2026

Last updated: Jul 17, 2026

July

Release 29

(DB) Include/exclude filtering for CWE and weakness: The vulnerability filter panel now supports include and exclude modes for CWE and weakness, letting teams scope results to specific weakness types or exclude categories from their view.
(ASPM) Export billing history authors as CSV: The billing history authors table at the organization level now includes a CSV export option.
(SAST) New rules:
- Elixir Insecure File Permissions
(Reachability) New rules:

Release 28

(ASPM) Secrets detection in the Peer Reviewer Assistant: The Peer Reviewer Assistant now runs the Secrets Scanner on pull request diffs alongside SAST and SCA on GitLab and Azure DevOps.
(MCP) Secrets Scanner tool in the MCP server: Authenticated AI agents can now invoke the run_secrets_scanner tool, which guides them through detecting hardcoded secrets and credentials in a codebase.
(DB) Events renamed to Signals: The vulnerability detail panel and list filter now label real-world exploitation activity as Signals, showing the plain count with a tooltip explaining the metric.
(DB) Components section in the Database: The new Components section lists every version of a software component and indicates which versions are vulnerable, covering containers, binaries, and kernels beyond dependency packages.
(DB) Package field links to its detail view: The package field on vulnerability pages is now styled as a link and opens the component's page in the new Components section instead of filtering the vulnerability list.
(SAST) New rules:
(SS) New rules:
(Reachability) New rules:

Release 27

(IDE Plugin) Feature parity between VS Code and IntelliJ IDEA: All IDE extension capabilities — viewing vulnerabilities, generating remediation recommendations, and generating autofixes — are now available in both VS Code and IntelliJ IDEA.
(IDE Plugin) SCA remediation recommendations in IntelliJ IDEA: Developers can now generate AI-assisted remediation recommendations for SCA vulnerabilities directly from IntelliJ IDEA, matching the capability already available in VS Code.
(IDE Plugin) SCA autofixes for JavaScript and Python in both IDEs: The IDE extension now generates diff-based autofixes for SCA vulnerabilities in JavaScript and Python package managers, available in both VS Code and IntelliJ IDEA.
(DB) VLAI Severity now available across the Database: Every vulnerability in the Database now displays a VLAI severity rating (Critical, High, Medium, or Low) and can be filtered by it, giving teams an AI-assisted signal to complement CVSS and EPSS when prioritizing fixes.
(SAST) New rules:
(SS) New rules:
(Reachability) New rules:
- CVE-2023-46229
- CVE-2025-1302

June

May

Release 22

(ASPM) Accuracy SLA now available on the platform: Customers with at least one group in the Advanced plan can now see their Accuracy SLA directly on the platform.
(SCA) Elixir support: Hex is now supported as a package manager, enabling SCA scanning for Elixir projects.
(SCA) Rust support: Cargo is now supported as a package manager, enabling SCA scanning for Rust projects.
(DAST-WEB) New rules:
(DAST-API) New rules:
(SAST) New rules:
(SS) New rules:

Release 21

(DB) Common name search for weaknesses: Users can now search weaknesses in the Database using common vulnerability names such as IDOR, BOLA, or Broken Access Control, without needing to know their formal name.
(DAST-WEB) New rules:
- Http Content Type Header Missing
- Http Serves Content Over Http
(SAST) New rules:
(SS) New rules:

Release 20

(IDE Plugin) Right-click link to criteria, platform and vulnerability description in IntelliJ IDEA: Right-clicking a vulnerability in the IntelliJ IDEA plugin now provides a direct link to its criteria page, platform entry, and vulnerability description on db.fluidattacks.com, improving developer context while triaging findings.
(ASPM) Scope banner with registered inputs count: A new informational banner in the Scope section now displays a count summary of all registered inputs, giving teams an at-a-glance view of their attack surface coverage.
(DB) Filter rules by weakness: The rules filter in the Database now supports filtering by weakness, allowing users to quickly narrow down rules associated with a specific security weakness.
(DB) Improved KEV exploit source count: The KEV signal now shows the number of independent sources that report an existing exploit (0–n sources), replacing the previous binary display to support clearer vulnerability prioritization.
(DB) Reachability support filter: A new filter for reachability support has been added to the Database, enabling users to surface only vulnerabilities for which reachability analysis is available.
(DB) Events filter: A new Events filter has been added to the Database, allowing users to filter vulnerabilities that have associated news articles or external internet references.
(DAST-WEB) New rules:
(SAST) New rules:
(SS) New rules:
(Reachability) New rules:

April

Release 18

(Compliance) Enterprise-Grade Security & Compliance Certifications: Fluid Attacks achieved ISO/IEC 27001 and ISO/IEC 27701 certification, with controls aligned to ISO/IEC 27017 and ISO/IEC 27018, a SOC 2 attestation and SOC 3 report, PCI DSS validation, and measures designed to support GDPR compliance.
(ASPM) The Health Check filter in the Git Repositories table now includes a third option: "Requested," which was previously missing. Filter labels have also been aligned with the values shown in the table column, changing "Yes" / "No" to "Included" / "Not included" / "Requested" for consistency.
(DB) Defines filters have been updated to recognize and expose the Rust ecosystem properly: Support for Rust advisories was previously available only at the data/source level; it is now fully reflected in the filter interface.
(IDE Plugin) SCA autofix for JavaScript: npm, Yarn, and Bun are now supported, enabling one-click SCA dependency fixes for JavaScript projects from the Fluid Attacks IDE extensions.
(SAST) New rules:

Release 17

(ASPM) Add filters.rootNickname in vulnerabilities: Added a filters.rootNickname parameter to group.vulnerabilities and finding.vulnerabilities, allowing API users to filter vulnerabilities by root directly instead of relying on ambiguous combinations of search, where, and whereStartsWith.
(CI Gate) Add GitHub action: Added a custom GitHub Action for the CI Agent, enabling clients to integrate it directly into their CI pipelines without manual setup or configuration.
(SS) New rules:
(DAST-WEB) New rules:
- Http Trace Enabled
- Ssl Tls Certificate Revocation Not Checked
(SAST) New rules:

Release 16

(ASPM) Improve "Add environment" flow: reorder fields and add Frontend/Backend distinction: Restructured the “Add environment” modal to improve configuration flow, introducing a clearer order for environment type, connection method, production context, frontend/backend URL classification, and conditional authentication settings with contextual guidance.
(CI GATE, CSPM, DAST, MAST, SCA, SAST) Deploy public container images to GHCR alongside DockerHub: Published public scanner images to GitHub Container Registry (GHCR) and migrated them to the centralized container-builder for unified CI workflows and multi-arch support.
(DB) Enhancing EPSS Value with Temporal Context: Added a tooltip with a last-updated timestamp to the EPSS field, giving clear visibility into how current the data is and supporting more confident, informed vulnerability prioritization.
(DB) Original filter for DB: Added an Original Severity filter to the vulnerabilities page, allowing users to filter by CVE source severity alongside the existing adjusted severity filter.
(SS) Add secret scan github action: Added infrastructure and a GitHub Action for the new secret scanner, including Docker image creation and publishing to DockerHub and GHCR.
(SS) New rules:
- DOCKER HUB ACCESS TOKEN
- SLACK TOKEN
(DAST-API) New rules:
- API Permissive Cors Policy
(DAST-WEB) New rules:
- HTTP Cookie Missing Cache Control
(SAST) New rules:

Release 15

(SCA) Add severity field and severity threshold to scanner output: Added cvss_v4_severity to scan results and a strictness_threshold config flag to fail pipelines only when vulnerabilities at or above the configured severity floor are found.
(IDE Plugin) Improve authentication and loading messages in IntelliJ plugin: Added visual state indicators (spinner, alert, and check icons) and adjusted dark mode contrast using standardized colors for clearer feedback during authentication and vulnerability loading.
(ASPM) Redesign Groups data panel to show attack surface and vulnerabilities: Added new Attack Surface and Vulnerability Summary sections, including repository coverage metrics (with/without OAuth) and a detailed breakdown of total vulnerabilities, CVSSF, and severity distribution.
(ASPM) Migrate platform authentication to Auth0: Replaced in-house Google, Microsoft, and Bitbucket authentication flows with Auth0, enabling built-in MFA, OTP, and third-party integrations while reducing application complexity.
(ASPM) Track severity updates in vulnerability and weakness history: Approving a severity update now records a timestamped entry in both the vulnerability and weakness tracking timelines.
(SAST) New rules:
(SS) New rules:

Release 14

(DB) Improve Fixes section: Reorganized the Fixes section with top-level groupings (Code, Infrastructure, Packages), introducing a dedicated SCA navigation model (Ecosystem → Fix) with initial coverage for TypeScript, Python, and Kotlin.
(DB) Add Exploit signal (ordinal) and improve EPSS display: Added exploit availability as an ordinal signal (0–n sources) with filterable groupings and simplified EPSS display format to support clearer vulnerability prioritization.
(SAST) New rules:
(SS) New rules:

March

Release 13

(IDE Plugin) Remove redundant repository selection pop-up when project is already open in IDE: Now our VSCode and Cursor extensions auto-detect the active repository when a project is already open, eliminating the repository selection pop-up.
(ASPM) Standardize file input experience in Add File modal: Processing is now indicated via the Upload button loading state, with the modal closing on completion and feedback shown through global notifications.
(ASPM) Minimum privilege for organizations and groups: Introduced per-organization and group activity tracking to replace the global last-activity check, enforcing least privilege by revoking access only for inactive orgs/groups while preserving access where the user remains active.
(ASPM) Restrict environment and repository exclusion to privileged roles only: Restricted scope exclusion permissions to group managers only, preventing users and vulnerability managers from excluding environments or repositories and reinforcing least-privilege governance.
(DB) Improve detail panel structure to show Base vs Adjusted CVSS + vectors: Scope now shows both Base (source) and Adjusted CVSS (Fluid) with vectors, clearly differentiating them to improve traceability and clarity.
(SAST) New rules:

Release 12

(ASPM) Add supported and tested columns to Lines table: Added language support and Machine testing status columns to the Lines table for file-level visibility.
(ASPM) Improve Groups filters: Updated Groups section filters to be functional and aligned with the target registration flow improvements.
(ASPM) Add Cursor to Integrations: Added Cursor as an available option in the platform Integrations section.
(ASPM) Restrict environment exclusion toggle to authorized roles: Limited the environment URL exclusion toggle to authorized roles, preventing unauthorized scope changes and vulnerability closures.
(CI Gate) Show EPSS and reachability in SCA execution logs: Added EPSS score and reachability status to execution logs for SCA vulnerabilities.
(SAST) New rules:

Release 11

(MCP) SCA remediation with AI agents: Added repository context configuration to the MCP server, enabling autonomous SCA vulnerability remediation via AI agents.
(ASPM) Display 'No fix available' guidance: Added actionable guidance when vulnerabilities have no remediation path (EOL packages, abandonware, pending fixes).
(ASPM) Improve Location filter with selector and search options: Replaced free-text Location filter with a selector supporting nickname, base URL, prefix matching, and full-text search.
(ASPM) Improve 'New Group' modal for target registration: Added target type and target evaluation stage fields to the New Group creation flow.
(DB) Dynamic filter options: Filter options are now generated dynamically based on available results, preventing empty result combinations.
(IDE Plugin) IDE SCA remediation options: Added multiple SCA remediation options to GenAI-powered fixes in the VSCode extension.
(Docs) Add fix guide for transitive dependency vulnerabilities: Added guide covering lockfile refresh, overrides, and shrinkwrap removal strategies.
(Docs) Add SAST and SCA GitHub Actions to CLI docs: Documented the new SAST and SCA GitHub Actions with auto-detected scan modes.
(SAST) New rules:

February

Release 9

(SCA) Add support for new package managers: Added support for CocoaPods (Podfile parser), Bun, and RubyGems (.gemspec) package managers.
(SCA) Add SCA remediation options to vulnerability details: Added remediation options (closest min fix, safe fix, complete fix) for direct and transitive dependencies.
(Docs & DB) Standardize central layout and sidebar widths: Constrained main content and sidebar widths on large screens to improve readability and layout consistency.
(ASPM) Update Groups table to match new group modal: Updated the Groups section structure to align with the new group creation flow and target registration improvements.
(ASPM) Allow editing environment authentication field: Enabled editing of the "Requires Authentication" field on existing environment records.
(ASPM) Relocate CI Gate token and installation guide: Moved CI Gate token management and installation guide from Scope to DevSecOps section.
(SAST) New rules:

Release 7

(DAST) Update scanner technique to MAST: Update APK scanner to replace DAST with MAST across the entire flow, including Docker image (mast scan config.yaml).
(DB) Make general search bar index vulnerabilities: Extend the main search bar indexing to include vulnerabilities (e.g., CVE identifiers) for direct discovery and navigation.
(DB) Add "View JSON" link to vulnerability's detail page: Add a "View JSON" link to vulnerability detail pages, pointing to the data.json endpoint and opening in a new tab.
(DB) Improve Log in: Rename "Get started" to "Try for free" and add a clear ghost "Log in" button in the top bar. Align flow with design system, including avatar dropdown with user info and ghost "Log out."
(DB) Scalable filter UX for Database: Group multiple vulnerability filters under the default Filter dropdown and remove highlighted filters. Reserve the highlighted filter for a single dominant case to ensure scalability and a clean hierarchy.
(DB) LLMs.txt: Add an llms.txt endpoint to improve consumption of DB pages by LLMs.
(IDE Plugin) Enhance IntelliJ sidebar: Add severity icons to the IntelliJ plugin sidebar, categorized by typology, to improve visual context and prioritization of weaknesses.
(MCP) Add output file configuration to MCP scanner tool prompts: Add a default output section to YAML examples in MCP scanner tools to generate Fluid-Attacks-Results.csv instead of stdout-only results.
(SAST) New rules:

Release 6

(Docs & DB) Add multiple authentication methods: Added Google, Microsoft, LinkedIn, Bitbucket, and internal login as authentication options.
(DB) Add detection status to vulnerabilities: Added a flag indicating whether each vulnerability has been detected at least once.
(ASPM) Add KEV and EPSS metrics to Package Details: Added KEV and EPSS metrics to the Package Details view to provide better vulnerability context for clients.
(SAST) New rules:

January

Release 5

(ASPM) Azure integration now supports Bug as a work item type: Our integration can create work items of type 'Bug', which is useful for users or clients whose projects do not have the 'Issue' type available.
(SAST) New rules:

Release 4

(ASPM) Prevent accidental rejection of access invitations: An extra confirmation step was added to the platform's invitation flow to avoid accidental rejections caused by automated email link scanning.
(SAST) New rules:

Release 3

(ASPM) Warn users about potential additional costs when changing branches: A warning and checkboxes were added when users modify branches from a repository under the scope section to clarify that this action can impact the cost of the service.
(SAST) New rules:

Release 2

(ASPM) Mark AI-detected vulnerabilities (AI SAST): Added a visual AI indicator to AI SAST findings to highlight the new technique.
(SAST) New rules:

Release 1

(SAST) New rules:

F064 Java session id not regenerated
F014 Dart mirrors unsafe reflection

Free trial: Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.