Nuevo v1.2.25

Plexicus v1.2.25: Multiple SCM Accounts & Smarter CVSS Scoring

Connect multiple SCM accounts per provider for flexible repository onboarding, and benefit from more accurate, NVD-backed CVSS scoring across your findings.

🚀 What’s New

  • Multiple SCM Accounts: You can now connect multiple SCM accounts per provider — including GitHub, GitHub Enterprise Server, GitLab self-hosted, and Bitbucket — all within a single client. This replaces the previous one-connection-per-client limit, giving you the flexibility to manage repositories across distinct organizational accounts without needing separate clients. Revoked connections are cleanly removed, and webhooks route automatically to the correct account.
  • CVSS Quality Improvements: CVSS scores on your findings are now version-agnostic and enriched with NVD integration, giving you more consistent and trustworthy severity assessments across your entire vulnerability backlog.

🔧 Fixes

  • GitHub OAuth Login: GitHub-based sign-in is fully restored — the post-callback lookup now correctly resolves your account and no longer fails on username/email mismatches.
Calificación

Comprueba si el AI Swarm Pentest encaja en tu entorno.

Déjanos el contexto mínimo. Revisaremos el alcance y te indicaremos el siguiente paso comercial.

Antes de enviar — verifica que encajas

Equipos con menos de 50 desarrolladores: empieza una prueba de 14 días en lugar de reservar una demo. Empieza una prueba de 14 días →

0 / 280

Sin compromiso. Si no encajas, te lo decimos.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorised target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)