Release Notes — June 19, 2026

This release sharpens security monitoring and makes everyday triage faster. On the monitoring side, detection comments now sync both ways with Slack so investigations stay in one place. For triage, you can edit a vulnerability’s assignee and priority without leaving the list, digest notifications show up in the in-app inbox, and a new network scan tier covers just your web-facing services. The asset graph also gains network services, certificates, and a column that flags changed assets.

New Features

In-App Digest Notifications

Digest notifications now appear in the in-app inbox as well as by email, with controls so admins can decide who receives which digests. Stale digests without content are hidden, and the digest modal has a tighter layout with more readable tables.

Bidirectional Slack Sync for Detection Comments

Comments on SIEM detections now sync bidirectionally with their Slack thread. Replies you post in Slack appear on the detection in Fencer, and comments added in Fencer post back to the Slack thread, so investigations stay together no matter where the team is working.

Vulnerability Resolved Timestamp

Every vulnerability now shows a resolved-at timestamp on the detail page, in exports, and as a sortable column and filter in the list. It’s easy to see what cleared in a given window for trend reporting and audit evidence.

HTTP/HTTPS-Only Network Scan Tier

A new base tier for network vulnerability scanning targets only HTTP and HTTPS services, giving you a faster, lower-noise option when you only care about web-facing exposure.

Modified Column in Asset Graph Diff

The asset-graph diff view now includes a Modified column, so changes to existing assets are visible at a glance alongside additions and removals across architecture scans.

Network Services and Certificates in the Asset Graph

The asset graph now shows network services and certificates as their own items, alongside the domains and hosts already there. More of your attack surface in one view.

Refreshed Artifact, Repository, and Application Settings

The artifact, repository, and application settings pages have all been migrated to the refreshed experience with cleaner layout and faster navigation. A new application add form streamlines first-time setup. The legacy pages have been retired.

Inline Editing for Assignee and Priority

You can now change a vulnerability’s assignee or priority right from the list, without opening the detail page. Ideal for clearing routine triage in bulk.

Configurable Date Format

A new user setting lets you choose how dates display across the app.

Styled OAuth2 Provider Pages

The OAuth2 provider application management pages have been styled to match the rest of the modernized app.

Improvements

• Smarter network service merging. Network service merging has been overhauled to produce fewer duplicate services and more stable identity across scans. Network services are now also routable by a meaningful slug instead of an opaque ID, and the network/domain picker no longer collides on shared query keys.
• Better DNS, certificate, and SSL display. DNS and certificate discovery results are more accurate, the domain detail pages now display SSL grades and punycoded domains correctly, and the screenshot service backs off more gracefully on errors. Legacy SSL handling has moved into the Network scan.
• New domain and network scanning tools. The architecture scanner now uses an upgraded set of domain and network scanning tools, producing richer, more reliable signal that feeds the asset-graph and network-merging work.
• GitHub repo-access notice in add-repos search. When searching for repositories to add, the picker now shows a notice when Fencer cannot see a repository because of the GitHub app’s installed-repo scope, so it’s clear when a repo is missing because of access rather than a broken search.
• Daily Vulnerability Digest sorted by severity. The Daily Vulnerability Digest email now sorts findings by severity, so the most important items always land at the top.
• Bulk Linear and Jira filing in pen-test results. The pen-test results view exposes the Linear and Jira bulk action buttons, so you can file multiple findings at once instead of one by one.
• Asset slug filters on vulnerability and detection grids. Vulnerability filters now accept asset slugs in addition to IDs, and the asset slug filter no longer crashes the grids.
• Snappier navigation. Page transitions feel noticeably faster, deep-link filters reliably apply on first load, and the advanced-filter flash-to-default race on rapid tab or sidebar clicks has been fixed.
• More resilient cloud scans. Cloud scans now retry on cluster capacity errors instead of crashing, stuck scans whose runs already completed are reaped, orphaned runs roll back cleanly on task launch failures, and init-clone failures show up in the UI instead of disappearing. K8s API exceptions during DigitalOcean Kubernetes enumeration are also handled gracefully, so a single misbehaving cluster no longer fails the whole scan.
• Clearer ShellCommandExecution detail and remediation. The ShellCommandExecution check now includes more actionable detail and remediation guidance, so reviewers can act on a finding without leaving the vulnerability page.
• Expanded left nav by default. New users now see the left navigation expanded to 256px by default, matching the layout most existing users already use.
• Reviews tab moved ahead of Rules. The vulnerability Reviews tab is now positioned before the Rules tab, since the review workflow is the primary place most teams triage from after the earlier general availability.
• Clean badge hidden for failed scans. Failed or timed-out scans no longer show the Clean badge. The badge is now reserved for scans that actually completed without findings.
• Consistent loading skeletons. Loading skeletons across the app are now standardized on a shared primitive, so loading states have a consistent rhythm and feel.

Bug Fixes

• Fixed datagrid column visibility resetting on re-render, losing the columns you had selected.
• Fixed package enrichment not detecting when remote metadata had changed, so dependency findings always reflect the latest registry information.
• Fixed deferred-vulnerability notification emails so the “view vulnerability” link uses an absolute URL and no longer 404s when clicked from outside the app.
• Fixed Y-axis labels above six digits clipping on dashboard charts.

Integrations

Batch Ingestion for Custom Log Sources

Custom log sources now accept batch payloads as either NDJSON or JSON arrays over HTTPS, so you can ingest higher-volume log streams without per-event request overhead.

Cloudflare Worker Modified Detection

A new SIEM detection rule fires when a Cloudflare Worker script is modified, surfacing potentially unauthorized edge-code changes in the detections feed.

Coming Soon

These features are currently in testing and rolling out soon:

• AI Penetration Testing Agent. An AI agent that runs a controlled adversary simulation against authenticated web apps, producing structured findings mapped to a stable check catalog with OWASP risk scoring. Recent work includes multi-method credentials, app-initiated SSO redirect handling, an expanded recon toolchain, and the first production-deployable agent runtime image.
• User Access Reviews. A new identity-lifecycle product for running quarterly access reviews. Reviewers work through assignment worksheets with keyboard-first decisions (retain, remove, or modify), with automatic remediation tickets in Linear or Jira on non-retain decisions, sign-off and attestation, manager oversight, and evidence export.
• AI Security Code Review. The AI security code reviewer for pull requests is now invokable by comment, scopes GitHub check annotations to files actually changed in the PR, and pre-validates inline comment anchors against the diff to avoid stale comments.
• Dataflow-aware code scanning. The code scanner now executes per-customer taint-based rules. This is the foundation for findings that reason about how untrusted input reaches a sensitive operation, rather than relying on pattern matches alone.
• Heroku log source. Heroku is being added as a SIEM data source. You’ll set it up through the standard data-source flow, and Heroku log events show up in the Hunts view so you can explore them directly.
• Event-driven AWS CloudTrail ingestion. AWS CloudTrail ingestion is being rebuilt on an event-driven pipeline to replace the previous polling architecture, lowering lag between event time and detection time for AWS environments.
• Refreshed integration setup. Connect and edit forms for individual integrations are being migrated to the new experience with consistent validation, loading states, and error handling. This wave adds Anthropic, OpenAI, Ashby, Attio, MailerSend, Schematic, Prefect, New Relic, 1Password, Iru, Drata, Render, PostHog, OCI Registry, Supabase, Cloudflare, and Snowflake.
• Refreshed signup and onboarding flow. The signup flow has been rewritten with cleaner validation, a more deliberate step-by-step layout, and faster transitions.
• Refreshed organization management and invitations. Organization member management and invitation flows are being migrated to the refreshed experience, with a new members datagrid and improved permission handling.
• Unified Agents drawer for AI fixers. All AI fix-attempt entry points across the app open a single shared agents drawer, so every fixer interaction lives in one side panel.
• Linear and Jira issue tracking for secrets. Secret findings can now be tracked individually in Linear or Jira, expanding ticket creation beyond vulnerabilities to the secrets workflow.
• Refreshed Domain and Network pages. Continued work on the reworked Domains and Network pages: the new architecture-scan tools are wired in, page tabs are standardized, and several layout issues from earlier iterations are resolved.
• Integration-gated SIEM rules. SIEM detection rules are now gated by the integrations an organization has actually connected, so customers only see rules that can fire for their environment.
• Refreshed Pentest CSV upload. The Pentest “Upload Vulnerabilities CSV” page has been rewritten in the refreshed experience, replacing the legacy page.
• Stale-resource recovery for domain scans. When a domain scan reconnects after an interruption, resources from the last successful scan are copied forward and marked stale, so reviewers see continuity instead of an empty asset graph while a re-scan completes.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.