Release Notes — July 4, 2026

This release reworks how Fencer catches impersonating domains, brings three refreshed experiences to all accounts, and adds a batch of improvements across vulnerabilities, domains, and cloud.

GitHub users, heads up: we’ve updated the permissions on our Fencer Code GitHub app to support features coming soon. If you receive an email from GitHub asking you to review and accept them, please approve it — see Updated GitHub App Permissions below for details.

New Features

Refreshed Domain and Network Pages

The reworked Domains and Network pages are now available to everyone. Alongside the new layout, the scan-all action on the domain, network, and architecture pages is now called Discover, matching what it actually does: finding new assets.

Security

Signups using disposable email addresses are now blocked, keeping throwaway accounts off the platform.

Improvements

Reworked lookalike domain detection (formerly phishing detection). Our detection of impersonating domains has been reworked with deeper analysis and renamed to lookalike domain detection. These are typosquats and copycat registrations that could be used to phish your users or employees. Confirmed lookalikes are now filed as vulnerabilities on the domain scan, so they flow through the same review and remediation process as everything else.
Clearer deferred-vulnerability workflow. Deferred vulnerabilities are now treated distinctly from ignored ones across the app, and you can defer with a new “No fix available” reason when no upstream fix exists yet.
Bulk scope management for assets. Mark many assets in or out of scope at once from the asset inventory. Out-of-scope status now propagates down the asset graph automatically, and the in-scope filter reads from a single source of truth, so scope means the same thing everywhere.
Richer vulnerability enrichment. Dependency findings are enriched from the OSV and NVD public vulnerability databases with automatic fallback between them, enrichment recovers from upstream hiccups, and pending checks are refreshed automatically every hour.
GitHub repositories stay in sync. When a repository is deleted, renamed, transferred, or changes visibility on GitHub, Fencer now picks that up automatically and keeps your code assets accurate.
More accurate domain scanning. Certificate authority authorization (CAA) checks now validate certificates directly and work against imported DNS zone records, DNS enumeration is faster, removed DNS records are cleaned up, and Cloudflare API rate limits are respected during large scans.
Ephemeral infrastructure handled correctly. Vulnerabilities found on short-lived infrastructure no longer linger after the underlying resource disappears.
Faster pages and charts. Dashboard charts render noticeably faster, heavy views load on demand, and a layout shift when navigating has been fixed.
More resilient scans. Stuck artifact and application scans are detected and recovered automatically, scan launches retry transient platform errors, and dependency processing is more fault-tolerant under load.
Deleted items explain themselves. Opening a deleted vulnerability, scan, or finding now shows a clear message about what happened instead of a generic not-found page.
See who scheduled a fix. Vulnerability details now show which user scheduled an AI fix.
Clearer auto-assignment. When a vulnerability is automatically assigned to an asset’s owner, the owner gets a notification that explains why.
Better asset context in the vulnerability list. The asset column now shows the asset’s identifier, kind, and name instead of a single opaque value.
More accurate license classification. Dependency license detection is more precise, including correct handling of dual-licensed packages by risk category.
Set priority from the command palette. Changing a vulnerability’s priority is now available as a command palette action.
Clearer cloud scan errors. Cloud scan error messages now include provider details, so failures are easier to diagnose.
Coverage gaps are visible. The network scanning page shows a notice when vulnerability scanning is not enabled, so you can tell discovery-only coverage from full scanning.
Automatic domain discovery. Verifying a domain now kicks off domain discovery right away without a separate step needed.
Consistent inline editors. The inline pickers for assignee, priority, and owner introduced last release now share one component everywhere, so editing feels the same across all lists.
Cleaner AI fix summaries. AI fix summaries no longer reference internal check identifiers.
Stale-resource recovery for domain scans is now available to everyone: when a domain scan reconnects after an interruption, resources from the last successful scan are carried forward and marked stale, so you see continuity instead of an empty asset graph while a re-scan completes.

Bug Fixes

Fixed duplicate network service entries appearing when the same service was found from multiple sources.
Fixed notification emails failing to send when the subject line was very long.
Fixed remaining relative links in notification emails so they work outside the app.
Fixed identity sync failing for Cloudflare roles with very long names.
Fixed older bookmarked filter links that stopped working, without breaking apostrophes in current filter URLs.
Fixed select-all behaving inconsistently across vulnerability bulk actions.
Fixed bulk un-defer touching vulnerabilities that had been deleted.
Fixed deleted vulnerabilities appearing in inbox notifications.
Fixed vulnerability metrics failing when an asset was deleted mid-run.
Fixed architecture scans using the wrong network scan intensity.
Fixed domain registration checks comparing dates in different formats.
Fixed a crash in email-security (DMARC) checks during domain scans.
Fixed handling of vulnerabilities found in temporary file paths.
Fixed the endpoint Discover button failing without any feedback.
Fixed endpoint scans erroring on an empty description.
Fixed the applications empty-state button not adding an application.
Fixed untranslated labels in the asset filter menu and identity list toolbar.
Fixed the network scanning page showing an empty state even when integrations exist.
Fixed placeholder text leaking into detection alerts.
Fixed application scans of MCP (Model Context Protocol) servers failing when a server doesn’t implement an optional method, and fixed API access to the MCP endpoint for machine-to-machine tokens.
Fixed expandable detail panels resizing from accidental drags so resizing now only works from the header.

Integrations

Expanded Cloud Asset Coverage

Cloud scans now enumerate Azure Kubernetes Service (AKS) clusters and recognize additional Google Cloud resource types that previously showed up as unknown assets.

Updated GitHub App Permissions

To support some of the features we have coming soon, we’ve updated the permissions on our Fencer Code GitHub app. If you receive an email from GitHub asking you to review and accept the updated permissions, please go ahead and approve it. You can also review the app’s permissions any time from its GitHub app page.

Coming Soon

These features are currently in testing and rolling out soon:

AI Penetration Testing Agent. An AI agent that runs a controlled adversary simulation against authenticated web apps, producing structured findings mapped to a stable check catalog with OWASP risk scoring. This cycle: findings now land in the vulnerability list where you can change their status or re-verify them with a one-click AI re-check, completed pentests generate a PDF report, a scope-discovery wizard grounds targets in what’s actually reachable, credentials display safely redacted, and the agent narrates progress per sub-agent so you can follow along.
Penetration Testing v2. A rebuilt penetration testing workspace with a full-page findings inbox, detailed trace views, and filters.
User Access Reviews. A new identity-lifecycle product for running quarterly access reviews. Reviewers work through assignment worksheets with keyboard-first decisions (retain, remove, or modify), with automatic remediation tickets in Linear or Jira on non-retain decisions, sign-off and attestation, manager oversight, and evidence export. This cycle adds inline recommended vendor identities, manual identity record management, card and grid catalog views, more keyboard shortcuts, smarter next-assignment navigation, and a small celebration when you sign off.
AI Security Code Review. AI reviews now appear in the agent activity pane, review reasoning is available in a collapsible block, and review summaries stay focused on security findings.
External detection rule sources. Bring your own detection rules: connect a GitHub repository of Sigma rules (the open standard for detection rules) as a rule source, with self-serve configuration and automatic periodic sync.
Custom log source transformations. A transformation editor for custom log sources lets you author rules that normalize your own event streams on the way in, with the ingestion endpoint shown right in the setup wizard.
Heroku log source. Heroku is being added as a SIEM data source. You’ll set it up through the standard data-source flow, and Heroku log events show up in the Hunts view so you can explore them directly.
Refreshed integration setup. Connect and edit forms for individual integrations are being migrated to the new experience with consistent validation, loading states, and error handling. This wave adds Notion, Vercel, Railway, and Fathom.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.