https://cybertoolchain.io/tools/black-duck New releases and features in Black Duck, tracked by The Cyber Toolchain. en Tue, 27 Oct 2026 07:30:00 GMT https://www.blackduck.com/blog/signal-agentic-fix.html https://www.blackduck.com/blog/signal-agentic-fix.html Tue, 27 Oct 2026 07:30:00 GMT Black Duck launches Signal Agentic Fix, an AI agent that scans, triages, patches, validates, and submits fixes as PRs at machine speed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces Signal Agentic Fix, an AI remediation agent that performs end-to-end vulnerability scan, triage, fix generation, validation, and pull-request submission without human bottlenecks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Agentic Fix for Coding Agents integrates as a companion to tools like Claude Code and GitHub Copilot, letting developers remove defects in existing code and prevent new ones as AI writes code. • Uses the same deterministic SAST and SCA engines from Polaris, Coverity, and Black Duck SCA for consistent scan results inside the agent workflow. • Available for early access as a Claude Code plug-in for Coverity users, with additional coding-agent and DevOps pipeline support coming for Coverity, Polaris, and Black Duck SCA. • Signal AI Code Analysis support will be added for deeper discovery of novel risks such as IDOR and BOLA within agent runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/black-duck https://www.blackduck.com/blog/blog-polaris-october-2026-update.html https://www.blackduck.com/blog/blog-polaris-october-2026-update.html Wed, 21 Oct 2026 06:44:00 GMT Polaris adds AI framework static analysis, per-type fix PR control, container scan automation, and GitHub Enterprise Cloud data residency support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds specialized static security analysis for AI frameworks — the Anthropic SDK, OpenAI SDK, and LangChain — catching dangerous tool enablement, agent configuration risks, and AI prompt injection issues via Rapid Scan Static (Sigma 2026.9.1).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends Rapid Scan Static language coverage to Go 1.27, expands detection across Groovy (including Grails and Gradle), JavaScript, and Python environments, improves detection accuracy for CORS and TLS misconfigurations in Groovy/Grails applications, and reduces false positives in JavaScript unit test files. • Adds per-assessment-type fix PR control in the CLI and Polaris UI, letting teams enable automated remediation for SCA only, Static only, or both independently, and extends Static AI fix PRs to the Jenkins plug-in and Black Duck Security Setup workflows, which previously supported SCA fix PRs only; enabling fix PRs in these surfaces turns them on for both SCA and Static issues together. • Adds container scan initiation from GitHub Actions, GitLab templates, Jenkins plug-in, Bitbucket pipe, ADO extension, the CLI, and Black Duck Security Setup workflows, with layer-level risk analysis identifying which container layer introduced a specific vulnerability or component, and a unified component inventory combining container scan findings with binary, package manager, and signature scan results into one view. • Adds support for GitHub Enterprise Cloud (GHEC) tenants with data residency, allowing connection to customer-specific regional GitHub hosts with automatic regional API routing via the CLI, GitHub Actions, or the Polaris UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/black-duck https://www.blackduck.com/blog/polaris-september-2026-update.html https://www.blackduck.com/blog/polaris-september-2026-update.html Wed, 23 Sep 2026 13:28:40 GMT Polaris gains BYO LLM for Signal AI analysis, central scan rule profiles, on-prem SCM support, async SCA alerts, and a dynamic sitemap view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds SARIF-format upload of Signal AI code analysis results into Polaris, where they are classified under the new AI tool type and managed alongside deterministic findings through unified policies, triage, audit trails, and governance workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports per-agent LLM configuration across each of Signal AI's six agents, with provider, model, and endpoint independently selectable — supporting OpenAI, Azure OpenAI, AWS Bedrock, GCP Vertex AI, or any OpenAI-compatible proxy with automatic provider detection. • Introduces central rule configuration in Polaris, letting security teams define rule profiles once and apply them at the organization, application, or project level via hierarchical inheritance, automatically enforced across CI pipelines, CLI scans, and integrations. • Adds support for the 2025 CWE Top 25 (alongside the existing 2024 list) across policy filters and violation criteria, dashboards, reporting, and issue management. • Extends on-premises SCM support to self-hosted GitLab, Azure DevOps Server, and Bitbucket Server/Data Center (in addition to previously released self-managed GitHub), enabling repository discovery, bulk onboarding, SAST/SCA scan triggers, and pull request–driven remediation workflows. • Adds async SCA notifications — email alerts for new critical- or high-severity open source vulnerabilities, or reclassifications of existing vulnerabilities to critical or high, with project- and branch-level subscription controls. • Adds a fAST Dynamic sitemap view that displays discovered URLs, endpoints, and resources in a hierarchical map so teams can validate dynamic testing coverage and identify gaps or unexpected endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/black-duck https://www.blackduck.com/blog/black-duck-signal-byo-llm.html https://www.blackduck.com/blog/black-duck-signal-byo-llm.html Thu, 10 Sep 2026 17:30:14 GMT Black Duck Signal gains BYO-LLM support, letting regulated orgs route each of its seven AppSec agents through their own LLM infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--llm-mode` CLI flag and `mode` field in the `[LLM]` config-file section to switch Black Duck Signal between Black Duck-managed and BYO-LLM endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `[LLM]` global config section with `uri`, `key`, `timeout`, `gcp_service_account_key`, and `gcp_project` fields that set defaults for all seven agents. • Adds per-agent config sections — `[LLM_SINGLEFILESCAN_AGENT]`, `[LLM_DATAFLOW_AGENT]`, `[LLM_OVERSIGHT_AGENT]`, `[LLM_EXPLOITATION_AGENT]`, `[LLM_SCA_AGENT]`, `[LLM_MERGEKEY_EMBED_AGENT]`, `[LLM_OVERSIGHT_EMBED_AGENT]` — each accepting `model`, `uri`, `key`, `timeout`, and `api_version` overrides. • Adds `--check-llm` preflight flag that validates every configured LLM endpoint is reachable and authenticated before a scan runs, with machine-readable JSON output for CI pipelines. • Supports OpenAI direct API, Azure OpenAI (including Azure AI Services with native Anthropic Claude and automatic Claude-vs-OpenAI family detection), AWS Bedrock (via IAM bearer-token auth), GCP Vertex AI (native service-account credentials with automatic token refresh), and any OpenAI-compatible proxy including LiteLLM as BYO-LLM providers. • Enables granular per-agent model routing so different agents (e.g., single-file SAST, cross-file dataflow, SCA, false-positive oversight, exploit-narrative generation, and two embedding agents) can each target a different provider, model, and endpoint within a single scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/black-duck https://www.blackduck.com/blog/polaris-august-2026-update-bug-tracker-sync-governed-scanning.html https://www.blackduck.com/blog/polaris-august-2026-update-bug-tracker-sync-governed-scanning.html Wed, 19 Aug 2026 06:00:00 GMT Polaris adds two-way bug tracker sync across five systems, AI-assisted SAST fix PRs, secure tunnels to on-prem SCMs, and central rule governance. • Adds CI-native AI-assisted SAST fix pull request generation via the Bridge CLI, triggerable from GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, or Azure DevOps pipeline configuration — no server-side scheduling required. • Adds policy-driven and on-demand fix PR creation from the UI (individually or in bulk) and via issue policy actions, with per-branch or per-run caps on open PRs and filtering by CWE, issue type, language, and file pattern. • Adds a 'View issue policies' action that surfaces which policies, compliance requirements, and governance rules are attached to a SAST finding. • Adds bidirectional status and triage sync across GitLab Issues, GitHub Issues, Jira, ServiceNow, and Azure Boards — triage states, ticket statuses, and fix-by dates now propagate automatically in both directions. • Adds fix-by date synchronization: Polaris fix-by changes update due dates in Jira, ServiceNow, and Azure Boards, and due date changes sync back to Polaris. • Adds configurable per-project bug-tracker integration mappings, saveable as reusable templates across projects and workflows, scoped to all branches or the default branch only. • Adds native integrations for GitLab Issues, GitHub Issues, and ServiceNow as new bug-tracking targets, supporting individual and bulk export, single-ticket bundling for ServiceNow, and policy-driven issue creation. • Adds configurable Jira field mapping — map Polaris issue data to standard or custom Jira fields and customize ticket descriptions. • Adds automatic ticket closure when linked findings are dismissed or absent in subsequent scans; a reappearing issue creates a new ticket to preserve audit trails. • Adds secure tunnel connectivity (outbound-only, no inbound firewall changes) to self-hosted Azure DevOps Server, GitLab Self-Managed, Bitbucket Server and Data Center, and on-premises Jira, built on Bridge CLI and Teleport infrastructure. • Adds webhook-triggered SAST and SCA scanning on push, branch creation, and pull/merge request activity for self-hosted SCMs, with PR/MR decoration including severity breakdowns and Code Insights reports for Bitbucket. • Adds central rule configuration: security teams define rule profiles at organization, application, project, or branch level with hierarchical inheritance, enforced automatically across CI pipelines, CLI scans, and integrations. • Adds RBAC, audit trails, and version awareness to central rule governance, with visibility into which profiles were used for each scan. • Adds seven existing Java JWT checks (algorithm confusion, nonexpiring tokens, ignored expiration/start times, missing claims validation, untrusted decoding) now applied to Scala in the Rapid Scan Static engine. • Adds six new Scala web security checks targeting permissive and credentialed CORS origins, excessive preflight age, missing TLS, and disabled security headers across http4s and Play. • Adds a new crypto bits private key pattern to the Rapid Scan Static engine to detect embedded cryptographic private keys in source code and configuration files. • Adds support for Go 1.26 and Dart 3.11 in the Rapid Scan Static engine. • Adds UV (Python), Rush monorepo tooling, a tree-based Conda detector, and Ant/Ivy dependency extraction as new package manager detectors in the fAST SCA engine. • Extends fAST SCA ecosystem coverage to include Poetry, pnpm, SBT, SetupTools, Bazel 9, `.slnx` solution files for NuGet, buildless `go.mod` analysis for Go, and Cargo workspace support with include and exclude controls. • Adds multitunnel support for on-premises Jira connectivity, with tunnel setup restricted to org admins via RBAC and full audit logging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/black-duck https://www.blackduck.com/blog/polaris-august-2026-update-bug-tracker-sync-governed-scanning.html https://www.blackduck.com/blog/polaris-august-2026-update-bug-tracker-sync-governed-scanning.html Wed, 19 Aug 2026 06:00:00 GMT Polaris adds two-way bug tracker sync across five systems, AI-assisted SAST fix PRs, secure tunnels to on-prem SCMs, and central rule governance. • Adds CI-native AI-assisted SAST fix pull request generation via the Bridge CLI, triggerable from GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, or Azure DevOps pipeline configuration — no server-side scheduling required. • Adds policy-driven and on-demand fix PR creation from the UI (individually or in bulk) and via issue policy actions, with per-branch or per-run caps on open PRs and filtering by CWE, issue type, language, and file pattern. • Adds a 'View issue policies' action that surfaces which policies, compliance requirements, and governance rules are attached to a SAST finding. • Adds bidirectional status and triage sync across GitLab Issues, GitHub Issues, Jira, ServiceNow, and Azure Boards — triage states, ticket statuses, and fix-by dates now propagate automatically in both directions. • Adds fix-by date synchronization: Polaris fix-by changes update due dates in Jira, ServiceNow, and Azure Boards, and due date changes sync back to Polaris. • Adds configurable per-project bug-tracker integration mappings, saveable as reusable templates across projects and workflows, scoped to all branches or the default branch only. • Adds native integrations for GitLab Issues, GitHub Issues, and ServiceNow as new bug-tracking targets, supporting individual and bulk export, single-ticket bundling for ServiceNow, and policy-driven issue creation. • Adds configurable Jira field mapping — map Polaris issue data to standard or custom Jira fields and customize ticket descriptions. • Adds automatic ticket closure when linked findings are dismissed or absent in subsequent scans; a reappearing issue creates a new ticket to preserve audit trails. • Adds secure tunnel connectivity (outbound-only, no inbound firewall changes) to self-hosted Azure DevOps Server, GitLab Self-Managed, Bitbucket Server and Data Center, and on-premises Jira, built on Bridge CLI and Teleport infrastructure. • Adds webhook-triggered SAST and SCA scanning on push, branch creation, and pull/merge request activity for self-hosted SCMs, with PR/MR decoration including severity breakdowns and Code Insights reports for Bitbucket. • Adds central rule configuration: security teams define rule profiles at organization, application, project, or branch level with hierarchical inheritance, enforced automatically across CI pipelines, CLI scans, and integrations. • Adds RBAC, audit trails, and version awareness to central rule governance, with visibility into which profiles were used for each scan. • Adds seven existing Java JWT checks (algorithm confusion, nonexpiring tokens, ignored expiration/start times, missing claims validation, untrusted decoding) now applied to Scala in the Rapid Scan Static engine. • Adds six new Scala web security checks targeting permissive and credentialed CORS origins, excessive preflight age, missing TLS, and disabled security headers across http4s and Play. • Adds a new crypto bits private key pattern to the Rapid Scan Static engine to detect embedded cryptographic private keys in source code and configuration files. • Adds support for Go 1.26 and Dart 3.11 in the Rapid Scan Static engine. • Adds UV (Python), Rush monorepo tooling, a tree-based Conda detector, and Ant/Ivy dependency extraction as new package manager detectors in the fAST SCA engine. • Extends fAST SCA ecosystem coverage to include Poetry, pnpm, SBT, SetupTools, Bazel 9, `.slnx` solution files for NuGet, buildless `go.mod` analysis for Go, and Cargo workspace support with include and exclude controls. • Adds multitunnel support for on-premises Jira connectivity, with tunnel setup restricted to org admins via RBAC and full audit logging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/black-duck