Release Notes — August 28, 2026

This release gives you tighter guarantees on vulnerability remediation and opens up more of Fencer to more codebases. Set SLA policies with deadlines right on vulnerability and asset pages, run a single AI penetration test across every domain you connect, and protect public open source repositories for free with a status badge for your README.

New Features

GitHub organization security posture scanning

You can now scan your connected GitHub organizations and repositories directly for security misconfigurations, covering settings like two-factor authentication enforcement, vulnerability alerts, and secret scanning protections. Findings show up in your vulnerability list alongside everything else Fencer finds, so you can track and remediate them the same way.

Vulnerability SLA tracking and policies

You can now set SLA policies for how quickly vulnerabilities need to be remediated. Vulnerability detail pages show SLA status and deadlines directly, and asset posture pages summarize SLA performance as a KPI.

Customer-managed API service accounts

You can now create your own service accounts for authenticating against the Fencer API, with a dedicated settings page to manage them. Use this to give automated tools and scripts scoped API access without tying them to a person’s account.

Multi-domain AI pentest engagements

A single AI penetration test engagement can now span multiple connected domains and applications at once, each scoped correctly to what it’s authorized to test. This continues the expansion of AI penetration testing to more of your infrastructure.

Self-verified shared-hosting AI pentest targets

You can now add shared-hosting domains as AI penetration test targets and verify ownership right in the product. Hosts you haven’t verified yet are grouped as untested so you can see exactly what was excluded and why, and you can rerun the test as soon as a host is verified.

On-demand full-repository security review

AI-powered code security review can now run across an entire repository on demand. Start it directly from the repository view whenever you want the full picture, without waiting for the next pull request.

Fencer for Open Source: free scanning tier with protected status badges

Public open source repositories can now be protected under a free Fencer plan, covering static analysis, secrets, and dependency scanning. Add a “Protected by Fencer” badge to your repository to show maintainers and contributors it’s covered, with a tooltip explaining what that means.

Region scoping for cloud scans

You can now choose which cloud regions to include or exclude from scanning. Set your region preferences right on the integration’s connect form, even before the account exists.

Auto-ignore for Fencer-triaged vulnerabilities

You can now opt in to automatically ignoring vulnerabilities that Fencer’s AI triage has assessed as safe to skip, cutting down on manual review for low-risk findings.

MCP Surface inventory

Fencer now inventories the MCP servers and tools configured across your organization as part of asset discovery, so you can see what’s exposed across your MCP surface.

Correlation-based detection rules

Detection rules can now correlate across multiple events instead of only matching one event at a time: counting events, summing or averaging values, and matching patterns over time from the same source. This lets you detect brute-force sequences, unusual volume spikes, and other multi-event attack patterns that single-event rules miss.

Improvements

• Deeper visibility into application scans. Application scans now show what actually happened during a run, and findings link back to the exact request that reproduces them. Scans of dynamic, JavaScript-heavy sites are also more thorough.
• Relaunch a finished AI pentest again. You can once again relaunch a new AI penetration test pre-filled from a prior run’s configuration.
• More reliable AI penetration testing. The AI penetration test agent is more resistant to stalling on rate limits, no longer wastes time on out-of-scope substitute targets, bounds how long it spends brute-forcing credentials, and covers a broader set of attacker objectives.
• AI credit usage visibility. You can now see your AI credit usage and consumption.
• Faster posture pages. Phishing, Attack Surface, and Software posture pages load faster for large inventories, with clearer footers pinned to the bottom of detail pages.
• Live vs. snapshot view on vulnerabilities. Vulnerability detail pages now let you toggle between the scan snapshot and the current, live state of the vulnerability.
• Stuck data source setup is now recoverable. If a data source connection gets stuck while it’s being set up, you’ll see recovery options instead of it silently hanging.
• Cleaner vulnerability reference lists. Long lists of vulnerability references are now collapsed by default for readability.
• SecretSpec recommended in secrets remediation. Remediation guidance for secrets findings now recommends SecretSpec.
• Clearer scan detail headers. Scan detail pages now show the asset’s name and type in the header, not just a relative timestamp.
• Smoother monitor integration setup. New monitor integrations set up their destinations in the background with clearer step-by-step feedback, and button wording is clearer.
• DigitalOcean detection coverage. Added detection rules covering DigitalOcean account activity.
• Clearer PostHog setup instructions. PostHog connection instructions now list the required API scopes.

Bug Fixes

• Fixed the sidebar and certain detail pages forcing a full-page reload instead of navigating in-app.
• Fixed a crash on some integration edit pages.
• Fixed missing dependency records and SBOM links on some code scans.
• Fixed a delivery failure affecting AWS CloudTrail log ingestion.
• Fixed an issue preventing AI penetration test engagements from starting.
• Fixed multi-select not working in nested filter menus.
• Fixed the asset filter on the vulnerability list missing some assets.
• Fixed vulnerability details showing data from the wrong branch’s scan.
• Findings on ignored branches are now included correctly in scan results and counts.
• Fixed secret-linked issue descriptions not regenerating correctly.
• Fixed container registries and images missing from vulnerability filters.
• Fixed AI penetration test wizard steps sometimes rendering empty.
• Fixed a class of failures during AI penetration test analysis.
• Fixed AI penetration test reports incorrectly marking some attacked endpoints as not attacked.
• Fixed the Hunts time picker not respecting your configured timezone.
• Fixed repository scan settings not applying consistently across every connected git provider.
• Fixed an asset’s in-scope or out-of-scope status resetting after architecture scans.
• Fixed sign-in for native and desktop MCP clients.
• Fixed the access review list showing stale results after an action.
• Fixed missing registration data for lookalike domains.
• Fixed access reviews being reassignable to a user outside your organization.
• Fixed vulnerability group status drifting out of sync after a scan.
• Fixed editing multiple event-data filters at once in Hunts.
• Fixed missing source code snippets on some vulnerability findings.
• Fixed incorrect values shown for New Relic events in Hunts.
• Fixed detection rules that could fire without a configured data source.
• Fixed container and cloud image scans occasionally scanning the wrong artifact, which produced inaccurate results.
• Fixed rerunning a network service scan failing with an error.
• Fixed an error when ordering detections by confidence label.
• Fixed Hunts silently showing an empty page instead of an error when a query times out.
• Fixed large GitHub webhook payloads being rejected.
• Fixed AI penetration test reports occasionally failing to save on long-running engagements.
• Fixed manual container scans ignoring your configured cloud region scope.
• Improved consistency in how AI penetration test findings are validated, so confirmed findings are less likely to be dropped.
• Fixed npm packages with a “SEE LICENSE IN” license declaration showing as unrecognized.
• Fixed a crash that could occur when checking paid feature access.
• Fixed some AI penetration test data being stored in the wrong empty format.
• Fixed vulnerability finding titles sometimes showing a raw code instead of a description.
• Fixed a SIEM data source connection repeatedly failing after its credentials were revoked; it now disconnects cleanly.
• Fixed a SIEM data source occasionally receiving data before it finished being set up.
• Fixed a crash on the AI penetration test detail page in certain cases.
• Fixed a crash processing certain npm package license data.
• Fixed GitLab monitor connections retrying endlessly when missing an access token.
• Fixed an error when GitHub returns incomplete organization data.
• Improved reliability of integration connections by retrying on timeout.
• Fixed billing checks that could hang instead of timing out.
• Fixed cases where paid feature access could be checked incorrectly, including for metered features.
• Fixed a blank pentest screen on slow connections, and a failed pentest list load incorrectly reporting no pentests.

Integrations

• Cursor Origin. Connect Cursor Origin to bring its repositories into Fencer for code scanning and AI review. Installs can be started from Cursor Origin itself, and connected repositories stay in sync with what the installation actually grants access to.
• GitLab as a SIEM source. GitLab audit event ingestion for threat hunting is now generally available. Connect GitLab to bring its audit events into Hunts alongside your other data sources.
• Heroku log events. Heroku log events can now be ingested and normalized as a new data source for threat hunting.
• SecureFrame. Connect SecureFrame to sync compliance evidence automatically, import vendors, and keep identity data in sync with what’s actually in scope for your audit.

Coming Soon

These features are currently in testing and rolling out soon:

• Custom notification rules. You’ll be able to build your own rules for when and how you’re notified about vulnerabilities, detections, and pentest events, including personal rules scoped to just you.
• Stronger SSO enforcement, continued. SSO and social sign-in requirements will keep being checked every time a protected action is taken, not only at login.
• An AI security chat assistant. Ask questions about your security posture in a conversational chat interface instead of digging through dashboards.
• Faster AWS CloudTrail ingestion. A new streaming path for AWS CloudTrail events, with a clearer setup wizard for the IAM role it needs.
• Cloudflare as a SIEM source. Connect Cloudflare account activity for threat hunting.
• Better actor identification, continued. Detections and hunts will resolve actor identities more accurately using an enrichment file built for your organization.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.