Product

Product Features SDLC How to Compare Docs Screenshots

Start here

Getting started Download Questions

More

Security Roadmap About

What changed

Changelog

Newest first, written for somebody deciding whether to upgrade. Every entry says what is different for a person using the product rather than which files moved.

AI validation that lowers grades and learns, decisions that hold until the code changes, and grades that follow what can be exploited

Validate with AI, one or five hundred
Tick findings on the list, or select everything matching the filters, and a model reads them in the background, with progress, tokens spent and what happened to each on a new Learned rules page. A reading lower than the grade now lowers it, and the finding says so. It never raises one, never lowers a credential or a known exploited package, and never overrides a person. The flagged line now goes with the question, so a model that was not sent the code still sees what was found.
The scanner learns from every answer
Each answer says which other findings deserve the same grade for the same reason, and that becomes a learned rule with a synthetic test. The rule grades its siblings at once and answers later validations and later scans without asking the model, so the same question is not paid for twice. It stays in its repository until somebody applies it everywhere, and a model that later disagrees retires it and puts its grades back.
A decision holds until the code changes
A regrade, or an AI grade, records the code it was made against. Rescanning the same code keeps it. When the flagged lines change it is lifted, the engine's grade comes back, and the finding says who decided what and that the code changed.
Waived findings stay waived
A scan that missed a waived finding marked it fixed, and when it came back it was reopened as open, approved waiver and all, which put several hundred waived findings back on dashboards. It now comes back waived while the waiver stands, and the next scan repairs the ones already affected.
How new a live credential is
The dashboard's Live credentials opens the list newest first, with a sortable column of days since each was first discovered and how long ago it was committed. The finding page says the same. Sorting, paging and bulk actions now keep every filter on the list, where before sorting the live list showed every finding and a bulk action reached more than was on screen.
Severity rules on Where and Repository
A custom severity rule can now match the file, or the package for a dependency, and the repository, with a star for any part.
Grades follow what can be exploited
An expired token is info, a known exploited package is at least high unless it does not ship, a package only a build tool pulls in is low, and a copy of a package is judged at its own version rather than another copy's. A credential nobody can show is dead stays critical. Keys only semgrep finds now go through the credential pass, and a rule withdrawn from semgrep's registry no longer closes what it found.
Fewer findings the code beside them already rules out
A v-html binding whose method returns only DOMPurify output is low, a redirect that begins with the server's own address is low, a missing rate limit where there is no password is low, and a workflow value only a repository writer controls is low. Each one says why on the finding.

A plugin for your editor, Gitea and Forgejo, and links that point at pages that exist

The editor plugin, from your own server
Visual Studio Code and Cursor install the same package, and the JetBrains IDEs and Eclipse run the language server underneath it through LSP4IJ and LSP4E. It is downloaded from a new Editor plugins page in the product rather than from a marketplace, because that server is the one holding your rules and plenty of these installations have no way out to the internet. The package carries the version of the server that handed it over, and building the same release twice gives the same bytes, so the checksum on the page is one you can compare.
Open a file, see what the nightly scan would say
The text of that one file goes to your own server, is read by the same engines and graded by the same triage a scan uses, and is deleted. Nothing is stored: a review creates no finding, no exception and no scan. A credential is red whatever its severity says, with the value masked, and every finding carries the triage sentence that let it through. By default only lines that differ from HEAD are marked, because a plugin that opens showing two thousand of somebody else's findings does not stay installed.
Gitea and Forgejo
Both are on the Connections page with a setup guide of their own. A token from Settings, Applications reaches everything its account can see, so one connection usually covers a whole instance rather than one per organization the way a fine grained GitHub token does. Forgejo is a fork of Gitea and speaks the same API, so one implementation serves both and the two names are kept apart everywhere a person reads one.
What those two do not have, said rather than guessed
No dependency alerts, no code scanning, no secret scanning alerts, so those passes are skipped rather than called and read as empty. Members, teams and pull requests are left unwired on purpose: their member listing has no role filter, so asking it for the administrators returns everybody. Who can reach each repository is still collected, with each person's permission asked for one at a time.
Finding links now point at pages that exist
Every link a scan wrote was GitHub shaped. GitLab redirects that shape, Bitbucket does not, and Gitea and Forgejo have no such route at all, so those links were a 404. Each host now says once where it puts a file, a commit and a blame, and every writer reads it from there. A host with no equivalent page, such as Bitbucket file history, gets no link rather than one that goes nowhere.
A credential is labeled with the branches it is really on
The history walk reads every branch whatever the quiet branch filter did, so a key on a skipped branch was still found and then stamped onto the default branch, which sent somebody looking for it in code that never had it. Labels now come from the branches that are there.

· version 1.0.1

Branches that certify themselves, a trends page you can walk down, and severity written as conditions

Certified branches, without the clicking
A completed scan now signs off the branches it found nothing to read on: no findings at all, or nothing above a low. Those badges say a scan wrote them wherever they appear, and reports count them apart from the ones a person reviewed. A scan never writes over a sign off somebody made, never re-dates one and never revives one that was withdrawn, and it only ever considers a repository whose four passes all reported themselves finished.
The trends page drills down
The estate opens into its organizations, an organization into its repositories, a repository into its branches, with the chart and the risk matrix narrowing at each step. Every row carries a drill down button and a findings button, so "how much" and "which ones" are two different clicks rather than one guess.
Sortable, paged, and over the whole set
Every column heading in the grid sorts on itself and clicking it again turns it around. The grid pages twenty five rows at a time and says how many are behind it. Both run on the server across every row at that scope, rather than over the rows that happened to fit on screen.
Severity as a condition, not just a name
A grade can now be written about the rule, the CWE, the kind, the state, the masked value of a credential, how it was exposed, or who committed the line, and about several of those at once, joined with all or with any. Every rule says how many findings it covers today, before it is saved and after.
A grade that could never apply is refused
A kind or a state that does not exist is named on the way in rather than accepted. A rule that silently never fires is worse than one that will not save.
The last point on a trend line could read double
On a fresh install the reconstruction wrote a row for today and the first scan of the day wrote another, and the chart added them up. A real record of a day now replaces a reconstruction of it.

Silence stopped being read as remediation

Findings held open when nothing looked
A finding is closed only by the pass that would have found it, and only when the scanner says that pass finished. An engine that died, a history walk that covered a window, a salvaged run and the credential skip list were four different ways a scan produced silence without reporting it, and each of them had been read as work somebody had done.
A credential proved live is never retired quietly
A credential the issuing provider confirmed still works is only closed by a run that looked and found it gone, or by a person deciding.
Coverage of the branches somebody owes a review
Certification coverage is counted as a share of branches that scans have actually walked, with archived repositories and branches nobody is expected to review taken out of the total.
Archived repositories stopped being outstanding work
A repository archived on the host is marked as archived here and stops being counted as work on code that can no longer change.

Scans that report what they really did

A history walked to the end says so
The marker that records how far the credential engines have walked is cleared when the engine that walks it dies, so the catch up pass stops skipping the repository it was written for.
Two limits for the failure a deadline cannot see
A worker that stops producing anything is caught by a stall watchdog as well as by its overall deadline.
Thirty six thousand candidates that were never credentials
The triage rules that decide what counts as an example rather than a credential were widened, with the counts on the page and a box to test a candidate against.
A scan of one repository scans one repository
Asking for a single repository no longer walks the rest of the account behind it.

A scan you can watch, on a machine that is actually used

Twenty six accounts stopped queueing behind each other
Connections are scanned in parallel up to a limit that is a setting, on the reasoning that sixty idle cores are not a safety feature.
Told "scanning", and nothing scanned
A run that could not start says so instead of reporting success, and a connection scanned twice at the same time is refused rather than raced.
Fifty seven repositories no longer thrown away
A run that is stopped part way keeps what it had already read rather than discarding the night.

· version 1.0.1

Git Code Review 1.0.1

Trends and a report to send upstairs
A page for how the numbers have moved, a risk matrix built from impact and likelihood asked separately, and a PDF written from exactly the filter on screen.
Deciding about a hundred findings at once
Bulk decisions, and the first version of saying that a branch has been read.
A fifth of the noise removed
Generated output, low confidence low severity findings and dependencies nothing imports moved out of the default work list, each with a count and one click back.
Container images read without building them
The base image every Dockerfile names is resolved and read from its registry, and advisories already patched by the build stop being reported as though they were not.

Install it What it does