(IDE Plugin) Feature parity between VS Code and IntelliJ IDEA: All the features of the IDE extension are available in VS Code and in IntelliJ IDEA. In the two IDEs, you can see vulnerabilities, get remediation recommendations, and get autofixes.
(IDE Plugin) SCA remediation recommendations in IntelliJ IDEA: Developers can get AI-assisted remediation recommendations for SCA vulnerabilities directly from IntelliJ IDEA. VS Code had the same feature before.
(IDE Plugin) SCA autofixes for JavaScript and Python in both IDEs: The IDE extension produces diff-based autofixes for SCA vulnerabilities in JavaScript and Python package managers. This feature is available in VS Code and in IntelliJ IDEA.
(DB) VLAI Severity now available across the Database: Each vulnerability in the Database shows a VLAI severity rating (Critical, High, Medium, or Low). You can filter the vulnerabilities by this rating. Thus, teams can use an AI-assisted signal together with CVSS and EPSS when they prioritize fixes.
(SS) Validity checks: Secrets scanning checks a detected credential against its own provider and reports if the credential is active. Thus, teams can rotate live secrets first.
(SAST) New rules:
(SS) New rules:
- Firebase Fcm Api Key
- Paypal Secret Key
- Smtp Password
- Twitch Secret Key
- Zoom Secret Key
(SS) New validity checks:
(Reachability) New rules:
- CVE-2023-46229
- CVE-2025-1302

June

Release 26

(AI SAST) AI SAST expanded authorization and access control detection: The AI-assisted SAST scanner covers improper authorization for web services, RDS environments, and privilege escalation patterns (CWE-862).
(DAST-WEB) New rules:
- Http Debug Framework Headers Leak
(SAST) New rules:
(SS) New rules:
(Reachability) New rules:
- CVE-2021-39152
- CVE-2022-31197

Release 25

(DAST-WEB) New rules:
- Http Exposed Management Endpoint
- Http Ssti In Body
(SAST) New rules:
(SS) New rules:
(SCA) New support:
- Ruby runtime CVE detection from .gemspec: Runtime CVE detection supports Ruby projects that use .gemspec files.
- Python runtime CVE detection from Pipfile and Pipfile.lock: Runtime CVE detection supports Python projects that use Pipfile and Pipfile.lock.
(Reachability) New rules:
- CVE-2020-13756
- CVE-2025-70974

Release 24

(SCA) Runtime support for Go: The platform supports runtime reachability analysis for Go projects.
(SCA) Runtime support for Ruby: The platform supports runtime reachability analysis for Ruby projects.
(IDE Plugin) SCA custom fix in IntelliJ IDEA: Developers can view the custom fix for SCA vulnerabilities directly from IntelliJ IDEA.
(AI SAST) Expanded authorization coverage: The AI-assisted SAST scanner detects more authorization vulnerability patterns.
(DAST-WEB) New rules:
(SAST) New rules:
(SS) New rules:
(Reachability) New rules:

Release 23

(IDE Plugin) SCA autofix for Python: The IDE extensions of Fluid Attacks support these package managers: pip, Poetry, Pipenv, and uv. Thus, you can fix the SCA dependencies of Python projects with one click from these extensions.
(DAST-WEB) New rules:
(DAST-API) New rules:
- Api Sensitive Fields Unmasked
(SAST) New rules:
(SS) New rules:

May

Release 22

(ASPM) Accuracy SLA now available on the platform: Customers with at least one group in the Advanced plan can see their Accuracy SLA directly on the platform.
(SCA) Elixir support: The SCA scanner supports Hex as a package manager. Thus, SCA scanning is available for Elixir projects.
(SCA) Rust support: The SCA scanner supports Cargo as a package manager. Thus, SCA scanning is available for Rust projects.
(DAST-WEB) New rules:
(DAST-API) New rules:
(SAST) New rules:
(SS) New rules:

Release 21

(DB) Common name search for weaknesses: Users can search weaknesses in the Database by usual vulnerability names, such as IDOR, BOLA, or Broken Access Control. Users do not have to know the formal name.
(DAST-WEB) New rules:
- Http Content Type Header Missing
- Http Serves Content Over Http
(SAST) New rules:
(SS) New rules:
- Azure API Key
- DroneCI Access Token

Release 20

(IDE Plugin) Right-click link to criteria, platform and vulnerability description in IntelliJ IDEA: When you right-click a vulnerability in the IntelliJ IDEA plugin, the plugin shows direct links. These links go to its criteria page, platform entry, and vulnerability description on db.fluidattacks.com. Thus, developers have more context when they triage findings.
(ASPM) Scope banner with registered inputs count: A new informational banner in the Scope section shows a count summary of all registered inputs. Thus, teams can quickly see the coverage of their attack surface.
(DB) Filter rules by weakness: The rules filter in the Database can filter rules by weakness. Thus, users can quickly find the rules that apply to one security weakness.
(DB) Improved KEV exploit source count: The KEV signal shows the number of independent sources that report an existing exploit (0–n sources). This number replaces the previous binary display, and helps you prioritize vulnerabilities more clearly.
(DB) Reachability support filter: The Database has a new filter for reachability support. With this filter, users can show only the vulnerabilities for which reachability analysis is available.
(DB) Events filter: The Database has a new Events filter. With this filter, users can show only the vulnerabilities with related news articles or external internet references.
(DAST-WEB) New rules:
(SAST) New rules:
(SS) New rules:
- Azure DevOps Personal Access Token
- Azure Blob SAS Token
- Bitbucket App Password
- CircleCI API Token
- Confluent Cloud API Key
- Confluent Cloud API Secret
(Reachability) New rules:

April

Release 18

(Compliance) Enterprise-Grade Security & Compliance Certifications: Fluid Attacks achieved ISO/IEC 27001 and ISO/IEC 27701 certification, with controls aligned to ISO/IEC 27017 and ISO/IEC 27018. Fluid Attacks also has a SOC 2 attestation and SOC 3 report, PCI DSS validation, and measures designed to support GDPR compliance.
(ASPM) The Health Check filter in the Git Repositories table now includes a third option: "Requested." Previously, this option was missing. For consistency, the filter options also have the same names as the values in the table column. "Yes" / "No" changed to "Included" / "Not included" / "Requested".
(DB) Defines filters have been updated to recognize and expose the Rust ecosystem properly: Previously, support for Rust advisories was available only at the data/source level. At this time, the filter interface also fully shows this support.
(IDE Plugin) SCA autofix for JavaScript: The IDE extensions of Fluid Attacks support these package managers: npm, Yarn, and Bun. Thus, you can fix the SCA dependencies of JavaScript projects with one click from these extensions.
(SAST) New rules:

Release 17

(ASPM) Add filters.rootNickname in vulnerabilities: Added a filters.rootNickname parameter to group.vulnerabilities and finding.vulnerabilities. With this parameter, API users can filter vulnerabilities directly by root. They do not have to use ambiguous combinations of search, where, and whereStartsWith.
(CI Gate) Add GitHub action: Added a custom GitHub Action for the CI Agent. With this action, clients can integrate the CI Agent directly into their CI pipelines, without manual setup or configuration.
(SS) New rules:
(DAST-WEB) New rules:
- Http Trace Enabled
- Ssl Tls Certificate Revocation Not Checked
(SAST) New rules:

Release 16

(ASPM) Improve "Add environment" flow: reorder fields and add Frontend/Backend distinction: Restructured the “Add environment” modal for a better configuration flow. The fields have a clearer sequence: environment type, connection method, production context, frontend/backend URL classification, and conditional authentication settings. The modal also gives contextual guidance.
(CI GATE, CSPM, DAST, MAST, SCA, SAST) Deploy public container images to GHCR alongside DockerHub: Published public scanner images to GitHub Container Registry (GHCR) and migrated them to the centralized container-builder for unified CI workflows and multi-arch support.
(DB) Enhancing EPSS Value with Temporal Context: Added a tooltip with a last-updated timestamp to the EPSS field. The tooltip clearly shows how current the data is. Thus, teams can prioritize vulnerabilities with more confidence and better information.
(DB) Original filter for DB: Added an Original Severity filter to the vulnerabilities page. With this filter, users can filter by CVE source severity, together with the existing adjusted severity filter.
(SS) Add secret scan github action: Added infrastructure and a GitHub Action for the new secret scanner. This work also makes the Docker image and publishes it to DockerHub and GHCR.
(SS) New rules:
- DOCKER HUB ACCESS TOKEN
(DAST-API) New rules:
- API Permissive Cors Policy
(DAST-WEB) New rules:
- HTTP Cookie Missing Cache Control
(SAST) New rules:

Release 15

(SCA) Add severity field and severity threshold to scanner output: Added cvss_v4_severity to scan results and a strictness_threshold config flag. With this flag, pipelines fail only when the scanner finds vulnerabilities at or above the configured severity floor.
(IDE Plugin) Improve authentication and loading messages in IntelliJ plugin: Added visual state indicators (spinner, alert, and check icons). Also adjusted the dark mode contrast with standardized colors, for clearer feedback during authentication and while the plugin loads vulnerabilities.
(ASPM) Redesign Groups data panel to show attack surface and vulnerabilities: Added new Attack Surface and Vulnerability Summary sections. These sections show repository coverage metrics (with/without OAuth). They also show details about the total vulnerabilities, the CVSSF, and the number of vulnerabilities for each severity.
(ASPM) Migrate platform authentication to Auth0: Replaced in-house Google, Microsoft, and Bitbucket authentication flows with Auth0. Auth0 gives built-in MFA, OTP, and third-party integrations, and makes the application less complex.
(ASPM) Track severity updates in vulnerability and weakness history: When you approve a severity update, the platform records a timestamped entry in the tracking timelines of the vulnerability and of the weakness.
(SAST) New rules:
(SS) New rules:
- SONAR TOKEN
- AWS KEY
- DB CONNECTION STRING
- PRIVATE PEM KEY
- PRIVATE SSH KEY

Release 14

(DB) Improve Fixes section: Reorganized the Fixes section with top-level groupings (Code, Infrastructure, Packages). Added a dedicated SCA navigation model (Ecosystem → Fix) with initial coverage for TypeScript, Python, and Kotlin.
(DB) Add Exploit signal (ordinal) and improve EPSS display: Added exploit availability as an ordinal signal (0–n sources) with filterable groupings and simplified EPSS display format to support clearer vulnerability prioritization.
(SAST) New rules:
(SS) New rules:
- HARDCODED CREDENTIALS

March

Release 13

(IDE Plugin) Remove redundant repository selection pop-up when project is already open in IDE: When a project is open, the VSCode and Cursor extensions of Fluid Attacks automatically detect the active repository. Thus, the extensions do not show the repository selection pop-up.
(ASPM) Standardize file input experience in Add File modal: The Upload button shows a loading state while the platform processes the file. When the process is complete, the modal closes and global notifications give feedback.
(ASPM) Minimum privilege for organizations and groups: Introduced activity tracking for each organization and group. This tracking replaces the global last-activity check. Thus, the platform enforces least privilege: it revokes access only to inactive orgs/groups, and keeps access where the user is active.
(ASPM) Restrict environment and repository exclusion to privileged roles only: Restricted scope exclusion permissions to group managers only. Thus, users and vulnerability managers cannot remove environments or repositories from the scope. This change reinforces least-privilege governance.
(DB) Improve detail panel structure to show Base vs Adjusted CVSS + vectors: Scope shows Base (source) and Adjusted CVSS (Fluid) with vectors. It clearly shows the difference between them, for better traceability and clarity.
(SAST) New rules:

Release 12

(ASPM) Add supported and tested columns to Lines table: Added two columns to the Lines table: language support and Machine testing status. These columns give visibility at the file level.
(ASPM) Improve Groups filters: Updated the filters of the Groups section to make them work and to align them with the improvements to the target registration flow.
(ASPM) Add Cursor to Integrations: Added Cursor as an available option in the platform Integrations section.
(ASPM) Restrict environment exclusion toggle to authorized roles: Only authorized roles can use the exclusion toggle of environment URLs. This change prevents unauthorized scope changes and vulnerability closures.
(CI Gate) Show EPSS and reachability in SCA execution logs: Added EPSS score and reachability status to execution logs for SCA vulnerabilities.
(SAST) New rules:

Release 11

(MCP) SCA remediation with AI agents: Added repository context configuration to the MCP server. Thus, AI agents can remediate SCA vulnerabilities autonomously.
(ASPM) Display 'No fix available' guidance: Added actionable guidance when vulnerabilities have no remediation path (EOL packages, abandonware, pending fixes).
(ASPM) Improve Location filter with selector and search options: Replaced the free-text Location filter with a selector. The selector supports nickname, base URL, prefix matching, and full-text search.
(ASPM) Improve 'New Group' modal for target registration: Added two fields to the New Group flow: target type and target evaluation stage.
(DB) Dynamic filter options: The Database makes the filter options dynamically from the available results. Thus, no combination of filters gives an empty result.
(IDE Plugin) IDE SCA remediation options: Added multiple SCA remediation options to GenAI-powered fixes in the VSCode extension.
(Docs) Add fix guide for transitive dependency vulnerabilities: Added a page that explains three strategies: lockfile refresh, overrides, and shrinkwrap removal.
(Docs) Add SAST and SCA GitHub Actions to CLI docs: Documented the new SAST and SCA GitHub Actions with auto-detected scan modes.
(SAST) New rules:

February

Release 9

(SCA) Add support for new package managers: Added support for CocoaPods (Podfile parser), Bun, and RubyGems (.gemspec) package managers.
(SCA) Add SCA remediation options to vulnerability details: Added remediation options (closest min fix, safe fix, complete fix) for direct and transitive dependencies.
(Docs & DB) Standardize central layout and sidebar widths: Constrained the widths of the primary content and the sidebar on large screens. This change makes the text easier to read and gives the layout more consistency.
(ASPM) Update Groups table to match new group modal: Updated the Groups section structure to align with the new group creation flow and target registration improvements.
(ASPM) Allow editing environment authentication field: You can edit the "Requires Authentication" field of existing environment records.
(ASPM) Relocate CI Gate token and installation guide: Moved CI Gate token management and installation guide from Scope to DevSecOps section.
(SAST) New rules:

Release 7

(DAST) Update scanner technique to MAST: Updated the APK scanner to replace DAST with MAST in all of the flow. This change includes the Docker image (mast scan config.yaml).
(DB) Make general search bar index vulnerabilities: Extended the indexing of the primary search bar to include vulnerabilities (for example, CVE identifiers). Thus, you can find and open vulnerabilities directly.
(DB) Add "View JSON" link to vulnerability's detail page: Added a "View JSON" link to vulnerability pages. The link goes to the data.json endpoint and opens in a new tab.
(DB) Improve Log in: Renamed "Get started" to "Try for free" and added a clear ghost "Log in" button in the top bar. Aligned the flow with the design system. This change includes an avatar dropdown with user info and a ghost "Log out."
(DB) Scalable filter UX for Database: Grouped multiple vulnerability filters in the default Filter dropdown and removed the highlighted filters. Kept the highlighted filter only for a single dominant case, for scalability and a clean hierarchy.
(DB) LLMs.txt: Added an llms.txt endpoint. Thus, LLMs can use DB pages more easily.
(IDE Plugin) Enhance IntelliJ sidebar: Added severity icons to the IntelliJ plugin sidebar, categorized by typology, for better visual context and prioritization of weaknesses.
(MCP) Add output file configuration to MCP scanner tool prompts: Added a default output section to the YAML examples in MCP scanner tools. This section makes the tools write the results to Fluid-Attacks-Results.csv, and not only to stdout.
(SAST) New rules:

Release 6

(Docs & DB) Add multiple authentication methods: Added Google, Microsoft, LinkedIn, Bitbucket, and internal login as authentication options.
(DB) Add detection status to vulnerabilities: Added a flag that shows if each vulnerability had at least one detection.
(ASPM) Add KEV and EPSS metrics to Package Details: Added KEV and EPSS metrics to the Package Details view to give clients better vulnerability context.
(SAST) New rules:

January

Release 5

(ASPM) Azure integration now supports Bug as a work item type: The Azure integration can make work items of type 'Bug'. This type is useful for users or clients when their projects do not have the 'Issue' type available.
(SAST) New rules:

Release 4

(ASPM) Prevent accidental rejection of access invitations: The invitation flow of the platform has one more confirmation step. This step prevents accidental rejections when automated tools scan the links in the email.
(SAST) New rules:

Release 3

(ASPM) Warn users about potential additional costs when changing branches: When users change the branches of a repository in the scope section, the platform shows a warning and checkboxes. They make it clear that this action can change the cost of the service.
(SAST) New rules:

Release 2

(ASPM) Mark AI-detected vulnerabilities (AI SAST): Added a visual AI indicator to AI SAST findings to highlight the new technique.
(SAST) New rules:

Release 1

(SAST) New rules:

F064 Java session id not regenerated
F014 Dart mirrors unsafe reflection

Free trial: Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, complete this contact form.

2026

On this page