New v1.2.25

Plexicus v1.2.25: Multiple SCM Accounts & Smarter CVSS Scoring

Connect multiple SCM accounts per provider for flexible repository onboarding, and benefit from more accurate, NVD-backed CVSS scoring across your findings.

🚀 What’s New

  • Multiple SCM Accounts: You can now connect multiple SCM accounts per provider — including GitHub, GitHub Enterprise Server, GitLab self-hosted, and Bitbucket — all within a single client. This replaces the previous one-connection-per-client limit, giving you the flexibility to manage repositories across distinct organizational accounts without needing separate clients. Revoked connections are cleanly removed, and webhooks route automatically to the correct account.
  • CVSS Quality Improvements: CVSS scores on your findings are now version-agnostic and enriched with NVD integration, giving you more consistent and trustworthy severity assessments across your entire vulnerability backlog.

🔧 Fixes

  • GitHub OAuth Login: GitHub-based sign-in is fully restored — the post-callback lookup now correctly resolves your account and no longer fails on username/email mismatches.
Qualification

Check whether AI Swarm Pentest fits your environment.

Share the minimum context. We will review the scope and tell you the next commercial step.

Before submitting — verify you fit

Teams with fewer than 50 developers: start a 14-day Trial instead of booking a demo. Start a 14-day Trial →

0 / 280

No commitment. If you don't fit, we'll tell you.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorised target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)