Black Duck

No entries match these filters. Clear filters

1. Introducing Signal Agentic Fix: Your 24×7 remediation team (2026-10-27) Oct 27, 2026 · issue 123

   Black Duck launches Signal Agentic Fix, an AI agent that scans, triages, patches, validates, and submits fixes as PRs at machine speed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Signal Agentic Fix, an AI remediation agent that performs end-to-end vulnerability scan, triage, fix generation, validation, and pull-request submission without human bottlenecks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agentic Fix for Coding Agents integrates as a companion to tools like Claude Code and GitHub Copilot, letting developers remove defects in existing code and prevent new ones as AI writes code.
   • Uses the same deterministic SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. engines from Polaris, Coverity, and Black Duck SCA for consistent scan results inside the agent workflow.
   • Available for early access as a Claude Code plug-in for Coverity users, with additional coding-agent and DevOps pipeline support coming for Coverity, Polaris, and Black Duck SCA.
   • Signal AI Code Analysis support will be added for deeper discovery of novel risks such as IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data. and BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. within agent runs.

   5 details in Everything

2. Polaris release update: Deeper detection, remediation you control, scanning wherever you work (2026-10-21) Oct 21, 2026 · issue 116

   Polaris adds AI framework static analysis, per-type fix PR control, container scan automation, and GitHub Enterprise Cloud data residency support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • Adds specialized static security analysis for AI frameworks — the Anthropic SDK, OpenAI SDK, and LangChain — catching dangerous tool enablement, agent configuration risks, and AI prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. issues via Rapid Scan Static (Sigma 2026.9.1).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends Rapid Scan Static language coverage to Go 1.27, expands detection across Groovy (including Grails and Gradle), JavaScript, and Python environments, improves detection accuracy for CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. and TLS misconfigurations in Groovy/Grails applications, and reduces false positives in JavaScript unit test files.
   • Adds per-assessment-type fix PR control in the CLI and Polaris UI, letting teams enable automated remediation for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. only, Static only, or both independently, and extends Static AI fix PRs to the Jenkins plug-in and Black Duck Security Setup workflows, which previously supported SCA fix PRs only; enabling fix PRs in these surfaces turns them on for both SCA and Static issues together.
   • Adds container scan initiation from GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab templates, Jenkins plug-in, Bitbucket pipe, ADO extension, the CLI, and Black Duck Security Setup workflows, with layer-level risk analysis identifying which container layer introduced a specific vulnerability or component, and a unified component inventory combining container scan findings with binary, package manager, and signature scan results into one view.
   • Adds support for GitHub Enterprise Cloud (GHEC) tenants with data residency, allowing connection to customer-specific regional GitHub hosts with automatic regional API routing via the CLI, GitHub Actions, or the Polaris UI.
   • Adds specialized static security analysis for AI frameworks — the Anthropic SDK, OpenAI SDK, and LangChain — catching dangerous tool enablement, agent configuration risks, and AI prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. issues via Rapid Scan Static (Sigma 2026.9.1).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds container scan initiation from GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab templates, Jenkins plug-in, Bitbucket pipe, ADO extension, the CLI, and Black Duck Security Setup workflows, with layer-level risk analysis identifying which container layer introduced a specific vulnerability or component, and a unified component inventory combining container scan findings with binary, package manager, and signature scan results into one view.
   • Adds support for GitHub Enterprise Cloud (GHEC) tenants with data residency, allowing connection to customer-specific regional GitHub hosts with automatic regional API routing via the CLI, GitHub Actions, or the Polaris UI.

   2 more in Everything

3. Polaris release update: Bringing AI security findings, scan governance, and remediation together (2026-09-23) Sep 23, 2026 · issue 084

   Polaris gains BYO LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for Signal AI analysis, central scan rule profiles, on-prem SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. support, async SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. alerts, and a dynamic sitemap view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.-format upload of Signal AI code analysis results into Polaris, where they are classified under the new AI tool type and managed alongside deterministic findings through unified policies, triage, audit trails, and governance workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-agent LLM configuration across each of Signal AI's six agents, with provider, model, and endpoint independently selectable — supporting OpenAI, Azure OpenAI, AWS Bedrock, GCP Vertex AI, or any OpenAI-compatible proxy with automatic provider detection.
   • Introduces central rule configuration in Polaris, letting security teams define rule profiles once and apply them at the organization, application, or project level via hierarchical inheritance, automatically enforced across CI pipelines, CLI scans, and integrations.
   • Adds support for the 2025 CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. Top 25 (alongside the existing 2024 list) across policy filters and violation criteria, dashboards, reporting, and issue management.
   • Extends on-premises SCM support to self-hosted GitLab, Azure DevOps Server, and Bitbucket Server/Data Center (in addition to previously released self-managed GitHub), enabling repository discovery, bulk onboarding, SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SCA scan triggers, and pull request–driven remediation workflows.

   +2 more show less

   • Adds async SCA notifications — email alerts for new critical- or high-severity open source vulnerabilities, or reclassifications of existing vulnerabilities to critical or high, with project- and branch-level subscription controls.
   • Adds a fAST Dynamic sitemap view that displays discovered URLs, endpoints, and resources in a hierarchical map so teams can validate dynamic testing coverage and identify gaps or unexpected endpoints.
   • Adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.-format upload of Signal AI code analysis results into Polaris, where they are classified under the new AI tool type and managed alongside deterministic findings through unified policies, triage, audit trails, and governance workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-agent LLM configuration across each of Signal AI's six agents, with provider, model, and endpoint independently selectable — supporting OpenAI, Azure OpenAI, AWS Bedrock, GCP Vertex AI, or any OpenAI-compatible proxy with automatic provider detection.
   • Introduces central rule configuration in Polaris, letting security teams define rule profiles once and apply them at the organization, application, or project level via hierarchical inheritance, automatically enforced across CI pipelines, CLI scans, and integrations.
   • Adds async SCA notifications — email alerts for new critical- or high-severity open source vulnerabilities, or reclassifications of existing vulnerabilities to critical or high, with project- and branch-level subscription controls.
   • Adds a fAST Dynamic sitemap view that displays discovered URLs, endpoints, and resources in a hierarchical map so teams can validate dynamic testing coverage and identify gaps or unexpected endpoints.

   2 more in Everything

4. Agentic AppSec on your infrastructure with Black Duck Signal (2026-09-10) Sep 10, 2026 · issue 072

   Black Duck Signal gains BYO-LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support, letting regulated orgs route each of its seven AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. agents through their own LLM infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Route the high-volume single-file SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. agent to a cost-optimised model while keeping lighter agents on a cheaper model, all within your own Azure OpenAI tenancy.
   ini copy

   [LLM]
   mode = byo
   uri = https://your-endpoint.example.com/v1
   key = ${OPENAI_API_KEY}
   timeout = 600
   
   [LLM_SINGLEFILESCAN_AGENT]
   model = gpt-4o
   timeout = 600
   
   [LLM_DATAFLOW_AGENT]
   model = gpt-4o-mini
   
   [LLM_OVERSIGHT_AGENT]
   model = gpt-4o-mini
   
   [LLM_EXPLOITATION_AGENT]
   model = gpt-4o-mini
   
   [LLM_SCA_AGENT]
   model = gpt-4o-mini
   
   [LLM_MERGEKEY_EMBED_AGENT]
   model = text-embedding-3-large
   
   [LLM_OVERSIGHT_EMBED_AGENT]
   model = text-embedding-3-small

   Use GCP Vertex AI for all agents to satisfy data-residency requirements, supplying a service-account key and project so Signal handles token refresh automatically.
   ini copy

   [LLM]
   mode = byo
   gcp_service_account_key = gcp-sa-key.json
   gcp_project = your-gcp-project-id

   • Adds --llm-mode CLI flag and mode field in the [LLM] config-file section to switch Black Duck Signal between Black Duck-managed and BYO-LLM endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [LLM] global config section with uri, key, timeout, gcp_service_account_key, and gcp_project fields that set defaults for all seven agents.
   • Adds per-agent config sections — [LLM_SINGLEFILESCAN_AGENT], [LLM_DATAFLOW_AGENT], [LLM_OVERSIGHT_AGENT], [LLM_EXPLOITATION_AGENT], [LLM_SCA_AGENT], [LLM_MERGEKEY_EMBED_AGENT], [LLM_OVERSIGHT_EMBED_AGENT] — each accepting model, uri, key, timeout, and api_version overrides.
   • Adds --check-llm preflight flag that validates every configured LLM endpoint is reachable and authenticated before a scan runs, with machine-readable JSON output for CI pipelines.
   • Supports OpenAI direct API, Azure OpenAI (including Azure AI Services with native Anthropic Claude and automatic Claude-vs-OpenAI family detection), AWS Bedrock (via IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. bearer-token auth), GCP Vertex AI (native service-account credentials with automatic token refresh), and any OpenAI-compatible proxy including LiteLLM as BYO-LLM providers.

   +1 more show less

   • Enables granular per-agent model routing so different agents (e.g., single-file SAST, cross-file dataflow, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., false-positive oversight, exploit-narrative generation, and two embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. agents) can each target a different provider, model, and endpoint within a single scan.

   6 details in Everything

5. Polaris release update: Two-way bug tracker sync, AI-assisted fixes, scanning you can govern (2026-08-19) Aug 19, 2026 · issue 050

   Polaris adds two-way bug tracker sync across five systems, AI-assisted SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. fix PRs, secure tunnels to on-prem SCMs, and central rule governance.

   └──▷ HOW TO FIND IT
   Apply a mandatory central rule profile at the organization level so every scan — CI, CLI, or integration — enforces the same ruleset without per-repo YAML.
   📍# In Polaris UI: Settings › Rule Profiles › New Profile # Set scope: Organization # Enable Mandatory and configure inheritance for application/project/branch overrides # All pipelines pick up the profile automatically on next scan — no per-pipeline changes needed.
   • Adds CI-native AI-assisted SAST fix pull request generation via the Bridge CLI, triggerable from GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab CI, Bitbucket Pipelines, Jenkins, or Azure DevOps pipeline configuration — no server-side scheduling required.
   • Adds policy-driven and on-demand fix PR creation from the UI (individually or in bulk) and via issue policy actions, with per-branch or per-run caps on open PRs and filtering by CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., issue type, language, and file pattern.
   • Adds a View issue policies action that surfaces which policies, compliance requirements, and governance rules are attached to a SAST finding.
   • Adds bidirectional status and triage sync across GitLab Issues, GitHub Issues, Jira, ServiceNow, and Azure Boards — triage states, ticket statuses, and fix-by dates now propagate automatically in both directions.
   • Adds fix-by date synchronization: Polaris fix-by changes update due dates in Jira, ServiceNow, and Azure Boards, and due date changes sync back to Polaris.

   +15 more show less

   • Adds configurable per-project bug-tracker integration mappings, saveable as reusable templates across projects and workflows, scoped to all branches or the default branch only.
   • Adds native integrations for GitLab Issues, GitHub Issues, and ServiceNow as new bug-tracking targets, supporting individual and bulk export, single-ticket bundling for ServiceNow, and policy-driven issue creation.
   • Adds configurable Jira field mapping — map Polaris issue data to standard or custom Jira fields and customize ticket descriptions.
   • Adds automatic ticket closure when linked findings are dismissed or absent in subsequent scans; a reappearing issue creates a new ticket to preserve audit trails.
   • Adds secure tunnel connectivity (outbound-only, no inbound firewall changes) to self-hosted Azure DevOps Server, GitLab Self-Managed, Bitbucket Server and Data Center, and on-premises Jira, built on Bridge CLI and Teleport infrastructure.
   • Adds webhook-triggered SAST and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning on push, branch creation, and pull/merge request activity for self-hosted SCMs, with PR/MR decoration including severity breakdowns and Code Insights reports for Bitbucket.
   • Adds central rule configuration: security teams define rule profiles at organization, application, project, or branch level with hierarchical inheritance, enforced automatically across CI pipelines, CLI scans, and integrations.
   • Adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., audit trails, and version awareness to central rule governance, with visibility into which profiles were used for each scan.
   • Adds seven existing Java JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. checks (algorithm confusion, nonexpiring tokens, ignored expiration/start times, missing claims validation, untrusted decoding) now applied to Scala in the Rapid Scan Static engine.
   • Adds six new Scala web security checks targeting permissive and credentialed CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. origins, excessive preflight age, missing TLS, and disabled security headers across http4s and Play.
   • Adds a new crypto bits private key pattern to the Rapid Scan Static engine to detect embedded cryptographic private keys in source code and configuration files.
   • Adds support for Go 1.26 and Dart 3.11 in the Rapid Scan Static engine.
   • Adds UV (Python), Rush monorepo tooling, a tree-based Conda detector, and Ant/Ivy dependency extraction as new package manager detectors in the fAST SCA engine.
   • Extends fAST SCA ecosystem coverage to include Poetry, pnpm, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development., SetupTools, Bazel 9, .slnx solution files for NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., buildless go.mod analysis for Go, and Cargo workspace support with include and exclude controls.
   • Adds multitunnel support for on-premises Jira connectivity, with tunnel setup restricted to org admins via RBAC and full audit logging.

   20 details in Everything

6. Polaris release update: Two-way bug tracker sync, AI-assisted fixes, scanning you can govern (2026-08-19) Aug 19, 2026 · issue 008

   Polaris adds two-way bug tracker sync across five systems, AI-assisted SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. fix PRs, secure tunnels to on-prem SCMs, and central rule governance.

   └──▷ HOW TO FIND IT
   Apply a mandatory central rule profile at the organization level so every scan — CI, CLI, or integration — enforces the same ruleset without per-repo YAML.
   📍# In Polaris UI: Settings › Rule Profiles › New Profile # Set scope: Organization # Enable Mandatory and configure inheritance for application/project/branch overrides # All pipelines pick up the profile automatically on next scan — no per-pipeline changes needed.
   • Adds CI-native AI-assisted SAST fix pull request generation via the Bridge CLI, triggerable from GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab CI, Bitbucket Pipelines, Jenkins, or Azure DevOps pipeline configuration — no server-side scheduling required.
   • Adds policy-driven and on-demand fix PR creation from the UI (individually or in bulk) and via issue policy actions, with per-branch or per-run caps on open PRs and filtering by CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., issue type, language, and file pattern.
   • Adds a View issue policies action that surfaces which policies, compliance requirements, and governance rules are attached to a SAST finding.
   • Adds bidirectional status and triage sync across GitLab Issues, GitHub Issues, Jira, ServiceNow, and Azure Boards — triage states, ticket statuses, and fix-by dates now propagate automatically in both directions.
   • Adds fix-by date synchronization: Polaris fix-by changes update due dates in Jira, ServiceNow, and Azure Boards, and due date changes sync back to Polaris.

   +15 more show less

   • Adds configurable per-project bug-tracker integration mappings, saveable as reusable templates across projects and workflows, scoped to all branches or the default branch only.
   • Adds native integrations for GitLab Issues, GitHub Issues, and ServiceNow as new bug-tracking targets, supporting individual and bulk export, single-ticket bundling for ServiceNow, and policy-driven issue creation.
   • Adds configurable Jira field mapping — map Polaris issue data to standard or custom Jira fields and customize ticket descriptions.
   • Adds automatic ticket closure when linked findings are dismissed or absent in subsequent scans; a reappearing issue creates a new ticket to preserve audit trails.
   • Adds secure tunnel connectivity (outbound-only, no inbound firewall changes) to self-hosted Azure DevOps Server, GitLab Self-Managed, Bitbucket Server and Data Center, and on-premises Jira, built on Bridge CLI and Teleport infrastructure.
   • Adds webhook-triggered SAST and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning on push, branch creation, and pull/merge request activity for self-hosted SCMs, with PR/MR decoration including severity breakdowns and Code Insights reports for Bitbucket.
   • Adds central rule configuration: security teams define rule profiles at organization, application, project, or branch level with hierarchical inheritance, enforced automatically across CI pipelines, CLI scans, and integrations.
   • Adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., audit trails, and version awareness to central rule governance, with visibility into which profiles were used for each scan.
   • Adds seven existing Java JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. checks (algorithm confusion, nonexpiring tokens, ignored expiration/start times, missing claims validation, untrusted decoding) now applied to Scala in the Rapid Scan Static engine.
   • Adds six new Scala web security checks targeting permissive and credentialed CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. origins, excessive preflight age, missing TLS, and disabled security headers across http4s and Play.
   • Adds a new crypto bits private key pattern to the Rapid Scan Static engine to detect embedded cryptographic private keys in source code and configuration files.
   • Adds support for Go 1.26 and Dart 3.11 in the Rapid Scan Static engine.
   • Adds UV (Python), Rush monorepo tooling, a tree-based Conda detector, and Ant/Ivy dependency extraction as new package manager detectors in the fAST SCA engine.
   • Extends fAST SCA ecosystem coverage to include Poetry, pnpm, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development., SetupTools, Bazel 9, .slnx solution files for NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., buildless go.mod analysis for Go, and Cargo workspace support with include and exclude controls.
   • Adds multitunnel support for on-premises Jira connectivity, with tunnel setup restricted to org admins via RBAC and full audit logging.

   20 details in Everything