Release Notes — April 24, 2026

Identity management is now generally available for all accounts, you can suppress code findings with inline comments, and the CLI now supports write operations.

New Features

Identity Management Is Now Generally Available

Identity management is now available to all accounts. Track who has access to what across your organization, review identities from connected providers, and manage vendor identities — all from a single view.

Inline Comment Suppression for Code Findings

You can now suppress individual code scan findings by adding a nofencer (or nosec) comment on the same line as the finding, or the line immediately above. The scanner will skip the finding on subsequent scans.

eval(user_input)  # nofencer — accepted risk: dynamic expression handling

See Suppressing findings with inline comments for the full list of supported comment styles and languages.

Next-Generation Code Scanning Engine

The upgraded code scanning engine is now the primary scanner across all accounts, bringing improved rule coverage and native rule support.

Penetration Test Reports

Two new report types are now available for completed penetration tests: a remediation report with prioritized fix recommendations, and an executive summary for stakeholders who need a high-level view of findings and risk. These reports are available on all completed pentests, including ones already in your account.

Vulnerability Scope and Assignee Filters

You can now filter your vulnerability list by scope and by assignee, including a “No Assignee” option to find unassigned vulnerabilities quickly.

Bulk Actions on Vulnerability Table

The vulnerability table now supports bulk ignore, defer, and state-change actions — select multiple findings and apply the same action in one step. You can also convert between ignored and deferred states in bulk.

Rule Disable Prompt

When you disable a vulnerability rule, you are now prompted to decide what to do with existing findings for that rule — ignore them, keep them, or take other action.

Entity-Backed Advanced Filters

Advanced filters now accept entity-backed values directly — pick multiple owning teams, integration sources, or vendors as filter chips and combine them across the same field without retyping. The chips group like-for-like values so the filter bar stays readable as your criteria grow.

Security Detection Event Subscriptions

You can now subscribe to security detection events to receive notifications when new detections are created, giving you real-time awareness of potential security issues.

CLI Write Operations

The Fencer CLI now supports write operations beyond read-only queries, along with pagination for all list commands and a compatibility handshake that ensures your CLI version is compatible with the current API. The Fencer CLI is still experimental — expect breaking changes between releases until we announce general availability.

API Rate Limiting and Versioning

The API now enforces rate limits with standard Retry-After and X-RateLimit headers, and supports content-type versioning so you can target a specific API version in your integration code.

Integrations

Schematic Integration for Identity Management

You can now connect Schematic to sync identities and manage access from your feature management platform.

Google Workspace Trusted App Setup

Improved setup instructions guide you through configuring Fencer as a trusted app in Google Workspace, resolving authentication issues some accounts encountered during the OAuth flow.

Azure DevOps Documentation

New documentation is available for setting up and using the Azure DevOps git integration, including repository connection, scanning configuration, and pull request annotations.

Improvements

• Network scan preview modal redesigned with a clearer layout and the “Scan All” action restored on scan-asset pages.
• Intra-file data flow analysis enabled for code scans, catching vulnerabilities where untrusted input flows to a sensitive operation within the same file.
• Linear and Jira bulk issue creation ported to the vulnerability pages, so you can create tracking tickets for multiple findings at once.
• Organization identifier renamed from “Organization ID” to “Organization Slug” in the UI, and the underlying Organization UID is now exposed for API consumers.
• Identity detail page migrated to the new interface for a faster, more consistent experience.
• Application layout refined with locked navigation width, page-specific drawer widths, and improved workspace persistence.
• Azure connection settings now include an edit UI so you can update credentials without recreating the connection.
• AWS region enumeration improved to handle opt-in regions gracefully, eliminating errors for regions you haven’t enabled.
• Scan asset pages now show “Add Application” and “Add Domain” actions instead of the generic “Integrations” button.
• GCP scanner role narrowed from roles/viewer to a custom FencerScannerRole with read-only permissions on only the resources Fencer scans. To apply the reduced privileges to an existing connection, reconnect your GCP project and grant the new custom role — see the GCP integration guide for the updated steps.
• Billing usage view expanded with an additional section for more granular usage breakdown.
• Billable contributors now displayed in the usage UI. Duplicate contributor identities are automatically consolidated.

Bug Fixes

• Fixed vulnerability default filters resetting on first page load.
• Fixed container scan failures caused by unscannable images not being filtered out.
• Fixed dependency database not updating correctly, causing missed vulnerability matches.
• Fixed welcome emails sending with a 60-minute countdown instead of the intended 5-minute delay.
• Fixed CSV upload errors when uploading to a penetration test without existing assets.
• Fixed missing subdomain records not appearing on the domain detail page.
• Fixed deleted organizations appearing in the weekly digest reports and organization selector.
• Fixed deep links to code in Azure DevOps vulnerability findings.
• Fixed Azure DevOps pull request creation failures.
• Fixed vendor catalog not displaying when the identity feature was not enabled on the account.
• Fixed duplicate DNS records being created during domain scanning.
• Fixed branch selector only showing initially loaded branches.
• Fixed scanner timeout for large container image dependency analysis, increasing the limit from 20 to 30 minutes.
• Fixed completed penetration tests incorrectly allowing modifications.
• Fixed login page errors caused by Cloudflare Turnstile widget failures.
• Fixed GCP identity sync failing for projects without the IAM API enabled, and prevented oversized role strings from causing database errors.
• Fixed Drata sync reliability with increased timeouts and better retry handling.
• Fixed GitHub and GitLab documentation links pointing to rendered views instead of raw source.
• Fixed GraphQL query escaping errors affecting New Relic integrations.
• Fixed container scans using expired AWS credentials by switching to refreshable sessions.
• Fixed database deadlocks during concurrent dependency snapshot writes.
• Fixed Slack connection health checks failing after scope changes.
• Fixed integration permission detection in the add-integration modal.
• Fixed Supabase integration showing cryptic error messages on connection failure.
• Fixed identity sync reporting errors for providers that hadn’t been configured yet.
• Fixed threat hunting queries timing out after 60 seconds on complex searches.

Security

• Resolved multiple Content Security Policy violations that caused user-visible errors — blocked inline styles on some report pages, broken Azure DevOps avatars in vulnerability findings, and intermittent script-load failures on the login page.
• Added dual webhook secret support for zero-downtime secret rotation, ensuring uninterrupted webhook delivery during credential updates.
• Removed overly broad permissions from GCP integration configuration.

Coming Soon

These features are currently in early access and rolling out soon:

• Single Sign-On (SSO) — Connect your identity provider using industry-standard protocols for centralized authentication. The core login flow, session management, and connection management API are built and in testing.
• Fencer Slack Agent — Ask Fencer questions directly in Slack via DM or mention. Get answers about your security posture, vulnerabilities, and scan results without leaving your conversation.
• Cloudflare Monitor integration — Connect Cloudflare monitoring data to your security event pipeline for unified visibility across your infrastructure.
• Improved CSV export — Export any datagrid view to CSV with better formatting and column selection.
• Page-by-page interface refresh — Vulnerabilities, secrets, identities, dependencies, vendor catalog, billing usage, and search pages are being migrated to a faster, more responsive interface.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.