Release Notes — June 5, 2026

A batch of features that were in early access are now stable and available to everyone, including a dedicated workflow for reviewing vulnerabilities, a daily email digest of new findings, and a repository picker that works across GitHub, GitLab, Bitbucket, and Azure DevOps. Inline suppression now applies to secrets, and you can add threaded comments to SIEM detections.

New Features

Vulnerability Review Workflow

The dedicated vulnerability review workflow is now generally available. It gives you one place to work through vulnerabilities one at a time and decide what to do with each. This release adds the ability to defer a vulnerability from the review screen, a cleaner filter layout you can edit inline, a review screen that hides off-task actions so you can focus, more visible keyboard shortcuts, and a wrap-up step that handles anything you skipped. Reviewing is faster with auto-advance and auto-focus as you move through the queue.

Multi-Provider Repository Picker

The new add / suspend / scope / remove repository picker is now generally available across GitHub, GitLab, Bitbucket, and Azure DevOps, so you can manage which repositories Fencer scans without leaving the app.

Daily Vulnerability Digest

A new daily email digest summarizes important vulnerability activity across your organization so you can keep on top of incoming findings without opening the dashboard.

Inline Suppression Now Covers Secrets

Inline suppression comments — nofencer, nosec, and nosemgrep — now also suppress secret-leak findings. You can mark known-safe values directly in source and have them respected during subsequent scans, the same way code-scan findings already worked.

Comments on Detections

Add comments directly on SIEM detections to capture investigation notes, decisions, and follow-ups. Comments include full create/read/update/delete, threaded display, and notifications so the team sees activity in real time.

Agents View Generally Available

The Agents view is now generally available for all accounts. It brings all of your AI fixer activity into a single view, replacing the older AI-fixes tab, so you can see what the fixers have done and what they’re working on in one place.

Refreshed User Settings

The refreshed user settings experience is now generally available with a cleaner layout and faster navigation. The legacy settings page has been retired.

Refreshed Organization Settings

Organization settings have been migrated to the refreshed experience with a Phase 2 UX update, matching the rest of the modernized navigation.

Asset Owner Auto-Assignment for Endpoint Vulnerabilities

Endpoint vulnerabilities now inherit their asset owner automatically. New findings get assigned to the right person on day one, reducing manual triage routing.

Configurable Vulnerability Notification Threshold

You can now configure a minimum severity threshold for vulnerability notifications. The threshold applies to every notification channel — email, Slack, and anywhere else you receive vulnerability alerts — so high-volume integrations don’t drown the signal.

Improvements

• Better AI fixer onboarding and recovery. AI fixer prompts are now specialized by vulnerability category, the IAM and GCP permissions the fixer needs are published in onboarding so auto-remediation works on day one, and when a fixer hits a permission error you get an actionable IAM remediation hint. AI fixers can now automatically open a pull request when a fix is ready.
• Sharper container and dependency findings. Container registry contents are validated before scanning, distroless images get tailored remediation text, and Go module package names with /vN path segments are now handled correctly. The code scanner supports SSH-authenticated git clones. Upstream fix availability for dependencies is now visible on endpoint vulnerabilities.
• Quieter, more accurate findings. We tightened false-positive detection across the board: version environment variables no longer trip secret detection in cloud scans, secret-in-env findings on cloud resources ignore reference-value placeholders, private-key findings with an empty PEM body are skipped, and a broader range of test and fixture paths are now recognized. Network findings no longer leak the underlying scanner tooling name.
• More reliable email notifications. Individual vulnerability notification emails are now batched, deferred vulnerabilities are excluded from email sends, and important-vulnerability notification wording is aligned across channels.
• Navigation and workspace UX. Double-click the sidebar resize handle to toggle minimum or maximum width. Global keyboard shortcuts now work everywhere and the shortcuts help menu has been refreshed. The secrets list supports infinite scroll, the app loading splash mirrors the refreshed navigation, and the reviews tab has a clearer icon.

Bug Fixes

• Fixed dropdown menus that closed before an option could be selected, a duplicate Inbox link in the expanded nav, incorrect nav header padding, navigation that redirected home when the drawer was open, a filtered-vulnerabilities link in tasks that wasn’t actually applying the filter, the Won’t Fix badge wrapping, unknown fix-state display, the organization selector display, and a stale hover cursor on the nav resize handle.
• Vulnerability review fixes: assignees, a server error when starting a new review, queue items occasionally not being marked reviewed after a fix, the progress icon, vulnerabilities still showing for soft-deleted assets, and filters not being applied on the initial vulnerabilities query.
• Integration and notification fixes: the GitHub post-install redirect, archived and unarchived repository events, the GitHub Fencer summary page link, container registry errors that were silently swallowed instead of surfaced to you, the unreachable “And N more…” Slack overflow block for secrets, and a URI collision on asset creation. Network-service vulnerability deduplication now scopes correctly to the organization.
• Restored the noise-reduction filters on the Threat Hunting page that had stopped applying.

Coming Soon

These features are currently in testing and rolling out soon:

• Security Advisory feed. Continued refinement on the Security Advisory feed: collapsible entries with per-risk-level finding counts, the summary split into independently rendered sections, integration health and outdated status surfaced inline, smarter nightly trigger heuristics, rate-limited manual triggers, auto-recovery of stale reviews, and explicit failure-state tracking for architecture scans.
• Refreshed Domain Management UI. The reworked Domains and Network pages are in the home stretch. Recent updates resolve slow page loads, fix empty-state behavior, and add UX polish after the layout merge.
• Custom Log Source Ingestion Wizard. A new wizard for setting up custom HTTP log sources is in testing, making it possible to ingest custom logs into Fencer without an engineer building a one-off integration.
• Code scanning that follows how data flows. Per-customer source-to-sink dataflow rules are in testing for the code scanner. Findings will be backed by reasoning about how untrusted input reaches a sensitive operation, rather than pattern matches alone — meaningfully reducing false positives on dataflow-sensitive vulnerabilities.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.