on our platform. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Your review would take only 10-15 minutes✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember your review can also be in Spanish.

Implemented

✨ AI SAST: Advanced plan clients, this one's for you: Our biggest detection upgrade in a while. The new AI-powered scanner is already finding critical vulnerabilities across your code, such as SQL injections and XSS. Multi-file analysis, all supported languages, 90% precision. It's already in your reports, look for the AI SAST technique. More details here.

🔍 Scanner in the MCP: Our MCP already let you query vulnerability info and our Knowledge Base from tools like VS Code, Cursor, and Claude. Now it also runs our SAST and SCA scanners locally. Devs can ask the MCP to scan and fix their code before committing—catching vulnerabilities instantly without switching tools. Prevent issues before they hit your repo and stay in your flow.

📦 Dependency risk mitigation info in our Database: Vulnerabilities found by our SCA now display patch impact details, letting you know when updates might introduce new issues or breaking changes.

🌳 Dependency paths visualization: Sometimes we report vulnerabilities in packages you didn't install directly. The reason is these security issues are inherited automatically by packages you did install. Now we show you the full chain from your direct dependency down to the vulnerable one. Go to the Packages section and try it.

🗑️ All roles can delete files in Design Map: Users, Group Managers, and Vulnerability Managers can now delete threat model files.

🗃️ Filters for Environments and Files: These sections in Scope now have filters for faster search. Additionally, today you can hide and reorder columns of the Environments table.

Upcoming deprecations

🐳 Docker image scanning: We're retiring Docker image scanning from our solution. In practice, it generated high alert volumes with limited remediation options. As you may know, mitigating risk posed by third-party images usually requires replacing the entire image.

Key info:

• Final deprecation date: March 31
• No action required.

☁️ CSPM (AWS, Azure, GCP): We're deprecating the CSPM technique. Many CSPM findings overlap with misconfigurations detected through IaC analysis, leading to duplicated alerts and noise. This simplifies results so teams can focus on what matters.

Key info:

• Final deprecation date: March 31
• No action required.

Additional information

📜 Privacy policy update: We've expanded our privacy policy. Check it out and reach out to help@fluidattacks.com if you have questions.

⚠️Fluid Attacks call notice⚠️

Our sales team may be calling your team members to offer them onboarding and adoption of new features on our platform. This is a reliable procedure in which we will never seek to discuss your software's vulnerabilities. However, if you have any questions, please contact us at help@fluidattacks.com.

✨Have 10-15 minutes to spare?✨

Share your opinions on our AppSec solution on Gartner Peer Insights and earn a $25 gift card! Your feedback helps others make informed decisions and shapes the future of application security. Just follow this link! Remember your review can also be in Spanish.