(MCP) SCA remediation with AI agents: Added repository context configuration to the MCP server, enabling autonomous SCA vulnerability remediation via AI agents.
(ASPM) Display 'No fix available' guidance: Added actionable guidance when vulnerabilities have no remediation path (EOL packages, abandonware, pending fixes).
(ASPM) Improve Location filter with selector and search options: Replaced free-text Location filter with a selector supporting nickname, base URL, prefix matching, and full-text search.
(ASPM) Improve 'New Group' modal for target registration: Added target type and target evaluation stage fields to the New Group creation flow.
(DB) Dynamic filter options: Filter options are now generated dynamically based on available results, preventing empty result combinations.
(IDE Plugin) IDE SCA remediation options: Added multiple SCA remediation options to GenAI-powered fixes in the VSCode extension.
(Docs) Add fix guide for transitive dependency vulnerabilities: Added guide covering lockfile refresh, overrides, and shrinkwrap removal strategies.
(Docs) Add SAST and SCA GitHub Actions to CLI docs: Documented the new SAST and SCA GitHub Actions with auto-detected scan modes.
(SAST) New rules:

February

Release 9

(SCA) Add support for new package managers: Added support for CocoaPods (Podfile parser), Bun, and RubyGems (.gemspec) package managers.
(SCA) Add SCA remediation options to vulnerability details: Added remediation options (closest min fix, safe fix, complete fix) for direct and transitive dependencies.
(Docs & DB) Standardize central layout and sidebar widths: Constrained main content and sidebar widths on large screens to improve readability and layout consistency.
(ASPM) Update Groups table to match new group modal: Updated the Groups section structure to align with the new group creation flow and target registration improvements.
(ASPM) Allow editing environment authentication field: Enabled editing of the "Requires Authentication" field on existing environment records.
(ASPM) Relocate CI Gate token and installation guide: Moved CI Gate token management and installation guide from Scope to DevSecOps section.
(SAST) New rules:

Release 7

(DAST) Update scanner technique to MAST: Update APK scanner to replace DAST with MAST across the entire flow, including Docker image (mast scan config.yaml).
(DB) Make general search bar index vulnerabilities: Extend the main search bar indexing to include vulnerabilities (e.g., CVE identifiers) for direct discovery and navigation.
(DB) Add "View JSON" link to vulnerability's detail page: Add a "View JSON" link to vulnerability detail pages, pointing to the data.json endpoint and opening in a new tab.
(DB) Improve Log in: Rename "Get started" to "Try for free" and add a clear ghost "Log in" button in the top bar. Align flow with design system, including avatar dropdown with user info and ghost "Log out."
(DB) Scalable filter UX for Database: Group multiple vulnerability filters under the default Filter dropdown and remove highlighted filters. Reserve the highlighted filter for a single dominant case to ensure scalability and a clean hierarchy.
(DB) LLMs.txt: Add an llms.txt endpoint to improve consumption of DB pages by LLMs.
(IDE Plugin) Enhance IntelliJ sidebar: Add severity icons to the IntelliJ plugin sidebar, categorized by typology, to improve visual context and prioritization of weaknesses.
(MCP) Add output file configuration to MCP scanner tool prompts: Add a default output section to YAML examples in MCP scanner tools to generate Fluid-Attacks-Results.csv instead of stdout-only results.
(SAST) New rules:

Release 6

(Docs & DB) Add multiple authentication methods: Added Google, Microsoft, LinkedIn, Bitbucket, and internal login as authentication options.
(DB) Add detection status to vulnerabilities: Added a flag indicating whether each vulnerability has been detected at least once.
(ASPM) Add KEV and EPSS metrics to Package Details: Added KEV and EPSS metrics to the Package Details view to provide better vulnerability context for clients.
(SAST) New rules:

January

Release 5

(ASPM) Azure integration now supports Bug as a work item type: Our integration can create work items of type 'Bug', which is useful for users or clients whose projects do not have the 'Issue' type available.
(SAST) New rules:

Release 4

(ASPM) Prevent accidental rejection of access invitations: An extra confirmation step was added to the platform's invitation flow to avoid accidental rejections caused by automated email link scanning.
(SAST) New rules:

Release 3

(ASPM) Warn users about potential additional costs when changing branches: A warning and checkboxes were added when users modify branches from a repository under the scope section to clarify that this action can impact the cost of the service.
(SAST) New rules:

Release 2

(ASPM) Mark AI-detected vulnerabilities (AI SAST): Added a visual AI indicator to AI SAST findings to highlight the new technique.
(SAST) New rules:

Release 1

(SAST) New rules:

F064 Java session id not regenerated
F014 Dart mirrors unsafe reflection

Free trial: Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

2026

May

Release 22

Release 21

Release 20

Release 19

April

Release 18

Release 17

Release 16

Release 15

Release 14

March

Release 13

Release 12

Release 11

Release 10