Release Notes — September 11, 2026

This release brings the Fencer CLI to general availability with service accounts to match, gives you control over when repositories scan, and rounds out SIEM coverage with Cloudflare as a new source, faster CloudTrail ingestion, and richer identity correlation across your data sources.

New Features

The Fencer CLI is now generally available

You can now manage your security posture directly from the terminal. Query vulnerabilities, detections, assets, and scan results; assign, ignore, defer, and prioritize findings; and automate security workflows in your CI pipeline using a service-account token. You can also run it to expose your Fencer data to AI assistants like Claude or Cursor over the Model Context Protocol.

Install it via Homebrew, with public documentation and license notices at docs.fencer.dev, and use the new fencer whoami command to check your authenticated identity.

Reduce CI noise by configuring scan triggers

You can now choose whether a repository scans automatically on every push, or only on a schedule you configure, giving you more control over scan frequency and CI noise.

Approval controls for scanning fork pull requests

Fencer for Open Source maintainers can now require manual approval before a fork’s pull request is scanned, or opt in to automatic scanning per repository which gives you control over running untrusted code from external contributors.

Service accounts, now for CLI, CI, and MCP access

Customer-managed API service accounts can now be used for programmatic access with the Fencer CLI, in your CI pipelines, and to authenticate directly to Fencer’s MCP server.

Monitor Cloudflare Account Activity

Connect Cloudflare account activity for threat hunting, alongside your other data sources. Fencer already ships detections tuned for Cloudflare out of the box, including alerts on unexpected changes to Cloudflare Worker scripts, code that runs in Cloudflare Workers at the edge, so unauthorized changes can indicate a supply-chain compromise.

Faster AWS CloudTrail ingestion

A new streaming path for AWS CloudTrail events, with a clearer setup wizard for the IAM role it needs.

Richer identity correlation across your SIEM data

Detections and hunts now enrich every event with more identity information, so you can correlate the same person’s activity across all of your connected data sources, not just within one.

Cancel a vulnerability review and see its status

You can now cancel a vulnerability review while it’s in progress, and see the review’s current status at a glance.

Improvements

• Owner approval required for GitHub App installations. Installing Fencer’s GitHub App into an organization now requires approval from a GitHub organization owner before it can be granted access.
• More flexible branch and directory scan exclusions. Exclude branches from scanning using glob patterns, restrict scanning to specific branches only, and get clearer validation feedback on directory exclusion patterns.
• Faster and more thorough AI penetration testing. The AI penetration test agent covers framework misconfigurations and per-surface tradecraft more broadly, sweeps every surface exhaustively instead of stopping at the first finding per category, recognizes more CDN and edge providers so it doesn’t misread fronted targets as coverage gaps, no longer ends runs early on transient target outages, and caps in-flight requests so it won’t overwhelm a fragile target.
• Faster and more accurate incremental code scans. Code scans on pull requests scan the meaningful diff more reliably.
• Faster page loads across the app. Lighter initial JavaScript bundles, on-demand loading of route headers and drawers, preloaded navigation destinations, and less redundant data refetching.
• Faster Hunts pages. Hunts pages now issue a single combined query instead of four separate ones.
• More powerful detection rule correlations. Correlation-based detection rules can now build on other correlations, attribute results to specific assets across multiple data sources, use median and percentile thresholds, and support dictionary-type variables.
• Clearer SSO and SAML setup. The SSO setup form now shows your Service Provider metadata directly, and we’ve published Okta-specific setup instructions along with SCIM, SAML, and OIDC documentation.
• Searchable Slack channel pickers. Slack channel pickers throughout the app are now paginated and searchable, and load faster on first open.
• Fencer for Open Source refinements. Public repository contributors no longer count toward your billing seats, the protected status badge now explains itself with a tooltip, and container artifact scanning on the free tier is limited to public, unauthenticated registries.
• Live vs. snapshot toggle on scan details. The toggle between a scan’s snapshot and the current, live state of a vulnerability is now also available on scan detail pages.
• Vulnerabilities link to their penetration test. Vulnerabilities discovered during a penetration test now link directly back to that pentest engagement.
• Column display menu on posture vulnerability grids. Choose which columns to display.
• Zoom into the asset inventory timeline to see changes over specific time ranges.
• Consolidated broken-integration notifications, and integration lists are now paginated for large organizations.
• Faster, more reliable Cloudflare cloud scans, especially for accounts with many zones.
• Infrastructure as a pentest request type. Request an infrastructure penetration test, in addition to existing application types.
• Delete streaming data sources, with normalized views rebuilt automatically afterward.
• Filter access reviews by vendor risk level, and vendor CSV imports now show every validation error instead of stopping at the first one.
• Consistent repository picker across integrations, and the Cursor Origin connection page shows which permissions were granted during installation.
• Readable artifact URLs. Artifact page URLs now use readable slugs instead of numeric IDs.
• Cleaner signup company size options.
• Asset breadcrumbs split into a link and a picker, so navigating and switching assets are separate actions.

Bug Fixes

• Fixed false-positive findings on parked domains registered through Porkbun.
• Fixed duplicate Linear tickets sometimes being created when ticket creation was retried.
• Fixed a rule-derived filter parameter being dropped when navigating from a filtered link.
• Fixed Inbox and Search briefly reappearing in the sidebar after app data refreshed.
• Fixed the default branch sometimes being skipped by code scans when branch scope rules excluded it.
• Fixed branch scope rules not being enforced strictly, which could let out-of-scope branches get scanned.
• Fixed “Informational” severity being imported incorrectly from CSV vulnerability uploads.
• Fixed cloud configuration scan exclusion patterns not being applied correctly in some cases.
• Fixed incorrect timestamps on the scan history chart.
• Fixed a display error for vulnerability scale values with many digits.
• Fixed horizontal scrolling on the vulnerability posture detail view.
• Fixed the asset filter menu adding duplicate entries and missing some assets in certain views.
• Fixed Drata data not refreshing automatically after rotating your API key.
• Fixed vulnerabilities incorrectly marked as having an upstream fix available.
• Fixed container image scans sometimes analyzing a stale image digest for Lambda-backed images.
• Fixed the GitHub App install popup not closing when a user couldn’t complete the installation.
• Fixed SSO re-authentication redirecting to the wrong identity provider for users in multiple organizations.
• Fixed some API requests returning a redirected page instead of the expected JSON response.
• Fixed the initial scan notification toast reappearing repeatedly.
• Fixed a layout issue on the GitHub repository access card.
• Fixed the vulnerability split pane failing to load for location-based groups.
• Clearer setup instructions for connecting Cloudflare.
• Fixed a broken SBOM download on the dependencies page.
• Fixed empty or missing dependency graphs and SBOM links on some code scans.
• Fixed graph views not panning when a drag started on a node.
• Fixed some code scan findings pointing to the wrong statement for certain module-level issues.
• Fixed unrecognized GCP Database Migration Service connection profiles appearing as unknown asset types.
• Fixed some pages failing to load for organizations with very large inventories.
• Fixed the Cloudflare integration being marked offline on an invalid account ID instead of showing a clearer error.
• Fixed Hunts returning a server error under heavy concurrent query load.
• Fixed two-factor authentication codes with non-ASCII characters causing an error instead of being rejected cleanly.
• Fixed container image scans hanging and failing silently when a Kubernetes cluster became unreachable.
• Fixed AWS cloud scans failing under load balancer API throttling on large accounts.
• Fixed a Slack integration not being marked as degraded when channel refresh started failing.
• Fixed missing timestamp handling for some certificate transparency log entries during domain monitoring.
• Fixed stale AI code review checks on GitHub not being marked as cancelled.
• Fixed oversized GitHub check summaries getting truncated incorrectly and swallowing check failures.
• Fixed SAML login failures showing a generic error instead of an actionable diagnostic.
• Fixed Drata evidence sync failing on evidence Drata had marked locked.
• Fixed webhook ingestion failing when GitHub or Rippling payloads contained invalid characters.
• Fixed Supabase integration sync failing when a member had no role assigned.
• Fixed several dependency-list errors, including a server error on duplicate dependency slugs, empty dependency trees when scanner output was missing, dependencies with local version identifiers failing to parse, and resolved dependencies still showing alongside their vulnerabilities.
• Fixed AWS IAM role policy findings being lost when trimming duplicate cloud scan results.
• Fixed stale in-flight code scans sometimes superseding results from a newer scan.
• Fixed the “Try again” action not recovering the page when a JavaScript chunk failed to load.

Coming Soon

These features are currently in testing and rolling out soon:

• Custom notification rules. You’ll be able to build your own rules for when and how you’re notified about vulnerabilities, detections, and pentest events, including personal rules scoped to just you.
• Custom roles. Define custom roles with your own set of fine-grained permissions, instead of choosing only from the built-in role set.
• Stronger SSO enforcement, continued. SSO and social sign-in requirements will keep being checked every time a protected action is taken, not only at login.
• An AI security chat assistant. Ask questions about your security posture in a conversational chat interface instead of digging through dashboards.

Interested in early access to any of these features? Reach out to us and we’ll get you set up.