🚀 What’s New
- Scan Modules Settings Page: You can now configure every scanning engine — code, dependency, secret, container, IaC, license, XBOM and more — from a single, clean Settings > Scan Modules section. One card per scan bundle lets you toggle engines, set severities, and open advanced options in a slideover. The old connector catalog page is gone, with a seamless redirect to the new home.
- Role Permission Matrix: Settings > Roles is now a clear View / Edit / Manage matrix organized into five resource groups — including a dedicated Source-Code Providers group for GitHub, GitLab, Bitbucket, Azure DevOps and others. Every checkbox controls a real permission, so you can confidently grant developers, compliance officers, or DevSecOps engineers exactly the access they need without guessing.
- Compliance Control Titles on the Dashboard: The Compliance dashboard now shows the canonical title for each control (e.g., A.8.8—Webfiltering) instead of raw identifiers. Controls that were previously split across multiple name variants are unified, so the mostviolatedcontrols chart ranks accurately and per-framework counts are no longer inflated.
- XBOM Per-Repository Analysis Status: A new Repositories tab on the XBOM page shows every repository’s analysis state at a glance — never analysed, analysed with zero components, or analysed with N components — with per-bundle detail (SBOM, CBOM, AIBOM) on expand. You can launch analysis directly from the grid.
- AI Pentest Abort Action: You can now abort a pending or running AI Pentest directly from the pentest list. A confirmation dialog prevents accidental cancellations, and cancelled pentests that delivered no report or findings are refunded in full.
- PlexiFlow Approvals and Test Runs: Automation approvals are now role-enforced — only the designated approver role can approve or reject a gate, preventing unauthorized decisions. The flow editor’s Test Run no longer requires a pasted finding ID; instead, a searchable picker of recent findings lets you test any trigger type instantly. The canvas now shows labelled branch handles for IF, on-failure, and SWITCH cases.
- Findings PDF Assessment Report: The findings PDF export is restructured as a full assessment report — with an executive summary, risk-at-a-glance KPIs, scope and methodology table, and a Bottomline callout highlighting your top repository, largest finding category, and EPSS coverage. Platform severity colors are used throughout for at-a-glance prioritization.
🛠 Improvements
- AI SAST C#/.NET Coverage: Deep Analysis now detects .NET-specific sinks across , , and files — including SQL injection, process arguments, file operations, certificate validation, XML resolution, cookie and CORS configuration, and weak crypto. The caller graph traces tainted values up to two hops through repository and service layers, marking HTTP entry points so you can see the full attack path.
- AIBOM Library Detection: XBOM now detects AI and ML libraries in your dependency manifests (requirements.txt, pyproject.toml, package.json, .csproj), so your AIBOM inventory stays current as developers add machine-learning dependencies.
- BYOAI Connection Management: You can now manage your bring-your-own-AI connections — Fast (validation) and Smart (remediation) models — from a unified AI Connections API. Connection test results are clearer: a transient modelbusy response from your provider no longer looks like a configuration mistake, and the pre-flight check retries with backoff before giving up.
- Repository Creation Error Reporting: When adding repositories in bulk, the workflow now reports each repository’s real failure reason — expired token, duplicate name, webhook failure — instead of a generic success. Partial runs tell you exactly how many succeeded (CreatedXofY), so you know what to fix.
- Remediation State Per Finding: Starting a Codex Remedium remediation on one finding no longer shows a spinner on every other finding in the list. The Creatingremediation… state is now scoped to the individual finding that initiated it.
- Rescan Safety: The Rescan action now checks your Azure DevOps connection before deleting the repository record, preventing a scenario where a failed re-creation leaves you with zero history. If the credential is expired, Rescan stops and tells you — no data loss.
- Settings Navigation: The XBOM sidebar entry intelligently hides when your tenant has XBOM disabled, and reappears the moment a repository has an XBOM override enabled — so the navigation always reflects what you can actually use.
- Pentest Detail Clarity: When an AI Pentest runs without an authenticated session (e.g., a rejected login), the detail page now clearly states thescanranwithoutasession instead of implying it was never launched.
🔒 Security
This release includes a comprehensive security hardening pass across tenant isolation, data exports, and authentication:
- Tenant settings isolation strengthened: Connector, plugin, and tool names are now strictly allowlisted, so a tenant administrator can no longer address or overwrite settings outside their own connector scope — including plan tier, SCM tokens, AI configuration, or billing details.
- Finding exports restricted to web sessions: CSV downloads, PDF reports, and SARIF exports now require an interactive web session and return 403 to API tokens. Advanced query filters on internal fields are blocked for API tokens, and the AI Magic Filter no longer exposes internal engine names through the API.
- AI Pentest data sanitized for API tokens: API-token access to pentest results now returns only customer-safe fields — status, severity counts, target URL, and report availability. Engine logs, pod names, object-storage keys, and workflow identifiers are no longer exposed through the API.
- 2FA login response hardened: The two-factor authentication challenge no longer returns the TOTP secret in the login response, so a compromised password alone cannot compute the second factor. Users enrolled in 2FA before this release should re-enroll to benefit from the strengthened flow.
- API token management and revocation: You can now revoke API tokens by ID, view last-used timestamps, and log out from the Plexicus TUI. Legacy token exchange is deprecated with a clear migration path.
- Billing routes secured: Self-service plan changes and payment endpoints are disabled and return 410 Gone. Marketplace and Stripe routes now enforce strict tenant ownership checks, so no authenticated user can act on another tenant’s billing objects.
- Role enforcement on billing and custom tools: Invoices, subscription details, and custom scan-tool configuration are now gated behind admin-level permissions, closing gaps that previously allowed any role to read or modify them.
- Audit log chain verification: The tamper-evident audit log now streams chain verification efficiently and tolerates retention-edge boundaries, so integrity checks remain reliable as the log grows.
🔧 Fixes
- Findings list stability: The findings list no longer flashes empty or applies stale responses when navigating, and the repository catalog loads once instead of repeatedly.
- False-positive mute: Muting a false positive now correctly opens its pull request, and un-muting cleans up the associated resources properly.
- Failed scan tool state: Tools that previously failed or degraded during a scan are now cleared to a clean state after a successful rescan, so stale failure reasons no longer linger.
- GitHub OAuth reconnect: Completing a GitHub connection via OAuth no longer fails with a redirect URI mismatch. If a previous connect attempt failed, simply reconnect.
- Roles grid accuracy: The Roles permission grid now accurately reflects which endpoints each scope controls — boxes that casbin would deny now render unchecked instead of falsely appearing granted.
- Azure DevOps repository display: Azure DevOps repositories are shown without the project ID prefix in assets, findings filters, and pentest pickers, keeping names clean and readable.
- Connector provider icons: Square mark-only icons are now left-aligned with their headers, and the official AWS Secrets Manager icon is used.