v1.75.3
New Features:
- Added configurable approval workflows for false-positive and accepted-risk decisions, with a searchable review queue, reviewer notes, history tracking, notifications, and a dedicated reviewer permission.
- Added Bitbucket support for running scans, including branch resolution and repository content retrieval. — Learn more
- Scan Logs now preserve the selected File Logs or Errors, Warnings & Info tab while active scans refresh.
- Triage justifications for false-positive and accepted-risk decisions must now provide a meaningful reason, with clear feedback when more detail is needed.
- Improved Advanced Search performance for large result sets and ensured findings with missing metadata continue to load.
- Improved scan processing reliability during concurrent deployments and SCA or IaC batch ingestion.
- Fixed dependency finding views that could fail while displaying usage analysis.
CLI v1.13.0 / v1.12.0
New Features:
- Added
corgea mcp installso a logged-in CLI writes the Corgea MCP server into supported agent configs (Cursor, Claude Desktop, Claude Code, Windsurf, VS Code, Gemini CLI, Continue, and OpenCode). If the CLI is not installed, runnpx @corgea/cli login --url https://<your-instance>.corgea.app && npx @corgea/cli mcp install --agent <agent>. — Learn more - BLAST scans are incremental by default: the CLI diffs against the project’s last clean scan locally and analyzes only changed files. Use
--disable-incrementalto analyze every file. — Learn more
- Raised the default blocking-rules wait to 35 minutes so CI gates outlast SCA reachability triage. — Learn more
- Reports a dirty worktree only when
git statusdoes, so ignored or equivalent files no longer force a full scan.
v1.75.2
Reliability & Stability:
- Fixed Advanced Search so vulnerability results load reliably, including findings with incomplete metadata.
- Improved Advanced Search for large result sets with pagination and caching, preventing timeouts and allowing complete CSV exports beyond the previous 30,000-finding limit.
v1.75.1
Reliability & Stability:
- Fixed SAML sign-in so first-time users can be provisioned through their identity provider when self-service registration is disabled. — Learn more
- Improved Azure DevOps pull request processing so permission-denied responses are skipped cleanly without unnecessary error reports. — Learn more
- Improved long-running scan reliability by preventing active legacy scans from being automatically requeued or incorrectly marked as failed.
v1.74.3
UI & Experience:
- Added dependency license badges and license filtering, and reordered dependency lists and SCA results to show direct dependencies before transitive dependencies. — Learn more
- Fixed SCA triage decisions so they continue to carry forward across rescans when earlier findings were not linked in scan history. — Learn more
v1.74.2
New Features:
- Added support for installing the Corgea plugin for IntelliJ IDEA directly from the Integrations page. — Learn more
- Added support for applying repository-defined policies during scans.
- Redesigned the sidebar and settings experience with clearer navigation and reorganized account, company, integration, notification, and agent settings. — Learn more
- Improved content-access filters and layouts so long selections no longer overlap surrounding controls. — Learn more
- Simplified Secrets scan cards and workbench results by removing unsupported criticality and validity indicators. — Learn more
- Fixed pagination layouts so controls remain contained on scan and feedback pages with many results. — Learn more
- Improved pull request comments so GitHub and GitLab findings anchor only to valid changed lines, while unanchorable quality comments are omitted instead of appearing on unrelated code.
- Improved scan throughput and recovery by allowing multiple scans to be processed concurrently and safely reclaiming interrupted work.
- Fixed scheduled scan dates and last-run times so they match the schedule’s configured day and timezone. — Learn more
- Improved GitHub repository discovery by warming inactive caches and avoiding incorrect integration deactivation after temporary API responses.
- Fixed GitHub sign-up so disabled workspace registration is enforced consistently.
v1.74.1
Reliability & Stability:
- Unified issue tracking for SCA, container, and IaC findings so triage, assignments, due dates, accepted-risk expirations, and SLA status remain consistent across rescans while views and reports show the latest detection details. — Learn more
v1.74.0
New Features:
- Added webhook delivery for scheduled scan failures, expired accepted risks, expired integration credentials, and completed AI pentests. — Learn more
- Added support for removing company administrators from teams.
- Added page-size controls to the Scans list and scan finding tables, making it easier to review more than 20 results at a time. — Learn more
- Improved project filters with search and scrolling for long team and tag lists. — Learn more
- Improved issue explanations with clearer formatting and consistent scanner-provided details. — Learn more
- Fixed duplicate page updates that could cause lists and controls to load or refresh twice.
v1.73.3
New Features:
- Added SCA findings to SARIF exports as a separate run alongside SAST findings, allowing compatible tools to ingest both finding types while keeping them distinct. — Learn more
- Added support for signing in directly to Corgea Admin.
v1.73.2
New Features:
- Added private package registry support for Maven, PyPI, and NuGet, allowing dependency scans to resolve internal packages and their transitive dependencies. Registries can apply company-wide or to selected projects. — Learn more
- Added reachability filtering to CI dependency Blocking Rules, so pipelines can focus enforcement on vulnerabilities based on whether affected code is reachable.
- Simplified the Scans list by removing metadata-specific filters and organizing scan metadata into expandable tags alongside clearer project and repository details.
- Improved Harness repository identification by unifying clone and web URLs, preventing duplicate projects and ensuring the correct integration is used for vanity domains and multiple Harness accounts. — Learn more
v1.73.1
Reliability & Stability:
- Fixed SCA findings so bulk-triage decisions carry forward correctly across rescans. — Learn more
v1.73.0
New Features:
- Added Rust support across code, secret, and dependency scanning. — Learn more
- Added tag filtering to the Vulnerability Workbench, making it easier to focus on findings from selected projects. — Learn more
- Added downloadable PDF scan reports through the API, including audit-ready reports for completed scans with no code findings.
- Added controlled bulk-triage write actions for agent workflows, with safeguards for higher-impact changes. — Learn more
- Added the acting user to issue status change webhook payloads, improving auditability for automated workflows.
- Fixed scan detail loading indicators so they update when a scan completes without requiring a page reload.
- Improved project search performance and responsiveness for workspaces with many projects. — Learn more
- Refined team badges on project pages with more consistent, less dominant colors.
- Removed the focus shadow from vulnerability accordions for a cleaner browsing experience.
- Improved SCA and container finding identifiers so issues remain consistently tracked across scans. — Learn more
- Fixed scan summaries so findings with
image:identifiers are counted as container findings. — Learn more - Prevented oversized IaC classification values from interrupting finding ingestion.
- Fixed Free plan usage enforcement so unlimited scanning works as intended.
- Fixed Harness integration selection and repository identification for projects created through the CLI.
- Made SSO and JWT authentication availability independent of Enterprise plan checks. — Learn more
- Improved API handling of malformed or non-UTF-8 JSON requests so they return a clear validation error.
v1.72.4
Reliability & Stability:
- Improved dependency, container, and IaC finding tracking so the same issue remains consistently identified across scans and retains its triage and assignment context. — Learn more
- Improved web app responsiveness and database reliability by reusing healthy database connections between requests.
v1.72.3
New Features:
- Added mandatory email one-time password verification for password-authenticated users, providing an additional sign-in verification step. — Learn more
- Added an email one-time password fallback for SSO users, allowing enabled workspaces to maintain access when their identity provider is unavailable. — Learn more
- Improved Harness repository search so matching repositories appear even in projects with more than 100 repositories.
v1.72.2
New Features:
- Added bulk triage ingestion for applying and auditing status changes across SAST and SCA findings, with approval policies for higher-impact actions. — Learn more
- Added PDF exports for scans with no findings, making it possible to download and share a complete report for clean scans.
- Improved post-scan SCA history processing for projects with extensive scan histories, reducing delays after scans complete.
v1.72.1
Reliability & Stability:
- Improved batch IaC API performance, reducing delays when processing multiple findings. — Learn more
v1.72.0
New Features:
- Added an API endpoint that reports the running Corgea web app version, helping clients verify compatibility with a deployment.
- Improved pagination across scan lists and other large result sets so page controls stay compact and no longer overflow. — Learn more
- Simplified the File Logs tab by removing the Limited skip detail warning when complete skip-reason coverage is unavailable.
- Updated Vulnerability Workbench access so the navigation and workbench actions are shown only when enabled for your workspace’s plan. — Learn more
- Improved CLI scan accuracy for worktrees with uncommitted changes by automatically running a full scan instead of reusing incremental results, and added a
dirtyindicator to scan details and API responses. — Learn more - GitHub pull request scans are now deferred while a pull request is in draft and start when it is marked ready for review. — Learn more
- Improved IaC scan processing and triage carry-forward performance, preventing large finding histories from disrupting scan ingestion while preserving prior triage decisions. — Learn more
v1.71.3
UI & Experience:
- Fixed scheduled scan forms so project names, headings, selections, and summaries remain readable in both light and dark themes. — Learn more
- Improved page title alignment so subtitles and badges display consistently.
- Improved GitHub pull request scan reliability by preserving and retrying webhook events when background processing is temporarily unavailable. — Learn more
- Improved IaC finding performance, reducing load times for scans with large result sets.
v1.71.2
New Features:
- Added a Vulnerability Workbench with finding-type tabs, drill-down views, detailed drawers, filtered CSV exports, and bulk assignment and triage actions. — Learn more
- Added CI-specific Blocking Rules that can be selected by rule ID, plus license-compliance rules for restricting dependency license families. — Learn more
- Added read-only scan metadata across scan lists, scan details, issue views, API responses, and MCP results, with filtering for metadata keys and values. — Learn more
- Added pull request scan scope guidance to Scan Logs, clarifying that only files in the pull request are shown.
- Added scanner-provided Fortify metadata to issue details, making uploaded findings easier to trace back to their source. — Learn more
- Improved company notification settings by removing the ambiguous
Inheritoption. — Learn more - Fixed project scan pagination so large scan histories no longer overflow the page.
- Improved large project deletion so projects with extensive scan history can be removed without disrupting the database. — Learn more
- Fixed SCA findings whose paths contain
tmpso dependency tables and finding details continue to load correctly. — Learn more - Improved scan completion processing so pull request checks and SCA comments update more reliably during heavy activity.
- Expanded webhook URL support for longer endpoints. — Learn more
- Improved API scan attribution when no client source is supplied, and added clearer validation when report uploads do not include source code. — Learn more
v1.71.1
New Features:
- Added dynamic team access based on project tags and repository URL fragments, so teams automatically gain access to matching projects. — Learn more
- Added IaC and container scanning to scheduled scans, allowing teams to include infrastructure and container security checks in recurring scans. — Learn more
- Fixed scan details controls and results so they refresh when a scan completes, making export and new scan actions available without reloading the page.
v1.71.0
New Features:
- Added failure reasons and scanner-level errors to scan API responses, making incomplete or partially successful scans easier to diagnose. — Learn more
- Improved in-progress SCA and IaC results so available findings remain visible alongside accurate tab counts and scan status. — Learn more
- Fixed the loading indicator shown during the final Dropsite upload step so its status text no longer spins.
- Improved pull request scanning by skipping binary files when building diff artifacts, preventing unsupported file content from interrupting scans.
- Fixed bulk Content Access Management updates for large project and member selections, preventing request failures. — Learn more
- Improved dependency usage analysis so incomplete or oversized usage details no longer leave findings stuck in repeated triage attempts. — Learn more
v1.70.3
New Features:
- Added agent-skill onboarding to the Add Project flow, with copyable commands for installing the Corgea scan skill in a project or globally. — Learn more
- Improved Jira and Linear integration dialogs so error messages display clearly, clear when the dialog closes, and do not reappear when it is reopened.
- Fixed the New Scan menu position on scan details pages so scan options appear directly below the button.
- Fixed SARIF exports so result identifiers conform to the SARIF schema and import reliably into compatible tools. — Learn more
- Improved GitHub sign-in handling so email lookup failures show clear guidance, only verified email addresses are used, and organization sign-in requirements are applied consistently.
- Fixed dependency usage analysis for findings with long file paths or many affected lines, so results are saved reliably. — Learn more
- Fixed scan webhook delivery when pull request identifiers are numeric, so scan events continue to include the pull request context. — Learn more
v1.70.2
New Features:
- Added a Linear integration, allowing teams to connect Linear and create tickets directly from vulnerability and dependency findings. — Learn more
- Added issue-type filtering to code Blocking Rules, so teams can target vulnerabilities, code quality findings, or both. — Learn more
- Added a self-service SSO group mapping editor, giving admins a guided way to map identity-provider groups to Corgea roles and project access. — Learn more
- Added email alerts to project owners and company admins when a project fails the same scheduled scan three times in a row, and Corgea now skips that project on the schedule’s automatic runs until a scan succeeds or you retry with Run Now. — Learn more
- Added repository paths to scan lists and scan details, making similarly named repositories easier to distinguish across source-control providers.
- Improved webhook configuration by keeping the webhook type selector visible and adding a human-readable message to event payloads. — Learn more
- Improved pull request fix suggestions for GitHub and GitLab so invalid suggestion ranges no longer produce syntax-breaking changes.
- Fixed vulnerability report loading for large result sets, reducing timeout failures.
v1.70.1
Reliability & Stability:
- Fixed Jira ticket creation for findings with long summaries, while preserving useful finding context in the ticket title. — Learn more
- Expanded SAML group recognition for additional identity-provider attributes, improving group-based access assignment during sign-in. — Learn more
- Fixed the Projects list so repositories with the same name remain distinct while duplicate entries for the same project are removed.
v1.70.0
New Features:
- Added branded PDF exports for scan findings, with issue type and urgency filters, severity summaries, and direct links back to findings.
- Added code quality findings to the API and MCP, so teams and connected assistants can list and inspect code quality results programmatically. — Learn more
- Added support for self-hosted GitLab instances, including custom hosts and an option to include accessible projects beyond the token owner’s direct memberships.
- Added commit SHA tracking and scan metadata for CLI scans, making it easier to identify prior results and avoid redundant scan work. — Learn more
- Streamlined onboarding into a guided connect-and-scan flow, added a sample project option, and improved upgrade guidance when a feature requires a different plan.
- Added searchable assignee selection for code findings and fixed navigation when opening findings from issue views.
- Added a user-selectable display timezone and improved consistency across forms, tables, filters, pagination, dialogs, and loading states.
- Improved user administration with clearer account details, newest-first sorting, and compact team badges with a full team-membership view.
- Updated project pages to prefer the latest full-project scan, preserving the most representative project-wide results.
- Expanded repository URL support for longer source-control URLs.
- Improved SAML sign-in by matching email domains case-insensitively, supporting Duo Security metadata, and allowing first-time users whose identity-provider groups satisfy group restrictions. — Learn more
- Improved GitHub Team Sync by matching members to Corgea users by email and handling member-fetch failures without clearing existing team membership.
- Improved Azure DevOps pull request comments by bounding reply lookups, reducing delays on pull requests with large comment histories. — Learn more
- Improved GitLab project discovery with more efficient, retry-aware requests.
- Fixed pagination totals so counts remain accurate after navigating beyond the final page.
- Improved large scan result processing to reduce memory-related failures and retry temporary storage errors more reliably.
- Improved MCP service stability by removing unsupported SSE endpoint handling. — Learn more
v1.69.0
New Features:
- Added scan coverage visibility for SAST and SCA, including skipped-file auditing, dependency resolution coverage, per-engine file status in Scan Logs, and processed-file progress while scans run. — Learn more
- Added malicious dependency classification and Blocking Rules that can stop pull requests when known-malicious packages are detected. — Learn more
- Expanded Advanced Vulnerability Search and exports to include SCA and IaC findings, and added filtered CSV export from the Dependencies dashboard. — Learn more
- Enriched SARIF exports with finding guidance, security severity, policy taxonomies, call-graph context, fingerprints, and available remediation details.
- Added Harness source-control integration provisioning through the API.
- Redesigned Policy Playground with a resizable editor and preview workspace, improved file and classification selection, persistent context, clearer loading states, and more useful test results.
- Refreshed the Corgea interface with a more consistent design system across tables, forms, filters, cards, navigation, and empty states.
- Improved scan details with a unified repository, branch, commit, and scan-type header, clearer lifecycle statuses, and dedicated errors and warnings visibility.
- Added the current Corgea release version and a changelog link to User Settings.
- Fixed incremental CLI scan code previews, diff viewer line alignment, scan auto-refresh tooltips, and duplicate script loading on project pages.
- Improved AI Penetration Testing run controls to prevent accidental duplicate runs and keep page actions consistently positioned.
- Improved scheduled scans by preventing duplicate registrations, surfacing launch failures, and making Run Now reliably include eligible projects after older successful runs.
- Improved Azure DevOps pull request scan handling when branches are deleted or commit lookups are unavailable. — Learn more
- Improved GitHub Team Sync for large organizations with rate-limit-aware processing, and fixed authentication edge cases during GitHub connection setup.
- Fixed Bitbucket pull request comment retrieval after credentials expire, allowing refreshed credentials to be used without lingering failures.
- Prevented case-variant repository names from creating duplicate projects and consolidated existing duplicates more safely.
- Improved fix delivery, webhook notifications, and scan launch responsiveness during periods of heavy scan activity.
v1.68.0
UI & Experience:
- Added reporting metrics for fixes generated and report-upload duplicates removed, giving teams clearer visibility into estimated hours saved through remediation support and duplicate-finding triage.
- Improved GitHub check-run updates so temporary GitHub server errors are retried more reliably when Corgea updates pull request checks.
v1.67.0
New Features:
- Added AI Penetration Testing, giving teams autonomous external assessments with target management, live run visibility, finding revalidation, completion emails, and technical or executive PDF reports.
- Added dependency inventory tools to the Corgea Agent, so teams can list dependencies and generate CSV export links directly from agent conversations. — Learn more
- Added comments to project file ignore rules and CWE filters, making it easier to document why project-specific exclusions exist and update those notes later.
- Added proactive expired-credential detection and admin email notifications for GitLab, Azure DevOps, Bitbucket, and Harness integrations, helping teams renew tokens before scans and repository access are interrupted.
- Improved Security Review recommendations so pending and processing reviews refresh automatically as recommendations become available.
- Added pagination to Content Access Management, improving load times and navigation for workspaces with many projects.
- Fixed scan detail pages so the selected scan tab, dependency tab redirects, filters, and badges render cleanly before Alpine finishes loading.
- Improved GitHub Team Sync for large organizations by syncing teams in smaller background jobs, reducing timeouts during organization-wide syncs.
- Improved Azure DevOps pull request diff handling so findings in edited files are matched against the scanned PR diff more accurately.
- Improved source-control webhook handling for GitHub and Bitbucket, reducing noisy retry and comment-thread failures.
- Fixed GitHub branch loading errors so repository branch fetch failures show the affected repository name correctly.
v1.66.0
New Features:
- Added GitHub Team Sync to Content Access Management, so teams can provision Corgea teams, project access, and membership from GitHub organization teams.
- Added Harness Service Account Token support, allowing Harness integrations to connect with SAT credentials as well as personal access tokens.
- Added SCA as a Custom Security Scan option in the web app, CLI, and API, so teams can run dependency analysis as part of targeted scans.
- Added multi-file data-flow click-through in issue details, making it easier to trace source-to-sink paths across related files.
- Improved Policy Management access so project-scoped users can view and manage only the policies available to their projects, with clearer validation in Policy Center and Policy Playground. — Learn more
- Changed policy deletion to preserve historical issue and fix references while removing deleted policies from active policy lists, scans, and API results. — Learn more
- Improved user deactivation and group cleanup so project, team, and company permission group assignments stay consistent.
- Added scan type badges to scan details, making it easier to distinguish full scans, CLI scans, and pull request scans.
- Improved static HTML scan reports so scan category tabs, SAST, SCA, IaC, code quality sections, and issue group views render without indefinite loading.
- Fixed user group displays so the user table, detail drawer, CSV export, and group changes stay in sync.
- Fixed scan attribution for API token-triggered scans so the scan shows the token owner’s name instead of
Automated Run.
- Improved pull request scan downloads across source control integrations by resolving archive downloads more reliably and gracefully skipping branches or commits that are no longer available.
- Improved scheduled dependency scans so reachability status is included when SCA is selected. — Learn more
- Fixed personal-account GitHub scans so personal GitHub App installations resolve correctly for their owner.
- Fixed policy selection consistency across scan execution, scan details, and policy APIs. — Learn more
- Fixed source-sink analysis handling for malformed or empty data so affected issue views continue loading.
- Improved Corgea Agent tracing reliability when trace access is unavailable.
- Added multi-file taint analysis with click-through in issue Full View, so teams can follow cross-file data flows from source to sink without leaving Corgea. — Learn more
v1.65.2
New Features:
- Added a Skills Registry, giving teams a versioned workflow for creating, reviewing, approving, and installing agent skills.
- Added API access for policies, so teams can list, create, update, and deactivate policies programmatically.
- Added SLA status filtering to Advanced Vulnerability Search, making it easier to find issues that are within SLA, overdue, or escalated. — Learn more
- Added bulk actions to Content Access Management, so admins can add or remove members and teams, replace owners, and clean up inactive users across selected projects more efficiently. — Learn more
- Added editing for Jira integrations, allowing teams to update existing Jira connection details without recreating the integration. — Learn more
- Improved scheduled scan Run Now so scans start in the background and return users to the scan list while the scan begins.
- Fixed issue detail previews so switching between findings shows the selected issue content instead of stale content.
- Fixed Harness pull request scans so PR numbers and links appear consistently on scan views.
- Fixed code quality scan views so plan-based access is applied consistently.
- Improved incremental full scans for projects with many issues or fixes, reducing scan processing slowdowns.
- Improved SCA dependency parsing for Maven SBOMs so direct dependencies are classified more accurately. — Learn more
- Improved scheduled scan create and edit flows for large project selections, reducing form submission failures.
- Improved GitHub pull request checks and PR comments so check runs update more reliably and duplicate comments are reduced.
- Improved pull request scan precision by ignoring lines changed only by formatting.
- Improved large scan upload and ingestion reliability, reducing memory-related failures and returning clearer validation errors for missing scan run IDs.
v1.65.1
New Features:
- Added branch filtering to Reporting, so teams can narrow vulnerability, SCA, IaC, code quality, and developer insight metrics to the branch they are investigating.
- Added team scoping for company notification defaults, allowing admins to limit email notifications to selected teams while keeping webhook defaults separate.
- Added direct repository file links in issue details, making it faster to jump from a finding to the affected file and line in source control.
- Added pull request links to Agent feedback history, so teams can trace feedback entries back to the PR or merge request where they came from.
- Blocked an additional disposable email domain during sign-up to reduce low-quality or abusive account creation.
- Improved the plan override admin widget so it renders cleanly in dark and light admin themes.
- Improved expired integration messages for Azure DevOps, Bitbucket, and Harness scans, giving users clearer guidance to update the integration and retry.
- Improved issue selection, scan details, and scan list performance for workspaces with large issue volumes.
- Fixed source-sink analysis handling when fix data needs to be generated on demand.
v1.65.0
New Features:
- Added on-demand fix generation, so issues marked
On Demandcan generate a suggested fix when opened instead of waiting for fixes to be prepared ahead of time. — Learn more - Added advisory details to SCA issue pages, making it easier to review the underlying security advisories behind dependency findings.
- Added severity filtering to IaC scan results, so teams can narrow infrastructure findings by Critical, High, Medium, or Low severity.
- Added pull request links to the scans list, making it faster to jump from a PR scan back to the originating pull request.
- Improved GitHub retry handling so temporary GitHub rate limits and permission responses no longer hold scan workers for extended periods.
- Fixed SLA Slack notifications so channel alerts are sent once per SLA event, retry more reliably, and handle Slack rate limits more gracefully. — Learn more
v1.64.6
Reliability & Stability:
- Fixed Dropsite scan runs so teams can start scans from uploaded code or connected repositories more reliably.
v1.64.5
Reliability & Stability:
- Fixed GitHub pull request scan handling for organization-owned GitHub App installations, so PR scans continue reliably when the installation is associated with a company instead of a specific user.
v1.64.4
Reliability & Stability:
- Improved scan result ingestion reliability for large uploads, reducing memory-related failures during batch processing.
- Improved GitHub pull request scan handling when GitHub temporarily returns missing PR data, so scans fail more gracefully and retry on the next push.
v1.64.3
UI & Experience:
- Added quicker project tag editing from the Projects list, including an inline add action, cleaner chip overflow, and a themed typeahead for selecting existing tags.
- Fixed incremental scan handling when stored fix data is missing, so follow-up scans and reachability updates can continue without failing.
v1.64.2
UI & Experience:
- Fixed Select All in scheduled scan project selection so teams can reliably select and deselect all eligible projects when configuring project-scoped schedules. — Learn more
v1.64.1
New Features:
- Added SCA support to SLA Management, so dependency findings can have remediation and escalation deadlines, assignees, due dates, status tracking, email summaries, and webhook alerts. — Learn more
- Added daily scheduled scan reports for new findings, with notification preferences and webhook delivery controls for scheduled scan summaries. — Learn more
- Added Markdown support for Security Reviews, so pasted design documents and additional context render with richer formatting.
- Added Security Review permissions to existing Admin permission groups, so admins can manage Security Review workflows without manual permission updates.
- Improved Reporting page developer feedback comments so longer comments are easier to view and recent feedback changes refresh more consistently. — Learn more
- Fixed scheduled scan create and edit validation so unavailable scan types are hidden and rejected consistently. — Learn more
- Replaced legacy scan-complete alerts with the newer notification and webhook delivery model for scan and SLA events. — Learn more
v1.64.0
New Features:
- Added Security Design Review beta support, giving teams a dedicated workflow for design-review analysis, recommendations, and security standards.
- Added API and MCP access to Infrastructure-as-Code issues and dependency inventory, including filters for scan, project, repository, branch, severity, provider, package, license, and dependency type. — Learn more
- Added reachability details to issue APIs and MCP responses, helping teams and AI assistants prioritize findings based on reachable code paths. — Learn more
- Added repository, branch, and pull request ID filters to scan listing APIs and MCP, making it easier to find the exact scan behind a repository, branch, or PR. — Learn more
- Added auto learning for policy recommendations, so teams can review suggested policy improvements from product usage and feedback. — Learn more
- Improved PR rule tables with clearer project and tag chips, source-control icons, overflow tooltips, and better behavior on narrow screens. — Learn more
- Improved plan-controlled feature updates so access changes from plan overrides take effect immediately after they are changed.
- Fixed manual full-scan triggering for affected source-control projects, with clearer repository selection feedback while scans start.
- Fixed SCIM-provisioned users so they are assigned to the SAM Default group when created.
- Improved SBOM processing reliability by preventing repeated generation loops when processing cannot complete.
- Improved batched API ingestion reliability to reduce database contention during large scan result uploads.
Web v1.63.9
Reliability & Stability:
- Fixed Blocking Rule create and edit workflows so selected projects, project tags, and classifications are saved and shown consistently. — Learn more
- Fixed Scan & Comment Rule create and edit workflows so selected projects, project tags, classifications, and integrations are preserved reliably. — Learn more
Web v1.63.8
New Features:
- Added scheduled scan filters for webhooks, so teams can subscribe endpoints to scan events from specific scheduled scans instead of receiving every scan event. — Learn more
- Improved scheduled scan editing by showing the projects already selected for a schedule, making it easier to review, remove, or clear selected projects.
- Improved issue fix downloads so download actions only appear when a suggested fix is ready, reducing confusion for issues without an available fix. — Learn more
- Improved SCA pull request comments so they show direct or transitive dependency context and focus on dependency findings tied to files touched in the pull request.
- Optimized the Projects page so larger workspaces load local projects faster while remote repository data refreshes separately.
- Improved code scan issue cleanup to reduce duplicate active findings in scan results.
Engine v1.20.7
Scanning Engine Improvements:
- Improved scan summaries so results are clearer and more consistent.
- Expanded code analysis coverage for additional languages, improving issue detection and false-positive identification.
- Reduced duplicate secret scan findings for cleaner results.
- Improved dependency scan reliability by preventing repeated retries when a scan cannot continue.
- Fixed dependency issue triage reporting so unsuccessful triage attempts are reflected correctly.
- Improved engine dependency handling for more consistent scan execution.
Web v1.63.7
New Features:
- Added project tag scoping for Blocking Rules, so teams can apply pull request blocking policies to tagged groups of projects without maintaining long project lists. — Learn more
- Added project tag scoping for Scan & Comment Rules, so teams can control PR scan behavior across tagged project groups more easily. — Learn more
- Added options in Advanced Vulnerability Search to include issues marked as false positives by status or fix status when those results need to be reviewed.
- Added Harness pull request links on PR scans, making it easier to jump from a Corgea scan back to the originating Harness PR.
- Improved PR rule setup with clearer field tooltips, direct documentation links, better tag-based rule counts, and Critical/High selected by default when adding new PR rules. — Learn more
- Improved scan download controls so CSV, SARIF, SBOM, and dependency exports are disabled until scan processing completes, with clearer guidance when downloads are not ready.
- Improved policy retrieval so prework-generated policies are included where applicable, keeping policy review and dependency policy views consistent. — Learn more
- Fixed Bitbucket PR comment handling so Corgea recognizes hyphenated bot mentions correctly.
- Improved source-control project selection error messages when an integration is unavailable or cannot be reached.
- Improved project creation and deletion cache handling so plan limits and repository lists update more consistently after project changes.
- Improved production asset cache busting so updated JavaScript, CSS, animations, and email assets load reliably after deployments.
Engine v1.20.4
Scanning Engine Improvements:
- Enhanced secret scanning accuracy with improved context analysis, reducing false positives while maintaining comprehensive coverage
- Upgraded endpoint discovery engine for better API detection and call graph analysis
- Improved SBOM generation reliability and accuracy across multiple package managers
- Enhanced language detection for secret scanning with support for additional file extensions
- Optimized batch processing for large-scale scans, improving throughput for enterprise environments
- Enhanced error handling and recovery mechanisms for more robust scan execution
- Improved memory efficiency for processing large codebases
- Better handling of incremental vs full scan detection logic
- Fixed issues with scan metadata reporting and GPT error breakdown tracking
- Resolved edge cases in file processing that could cause scans to fail
- Improved parent dependency false positive checking
- General stability improvements and performance optimizations
Web v1.63.6
UI & Experience:
- Fixed repository selection for workspaces where Harness is the only connected source control integration, so Harness repositories now appear correctly when creating or selecting projects. — Learn more
Web v1.63.5
New Features:
- Added Harness Code integration support, so teams can connect Harness repositories, run pull request scans, receive Corgea comments and status checks, and create fix pull requests directly in Harness. — Learn more
Web v1.63.4
UI & Experience:
- Added Git service icons to Content Access project selection, making it easier to distinguish GitHub, GitLab, Azure DevOps, Bitbucket, and local projects.
- Fixed code highlighting in false-positive explanations so inline code renders clearly and safely in issue details.
- Improved scan log file path display and added Scan ID filtering to Advanced Vulnerability Search for more precise scan investigation.
- Improved agent pull request comment handling so Corgea responds more accurately to direct mentions and replies while avoiding comments intended for teammates.
- Corrected duplicate project detection so repositories with the same name in different namespaces are no longer treated as duplicates.
- Improved GitHub retry behavior for transient server and rate-limit responses.
Web v1.63.3
New Features:
- Added cross-project dependency management so teams can review approved dependencies and automated suggestions across projects.
- Improved full-incremental scans so copied issues preserve detection history, keeping issue timelines consistent across follow-up scans.
Web v1.63.2
New Features:
- Added CVSS score range support for dependency blocking rules, so teams can block SCA findings by precise score ranges instead of severity alone. — Learn more
- Improved issue debug details by showing when a dependency false-positive policy was applied, making policy-driven triage easier to understand.
- Improved file ignore rule enforcement so ignored paths are consistently excluded when new issues are created.
- Improved SBOM processing so dependency relationships are parsed more reliably from stored CycloneDX data. — Learn more
- Improved batch API reliability for issue and scan file-log ingestion, reducing contention during large scan result uploads.
v1.63.1
Reliability & Stability:
- Improved upgrade reliability for issue analysis tracking data, reducing migration risk when moving to this release.
v1.63.0
New Features:
- Added Fortify FPR upload support for third-party scan imports.
- Added SCA dependency-type visibility for dev and optional dependencies, including filters, badges, issue details, and CSV exports. — Learn more
- Improved scan list counts by separating code issues from dependency issues and keeping dependency-only scans visible when filtering out empty scans.
- Improved scan policy visibility so policies applied to a scan remain visible even when older or archived versions were used.
- Fixed IaC scan cards so Critical counts display correctly.
- Fixed sidebar account-menu behavior so users can reliably open account actions and log out.
- Improved scan ingestion performance and reliability with batch handling for SCA issues, IaC issues, and scan file logs.
- Improved SCA result deduplication and lookup performance to reduce duplicate findings during high-volume scan processing. — Learn more
- Improved scan API resilience so deleted scans and Rootly heartbeat timeouts no longer cause avoidable server errors.
v1.62.6
UI & Experience:
- Improved the Dependencies page by making the “Scans Affected” count clickable, opening a detailed modal with affected scans, detection dates, and direct vs. transitive dependency context.
- Improved SCA results visibility with clearer direct/transitive dependency indicators in scan results and package group summaries.
- Improved SCA issue details with sub-dependency count visibility for affected packages.
v1.62.5
UI & Experience:
- Fixed scheduled scan scope tab switching so Projects, Project Tags, and Teams tabs open correctly during schedule setup.
- Increased supported security-pattern file path length so long paths are stored correctly.
v1.62.4
UI & Experience:
- Fixed scheduled-scan scope tab switching so changing between Projects, Tags, and Teams consistently shows the correct targeting options.
v1.62.3
UI & Experience:
- Fixed an issue where Teams did not appear on the Scheduled Scan creation page, so team-scoped schedules can now be configured reliably.
v1.62.2
UI & Experience:
- Improved Policies page filtering and search usability, including support for searching policies by ID.
- General bug fixes and performance improvements.
v1.62.1
New Features:
- Added team-based scheduled scan targeting, so you can schedule scans for all projects assigned to selected teams.
- Added support for Corgea-managed read-only policies, including clearer handling for immutable default policy workflows.
- Fixed service-principal JWT authentication for Blocking Rules API requests. — Learn more
- Improved Entra JWT issuer handling by normalizing missing trailing slashes in issuer configuration, reducing token-validation setup errors. — Learn more
- Fixed a SAML provider compatibility issue that caused sign-in failures for affected SSO configurations.
- Fixed issue details metadata presentation by removing incorrect query-name fallback values.
- Fixed issue details rendering regressions so explanation and fix content display reliably.
- Fixed First Detected timestamps so issue views and issue APIs now reflect the true first detection time.
- Improved pull request scan behavior by superseding older pending scans when many commits arrive quickly, so the latest commit scan is prioritized.
- Fixed scheduled-scan execution reliability by correcting cron command path handling and ensuring next-run calculation updates after schedule changes.
v1.62.0
Security & Permissions:
- Expanded domain-level registration restrictions to cover additional domains and their visually similar homograph variants as part of ongoing abuse prevention controls.
v1.61.9
UI & Experience:
- Fixed scheduled scan list day-of-week display so weekly schedules now show the correct weekday. — Learn more
v1.61.8
UI & Experience:
- Fixed sidebar account-menu display for users with long names, so profile names no longer overflow or crowd navigation controls.
v1.61.7
New Features:
- Added filtering on the Policies page so teams can narrow large policy lists faster by relevant criteria. — Learn more
- Added scan-type scoping for scan responses, so API consumers can request only the scan categories they need.
- Added policy-page access enforcement based on content access controls, so users only see policy data for projects they can access. — Learn more
- Added policy and scan-settings permission gating so users without
change_projectaccess no longer see or can open restricted project-setting controls. — Learn more - Fixed code-quality CSV/SARIF export behavior and improved filter dropdown spacing for a cleaner export and filtering workflow. — Learn more
- Improved SBOM handling by shifting parsing to background workers, reducing request-path load during scan processing.
- Improved CI SCA reporting to focus on packages changed in the pull request, reducing dependency-noise in automated results.
- Fixed scan attribution so automation-triggered runs are consistently labeled as automation.
- Improved scheduled-scan timing so runs respect each schedule’s local timezone. — Learn more
- Improved GitHub webhook ingestion to handle unsupported Unicode payload edge cases more safely.
- Improved SSO compatibility for strict XML-validation provider configurations.
v1.61.6
UI & Experience:
- Improved SAML setup with a more guided configuration form, including ready-to-copy IdP URLs and one-click metadata fetch/populate support for core SAML fields.
- Improved SAML sign-in compatibility by falling back to NameID when email attributes are not provided by the identity provider, reducing failed login scenarios for affected SSO configurations.
v1.61.5
New Features:
- Enabled incremental scans by default for all organizations, so new and existing workspaces get faster follow-up scan coverage automatically.
- Expanded Policy Playground workflows so teams can open supported policies directly in Playground, edit and version them in-place, and scope policies with file glob patterns. — Learn more
- Improved login behavior so already authenticated users are redirected directly to the Projects page.
- Improved profile administration with company auto-complete on profile edits, including clearer company ID selection behavior.
- Improved CLI upload compatibility for repositories without configured integrations, reducing avoidable upload/prework flow failures.
- Improved policy editing stability with clearer no-change handling during Playground-based policy updates.
- General bug fixes and performance improvements.
v1.61.4
Reliability & Stability:
- Improved prework scan handling so standard scan selection consistently excludes prework-only and policy-playground scans, reducing incorrect scan context in scan views. — Learn more
- Improved API request tracking coverage for versioned endpoints to provide more consistent monitoring visibility.
- General bug fixes and performance improvements.
v1.61.3
New Features:
- Added policy-generation prework runs from the Policies page, so teams can trigger targeted policy generation directly from the UI. — Learn more
- Added OAuth2 JWT bearer authentication with service-principal permission mapping for API access, enabling secure machine-to-machine workflows without user-bound API keys. — Learn more
- Improved Service Principal setup guidance for Entra and Okta token configuration, including clearer issuer/audience/application ID instructions. — Learn more
- Improved prework-only scan presentation with clearer scan naming and prework-focused status messaging in scan views.
- Improved full-scan performance for integration-backed repositories, reducing end-to-end scan time in supported cases.
- General bug fixes and performance improvements.
v1.61.2
New Features:
- Added JIRA ticket creation directly from SCA issue details, including quick access to created ticket links for faster dependency-vulnerability triage. — Learn more
- General bug fixes and performance improvements.
v1.61.1
New Features:
- Added project-level filtering in Content Access so teams can quickly narrow access reviews to a specific project.
- Added scan trigger-source tracking for CLI and IDE initiated scans, improving visibility into how scans are launched and which client tools are being used. — Learn more
- Added Checkmarx
Path Idvisibility in issue details to improve triage context for scanner-specific findings.
- Improved the scan comparison experience with custom scan labels, richer false-positive visibility, and new filters for reachability and hold-reason changes.
- Improved pull request diff handling so legitimate findings are less likely to be skipped in automated commenting, including better Bitbucket diff coverage.
- Fixed add-issue flow failures when pull request file metadata is unavailable.
- Improved policy API error handling and validation, including better project-based policy retrieval behavior and clearer invalid-input responses. — Learn more
v1.61.0
New Features:
- Added scanner metadata to issue API responses, including normalized custom scanner fields, so teams can preserve third-party scanner context during triage. — Learn more
- Added scan-scope filtering for issues APIs by scan type and triggering user, so issue listings reflect the latest matching scan instead of defaulting to unrelated scan runs. — Learn more
- Added support to reconstruct source ZIPs for third-party scanner workflows, improving recovery and reprocessing for uploaded scans. — Learn more
- Improved scan policy issue links and counts so false-positive and fix policies open directly to the associated filtered issue views for the selected scan. — Learn more
- Improved scan pipeline throughput by allowing prework and scan processing to run in parallel, reducing queue delays.
- Fixed content access exports so project access CSVs include complete user/team coverage and explicit entries for projects with no assigned access.
v1.60.8
New Features:
- Added company domain join controls so organizations can allow users with matching business email domains to join automatically. — Learn more
- Added CWE ignore glob pattern support, so teams can scope ignore rules to specific file paths instead of applying them globally. — Learn more
- Improved scan filtering with clearer labels, better layout fit, and added scanner options.
- Improved issue details and scan details behavior, including clearer file path display and better filter isolation across tabs.
- Added dedicated reporting access control, so reporting pages are now gated by a specific reporting permission.
- Improved webhook delivery and redelivery reliability to reduce duplicate or missed webhook events. — Learn more
- Fixed SCIM user provisioning idempotency to prevent duplicate-key failures when the same user payload is sent more than once. — Learn more
- Improved prework scan eligibility handling and related company-setting defaults for more predictable scan behavior.
- Improved stale CI scan cancellation reporting for better operational visibility.
v1.60.7
New Features:
- Added policy guidance notes, so teams can attach internal instructions that appear directly in related issue details.
- Added prework-driven policy generation controls, including optional review behavior before generated policies are activated.
- Improved scan page filtering with reorganized controls and cleaner interactions.
- User search now works globally across all pages instead of only filtering the currently visible page.
- Improved webhook receiver reliability and delivery handling for more consistent event processing. — Learn more
- Added safer issue/query limits for heavy search, export, blocking-rule, and scan comparison flows to reduce out-of-memory failures.
- Improved GitHub integration resilience with custom retry behavior for transient API failures.
- Updated policy API versioning behavior so newly updated policies are versioned cleanly while older active versions are archived.
- Improved handling when duplicate projects are detected during project lookup to reduce incorrect matching issues.
v1.60.6
New Features:
- Added customizable webhook request body templates with safe placeholder support, giving you more control over webhook payload formats. — Learn more
- Reachability details are now shown only for direct dependencies, reducing noise when reviewing transitive SCA findings. — Learn more
- Improved SAML onboarding and group sync behavior, including fixes for SAML config registration, first-login redirects, and consistent team naming from incoming SAML groups.
- Improved GitLab integration resilience by handling transient connection resets more reliably. — Learn more
- Reduced unnecessary integration error logging for cleaner operational visibility.
v1.60.5
Security & Permissions:
- Improved authentication flow to prevent unauthorized redirects. — Learn more
- Fixed an edge case where SCA triage updates could fail to save in certain scenarios. — Learn more
- Improved reliability of SAML group sync and group mapping behavior.
- Routine dependency updates.
v1.60.4
New Features:
- Added project tag management through the Projects API, plus
repo_urlfiltering/support in project responses for easier project automation workflows. — Learn more - Added CVSS scores to SCA issues API responses to help prioritize dependency vulnerabilities more accurately. — Learn more
- Fixed the JIRA ticket modal trigger on issue details pages for a more reliable ticket creation flow.
- Improved navigation bar behavior and responsiveness across layouts.
- Hardened user group APIs to prevent vertical privilege escalation and improve access safety. — Learn more
- Scan upload API now returns a clear
400error when required fields are missing, improving API feedback for failed uploads. — Learn more - Improved scan operations with manual scan triggering support for timeout recovery scenarios.
- Fixed vulnerability aging report errors to ensure the page loads reliably.
- Included missing database migrations and resolved migration conflicts for smoother upgrades.
- Improved test execution throughput and coverage reporting to support release stability.
v1.60.3
New Features:
- Added SBOM (Software Bill of Materials) generation and dependencies view for better visibility into your project components.
- Enhanced vulnerability filtering with the ability to filter SCA dependency vulnerabilities by criticality in the scan view.
- Improved user interface elements for a better experience.
- Fixed various button interactions and display issues.
- Resolved CLI and IDE integration issues to ensure proper connectivity.
- Enhanced security detection capabilities with expanded vulnerability coverage.
- General bug fixes and improvements for better stability.
- Updated change log pipeline for improved release documentation.
v1.60.2
New Features:
- Added support for Coverity integration to expand security scanning capabilities.
- Introduced self-service billing management for easier subscription control.
- Enhanced feedback system to track and display AI agent response history.
- Improved project navigation when accessing Projects from the Teams page.
- Enhanced dependency filtering to help you better manage project dependencies.
- Improved error handling and logging for better system stability.
- General bug fixes and performance improvements.
v1.60.1
New Features:
- Added project filter to dependencies view for easier navigation and management
- Added Reachable toggle for endpoint findings filters to help prioritize security issues
- Fixed Policy Playground line highlighting issue after security scans
- Improved code review diff parsing for better accuracy in change detection
- General bug fixes and improvements
v1.60.0
New Features:
- Added AI-powered Software Composition Analysis (SCA) for enhanced dependency scanning.
- Implemented user login audit logs for improved security monitoring.
- Added webhook support for user-related events with asynchronous processing.
- Enhanced reporting capabilities with additional metrics and insights.
- Improved Azure Repos integration with better URL mapping support.
- Fixed SAML group synchronization for more reliable identity management.
- Improved color contrast for better accessibility and readability.
- Updated styling for ticket and pull request creation workflows.
- Enhanced issue filtering functionality to work more reliably.
- Fixed logs page to auto-refresh automatically.
- Resolved text display issues throughout the interface.
- Enhanced authorization controls for project management operations.
- Improved role-based access control (RBAC) enforcement for API operations.
- Standardized group permission handling for consistent behavior.
- General bug fixes and performance improvements.
- Enhanced test coverage for better system reliability.
v1.59.5
New Features:
- Added SCIM Token visibility in the SSO configuration modal for easier identity management setup.
- Improved scan tracking and pull request monitoring with enhanced timeout handling.
- General bug fixes and performance improvements.
- Enhanced automated documentation generation for better resource availability.
v1.59.4
New Features:
- Added support for Glob Pattern configuration in policies, now accessible through the user interface
- Introduced API grouping support for better organization and data management
- Added Agent integration support for Azure DevOps
- Enhanced dependency view data loading for improved performance
- Improved rendering of tables in security findings markdown display
- Enhanced email validation during sign-up process
- Fixed issue where duplicate projects could be created under certain conditions
- Resolved false positive feedback form submission issues
- Fixed database migration issues affecting permissions
- Optimized database queries with new indexing for better performance
- General bug fixes and improvements for enhanced system stability
v1.59.3
New Features:
- Enhanced webhook notifications now include a summary of scan findings for easier integration and monitoring.
- Improved clarity for Software Composition Analysis (SCA) issues caused by auto-generated lock files.
- Enhanced the issue detail view page for better readability of SCA findings.
- Policy-only scans now properly display all skipped items for better visibility.
- General bug fixes and improvements for enhanced application stability.
v1.59.2
New Features:
- Added project-tag search capability across all search fields in Zapier integration
- Introduced new API to retrieve projects programmatically
- Added feedback link for issues
- Updated code vulnerability side panel to match the improved SCA (Software Composition Analysis) design
- Fixed double search bar display issue in the dependencies tab
- Resolved rendering issues where some SCA issues appeared without titles
- Enhanced content security enforcement on the dependencies page
- Implemented authentication improvements for critical functions
- Strengthened authorization controls to prevent bypass vulnerabilities
- Applied additional security hardening measures
- Improved PR comment formatting for quality scanner results
- Enhanced issue history tracking and fingerprinting
- Resolved multiple error conditions reported through monitoring
- Fixed development environment setup issues
- Improved logging for better troubleshooting and diagnostics
- General bug fixes and performance improvements
v1.59.1
Reliability & Stability:
- Improved system logging and error tracking for better monitoring and diagnostics.
- General bug fixes and performance improvements.
v1.59.0
New Features:
- Added SAML group import and configuration for enhanced team access control.
- Added support for filtering issues by branch.
- Introduced new permissions for updating issue status.
- Added pull request search filtering on scan page.
- Improved issue quick view for better usability.
- Enhanced the fix debug section with clearer documentation.
- Fixed back button navigation on issue pages when changing decisions.
- Resolved pagination issues for the issues list.
- Fixed double scrollbar issue in Advanced search.
- Improved diff viewer performance and loading behavior.
- Code quality scans are no longer enabled by default on full scans.
- Enhanced scanning logs for better visibility and diagnostics.
- Fixed SAML metadata endpoint access issues.
- Resolved SAML SSO issue that could create duplicate companies.
- Improved GitHub integration compatibility.
- General bug fixes and performance improvements.
v1.58.7
Bug Fixes:
- Resolved an issue where Infrastructure as Code (IaC) scan results were not displaying correctly for users.
- Enhanced overall system stability and performance.
v1.58.6
New Features:
- Added support for enhanced Checkmarx integration with improved scan metadata tracking.
- Enabled large SAST scan file upload capability through the CLI for better handling of comprehensive security scans.
- Improved performance and handling of large security scan uploads.
- General bug fixes and improvements.
v1.58.5
Bug Fixes:
- Fixed an issue with the false positive filter not working correctly on the new scan page.
v1.58.4
UI & Experience:
- Scan view now defaults to showing only open issues for easier issue management and improved focus on active security concerns.
- Resolved database integrity issues to improve data consistency and application stability.
- General bug fixes and improvements.
v1.58.3
New Features:
- Added the ability to cancel scans in progress, giving you more control over your workflow.
- Resolved database migration conflicts for improved system stability.
- General bug fixes and performance improvements.
v1.58.2
New Features:
- Added direct dependencies filtering option with new UI controls
- Enhanced issue filtering capabilities for MCP server and agent
- Improved Azure repository integration with custom rules for better project identification
- Added Infrastructure as Code (IaC) support
- Refreshed scanner page design for improved usability
- Updated integration page with consistent styling and expiration indicators
- Optimized advanced search queries for faster results
- General bug fixes and improvements
- Enhanced system stability and performance
v1.58.1
Improvements:
- Enhanced admin interface compatibility and performance.
- General bug fixes and stability improvements.
v1.58.0
Bug Fixes:
- Fixed an issue with advanced search default scan type settings.
- Resolved errors in GitHub webhook processing to ensure reliable integration.
- General bug fixes and stability improvements.
- Enhanced error handling for improved system reliability.
- Performance optimizations and backend improvements.
v1.57.4
Search Improvements:
- Fixed an issue with advanced search when using the false positive filter, ensuring more accurate search results.
- General bug fixes and improvements to enhance platform performance.
v1.57.3
New Features:
- Added filter view for better organization and navigation.
- Introduced the ability to add teams to projects and projects to teams for improved collaboration.
- Added exclude button for scanning to give you more control over what gets scanned.
- Project names and repository URLs are now case-insensitive for easier management.
- Improved error handling for GitLab integrations.
- Enhanced user creation process for better reliability.
- Improved logging for Bitbucket authentication issues.
v1.57.2
Improvements:
- Enhanced cookie handling for better session management and security.
- General bug fixes and performance improvements.
v1.57.1
UI & Experience:
- Improved the SCA (Software Composition Analysis) page display and functionality.
- Added cookie consent management for better privacy controls.
- General bug fixes and improvements for enhanced application performance.
v1.57.0
Integrations:
- Improved Jira ticket creation visibility - tickets are now accessible regardless of fix status.
- Enhanced system performance and stability.
- General bug fixes and improvements.
v1.56.0
Performance & Monitoring:
- Enhanced application performance monitoring with improved latency tracking capabilities.
- Resolved issues to improve overall system stability and reliability.
- General bug fixes and improvements.
v1.55.9
UI & Experience:
- Redesigned the clear filters button for a cleaner, more intuitive interface
- Removed confidence filtering from the UI to streamline the issue management workflow
- Improved performance when adding new issues to your dashboard
- General bug fixes and stability improvements
v1.55.8
Reliability & Stability:
- Improved logging and system diagnostics for better performance monitoring.
v1.55.7
Reliability & Stability:
- Improved status update handling to prevent errors in edge cases.
- Enhanced data processing reliability.
v1.55.6
New Features:
- Added export functionality for advanced vulnerability search results.
- Enhanced token security with encryption and expiration management.
- Improved password reset validation to support additional special characters.
- Resolved issue creation errors and improved system performance.
- General bug fixes and improvements for enhanced stability.
v1.55.5
New Features:
- Added Bitbucket integration support for seamless workflow automation with your Bitbucket repositories.
- General bug fixes and performance improvements.
v1.55.4
New Features:
- Added Quick View for viewing security issues with improved navigation
- Introduced Dependency Vulnerability Details page for comprehensive vulnerability analysis
- Added markdown support for enhanced documentation and formatting
- New filter to display only scans with identified issues
- Enhanced policy configuration with support for append instructions
- Improved scanner timing metadata for better performance tracking
- Enhanced vulnerability search with loading indicators for better user feedback
- Fixed sticky navigation and centered navigation buttons for improved layout
- Reorganized scan display with better prioritization of top issues
- Added date information to scan history expansion view
- Improved navigation layout and responsiveness
- Enhanced webhook functionality to include user comments from issue history
- Deactivated PR rules can now be reactivated as needed
- SCA (Software Composition Analysis) issues on PRs are now properly sorted
- Improved error messaging for SAML authentication issues
- Enhanced handling when fix summaries are unavailable
- Quality scanner enhancements for more reliable results
- General bug fixes and performance improvements
v1.55.3
New Features:
- Added advanced vulnerability search capability to help you find and filter security issues more efficiently.
- Introduced intelligent false positive detection to reduce noise in your security findings.
- Enhanced pagination controls now properly maintain your selected filters as you navigate through pages.
- Streamlined and optimized the user interface for better performance.
- Improved Azure DevOps integration performance for faster and more reliable operations.
- General bug fixes and performance improvements across the platform.
- Backend optimizations for enhanced stability.
v1.55.2
New Features:
- Enhanced dependency filtering capabilities for better project management.
- Improved Azure DevOps integration with better handling of pull request differences.
- Fixed filtering functionality to ensure consistent behavior.
- General bug fixes and performance improvements.
v1.55.1
New Features:
- Scheduled scans are now enabled by default for all projects.
- Added filtering capabilities for scheduled scanning to help you manage your scan configurations.
- Introduced support for container scanning (only available per request).
- Enhanced project tagging functionality for better organization.
- Improved scheduled scan editing experience on initial load.
- Enhanced GitLab scheduled scan integration to properly detect branch names.
- Better handling of tag management in scheduled scans.
- Fixed font rendering issues in SCA (Software Composition Analysis) views.
- Resolved layout display issues in SCA interface.
- Fixed several issues with scan error handling and API responses.
- Improved content access management workflows.
- General bug fixes and performance improvements.
v1.55.0
Bug Fixes & Improvements:
- Resolved an issue with editing scheduled scans to ensure configuration changes are properly saved.
- Improved text formatting and structure in policy descriptions for better readability.
v1.54.9
Improvements:
- Enhanced repository connection reliability and error handling.
- Improved PolicyIQ feature accessibility across different plan types.
- Resolved credential validation issues when accessing repositories.
- Fixed plan verification logic for PolicyIQ features.
v1.54.8
New Features:
- Added blocking rules capability to Software Composition Analysis (SCA) for enhanced security control.
- General improvements and bug fixes for better platform performance.
v1.54.7
Authentication & Access:
- Improved SAML login group validation for more reliable authentication.
- Enhanced version comparison logic for software composition analysis.
- General bug fixes and performance improvements.
v1.54.6
New Features:
- Added ability to edit SAML configuration settings for enhanced authentication management.
- General improvements and bug fixes to enhance platform stability.
v1.54.5
Authentication & Access:
- Enhanced Single Sign-On (SSO) authentication with improved group-based access controls and configuration options.
- General bug fixes and improvements for enhanced system performance.
v1.54.4
New Features:
- SCA license information is now optional, giving you more flexibility in compliance workflows.
- Email addresses are now automatically normalized to lowercase during sign-up and registration for consistency.
- Admin users now have full access to all projects, even when access controls are enabled.
- Enhanced content access control functionality across the platform.
- Resolved issues with access control permissions not applying correctly.
- Improved Azure DevOps integration to handle pull request links more gracefully.
- Fixed GitLab comment posting functionality.
- Enhanced error handling for git operations.
- Fixed counting accuracy issues in reporting.
- Resolved performance issues in dependency analysis.
- General stability improvements and bug fixes.
v1.54.3
Integrations:
- Enhanced third-party scanner integration support for improved compatibility.
- Improved Single Sign-On (SSO) authentication flow for better reliability.
- General bug fixes and improvements for enhanced system performance.
v1.54.2
New Features:
- Added support for scheduled scans on remote projects that haven’t been fully onboarded yet.
- Resolved security vulnerabilities to improve application safety.
- General bug fixes and improvements for enhanced stability.
v1.54.1
Authentication & Security:
- Improved Google authentication and single sign-on experience.
- Enhanced pagination controls for easier navigation through content.
- Improved project selection in scheduled scan settings.
- General bug fixes and performance improvements.
v1.54.0
New Features:
- Added dropdown menu to PR rule management page for easier configuration.
- Enhanced CSV export functionality for SAST findings with additional data fields.
- Improved project search functionality on content access page.
- Fixed issues with pull request commenting to prevent duplicate comments.
- Resolved project lookup errors that could occur in certain scenarios.
- Improved endpoint discovery processing for more accurate results.
- General bug fixes and performance improvements.
v1.53.0
New Features:
- Added CVSS scoring display for dependency vulnerabilities to help you better assess risk levels.
- Introduced webhook subscriptions for automated workflow integrations.
- Added support for multi-select projects in content access management for easier permission configuration.
- Restored code view in advanced search functionality.
- Improved classification display for long security issue names.
- Enhanced permission management with an improved checkbox experience.
- Refreshed user interface on the users page for better clarity.
- Added fix date tracking and improved related UI elements.
- Fixed issue tracking to properly handle cases where previously fixed issues are detected again.
- Improved fix history management - previous fixes are now automatically archived when new fixes are added.
- General bug fixes and performance improvements.
v1.52.0
New Features:
- Added new Teams & Content Access Controls for project-level access.
- Improved several interface elements for a smoother workflow.
- Fixed issues with “Add Group” buttons not responding as expected.
- Updating pull-request status will no longer interrupt or fail a running scan.
v1.51.9
Developer Workflow Enhancements:
- Automatically sets a default branch when no current branch is detected to ensure uninterrupted scanning and smoother onboarding.
v1.51.8
New Defaults & Onboarding:
- New AI-native SAST scanner version
- Added export functionality on the user list page.
- General UI refinements to improve clarity and consistency.
- Fixed an issue causing file fetch failures for Azure DevOps repositories.
- Minor formatting and maintenance updates for overall stability.
v1.51.7
New Features:
- Introduced the Corgea Agent, enabling expanded automation and improved scan workflows.
- Added new permissions for the Integrations page, giving administrators more granular control.
- Improved notifications for assigned issues.
- Additional UI fixes to ensure a smoother user experience.
- Improved logic for handling PR updates and fallbacks when commit data is missing.
- Overall reliability enhancements and background maintenance.
v1.51.6
Improved UI & Developer Experience:
- Refined the width of the user detail slide-out for a cleaner layout.
- Enhanced filter controls and applied several UI polish updates across the platform.
- Corrected the “View More Details” link in check-run views for smoother navigation.
- Improved the Azure DevOps experience by fixing URLs, improving the new-scan interaction, and displaying project names accurately.
- Fixed policy bug 3rd party scanners
v1.51.5
Platform Stability & Data Integrity:
- Prevented the creation of duplicate projects within the same company.
- Added support for new ignore rules in scan configuration to give teams more control over scan output.
- Corrected filtering behavior for dependency views to ensure accurate and intuitive results.
v1.51.4
User Interface Enhancements:
- Relocated the user search bar to provide a more intuitive navigation experience.
- Removed an incorrect warning message that appeared for public-repository projects.
- Improved CI review comments by using a more concise and helpful summary.
- Expanded internal issue tracking with additional properties for better reporting and analytics.
- Fixed agent-related actions to ensure consistent scan execution.
- Prevented project tag updates from unintentionally overwriting existing values.
v1.51.3
Improvements:
- Fixed error because of long file path.
v1.51.2
Bug Fixes:
- Fixed an issue with dropdown menus not displaying correctly.
v1.51.1
Platform Stability:
- Improved GitHub reliability by handling user error cases.
- Updated button styling for better visual consistency.
v1.51.0
New Features:
- Added a SAML tab on the users list page for easier identity management.
- Fixed page shifting when creating new scans or interacting with menu icons.
- Improved redirection logic for admin users to ensure smoother navigation.
- Fixed an issue where policies were not displaying properly in the policies view.
v1.50.8
New Features:
- Added support for “New Scan” on projects uploaded as ZIP files.
- Enabled “New Scan” functionality for public repository URLs.
- Improved the inbox page with search functionality and cleaner spacing.
- Updated redirection logic to send users without permissions to the inbox page.
- Suppressed unnecessary Slack webhook error messages for a cleaner log experience.
v1.50.7
New Features:
- Vulnerability Source from OSV: Added detailed vulnerability source information powered by the OSV database, enhancing transparency and traceability in scan results.
- History View: Enhanced the history view for a clearer, more streamlined experience.
- Commenting Experience: Improved commenting interface and added AI-powered LLM explanations for better context understanding.
- Repository Dropdown: Fixed overlapping UI elements between the repository dropdown and navigation bar.
- Search Bar on Projects Page: Refined search functionality for smoother navigation and quicker access to projects.
- Case-Insensitive Branch Search: Dropsite branch search is now case-insensitive for easier usability.
- Resolved issues with project list visibility for GitHub repositories.
- Improved handling of missing Git user info to prevent failures.
- Addressed GitLab “branch not found” errors gracefully.
- General bug fixes and performance improvements.
v1.50.6
New Features:
- Scan Audit History: Added a dedicated tab for viewing detailed scan audit history.
- Enhanced messaging and consistency across various pages.
- Displayed a proper 404 error page for invalid scan or issue links.
- Fixed inaccurate counts on the scan page for non-BLAST scans.
- Improved API handling for invalid or missing scan IDs.
- Stability fixes for integration tests and backend reliability.
v1.50.5
Bug Fixes & Stability:
- Fixed versioning display to ensure accurate build tracking.
- General fixes and optimizations for smoother performance.
v1.50.4
New Features & Enhancements:
- Enhanced Export Capabilities: Added support for exporting CSV reports that include false positive data for comprehensive security analysis.
- Advanced API Filtering: Introduced filtering and sorting capabilities in the API to provide more flexible data access and integration options.
- Third-Party Scanner Integration: Improved support for third-party security scanners with enhanced deep linking capabilities for seamless workflow integration.
- Checkmarx Integration: Added additional context support for Checkmarx scans to provide more detailed security insights.
- Scan List Optimization: Significantly improved page load times for the scan list to provide faster navigation and better user experience.
- Enhanced Issue Management: Fixed issues with false positive visibility controls to ensure accurate issue filtering and management.
- Improved Scan Organization: Code quality scans are now properly excluded from the main scan list for cleaner project organization.
- Enhanced Monitoring: Improved system monitoring with heartbeat functionality for better service reliability.
- Issue Status Management: Fixed issue status inheritance to ensure consistent status tracking across projects.
- Jira Integration: Resolved Jira integration issues for seamless ticket management.
- File Type Handling: Improved file type detection and processing for more accurate scan results.
- Various bug fixes and performance enhancements across the platform.
- Improved user experience based on customer feedback.
- Enhanced system stability and reliability.
v1.50.2
New Features & Enhancements:
- Project Management: Added permissions to allow authorized users to delete projects when needed.
- CWE Filtering: Introduced an option to filter vulnerabilities by CWE category directly in project settings.
- SAML Integration: Added support for assigning default groups when users log in via SAML.
- Language Detection: The platform now automatically detects the programming language for imported scans, improving compatibility and accuracy.
- Endpoint Discovery: Enhanced the endpoint discovery engine with support for PHP and C# projects.
- Feedback System: Added the ability to provide feedback on false positives to continuously improve detection accuracy.
- Improved GitLab and Azure DevOps scheduled scan reliability.
- Enhanced GitHub app installation handling to support webhook timing edge cases.
- Ensured all project types can be deleted consistently.
- Prevented unnecessary processing of privileged users during webhook callbacks.
- Streamlined project linking using project IDs for more consistent behavior.
- Fixed minor UI issues such as button alignment and whitespace handling.
- General performance, stability, and reliability improvements across the platform.
1.48.0
New Features:
- Risk Management Enhancements: Added automatic expiry options for accepted risks, making it easier to manage ongoing security decisions.
- Project Settings Update: Improved project settings interface for a smoother configuration experience.
- False Positive Detection: Upgraded the false-positive detection system to use GPT-5, providing smarter and more accurate results.
- Automated QA Checks: Added issue codes for quality assurance checks and improved retry handling when checks fail.
- Improved Ignore File Support: Added support for ignore files (corgea.yaml) within project settings for more flexible configurations.
- Search Bar Enhancements: Added a “Clear” button and improved multi-select behavior in the search bar.
- CWE Filter Fix: Enhanced auto-search functionality for CWE filters to deliver more accurate filtering.
- Improved Error Messages: Cleaned up and clarified various error messages for better readability.
- Projects Page Fixes: Improved layout and stability on the Projects page for smoother navigation.
- Webhook Settings: Fixed Azure webhook link display for easier configuration.
- Scan Overview API: Fixed an issue that could cause server errors when loading scan overviews.
- Command-Line Scans: Improved handling for CLI-based scans to ensure smoother operations.
- General Bug Fixes & Improvements: Various performance and reliability enhancements across the platform.
Major Platform Updates:
- Complete UI Redesign: Overhauled the entire user interface with modern design principles and improved user experience.
- Performance Optimization: Significantly improved platform performance with faster load times and smoother interactions.
- Mobile Responsiveness: Enhanced mobile experience with responsive design improvements across all pages.
- Advanced Vulnerability Detection: Upgraded security scanning algorithms to detect more sophisticated threats.
- Real-time Security Monitoring: Added continuous security monitoring capabilities for immediate threat detection.
- Enhanced Compliance Reporting: Improved compliance reporting features with more detailed analytics and export options.
- New API Endpoints: Added 1new API endpoints for better third-party integrations.
- Webhook Enhancements: Improved webhook reliability and added support for custom payload formats.
- CI/CD Pipeline Integration: Enhanced integration with popular CI/CD platforms for seamless security scanning.
- Improved Documentation: Comprehensive updates to API documentation and developer guides.
- Better Error Handling: Enhanced error messages and debugging capabilities throughout the platform.
- Scalability Improvements: Enhanced platform scalability to handle increased user load.
- Monitoring & Alerting: New monitoring systems and alerting mechanisms for better system reliability.
- New scans page to view all scans with filters
- Filtering on the reporting page
- Fix feedback redesign
- New Dropsite
- New User management views
- Admin and user token rotation
- New reporting page
- Signin redesign
- Registration redesign
- New issue view. View by CWE, File or all the issues.
- Diff viewer line-by-line or side-by-side
- Added Additional Instructions to inform engineers of additional steps needed
- Advanced False Positive Detection
- Support to fix Checkmarx SAST scan findings
- New Dropsite to upload code and vulnerability data without the Corgea CLI
- Added Azure DevOps Integration
- Updated Github PR comment
- Added Projects pagination
- Corgea CLI pypi package
- Improvements that increased fix coverage by 10%
- New Projects view to see all projects
- Introduced Corgea Verified to show quality checks
- Improved fix quality
- White consistency improvements
- CLI improvements
- Added filter tags for Date & Issue type on the Issues table
- Introduction of Single tenant support
- CLI authentication checks before scan
- Shortened Fix explanations to improve legibility
- Security fixes
- GitHub Oauth login and registration
- GitHub App for Corgea
- Improved how to fix vulnerable code in large functions
- Updated Fix and Quality models to increase fix quality
- Added Projects to the filter criteria on the Issues list page
- C# language support
- Sorting and filtering of issues
- New CLI tool
- Additional fix quality checks
- CodeQL support
- Github integration for issuing fixes
- Ruby language support
- Java language support
- Go language support
- Added download fix as a git diff and a full file
- Added email notification when fixes are available
- Added ability to delete issue
- Code integrity improvements