Bright Security

No entries match these filters. Clear filters

1. Release of September 22, 2026 Sep 22, 2026 · issue 083

   Bright adds fuzzing mode to STAR Harness, three new security tests, 2,000+ entry point scanning, and a new Optimizer dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ USE IT
   Migrate a Scan Configuration API call from the deprecated entrypointsStatuses to the new entryPointFilter to select only new, reachable entry points.
   json copy

   {
     "entryPointFilter": {
       "securityStatus": ["new"],
       "connectivityStatus": ["ok"]
     }
   }

   • Deprecates the entrypointsStatuses property in the Scan Configuration API; use the entryPointFilter property instead, which accepts securityStatus and connectivityStatus arrays for more flexible entry point selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds entryPointFilter to the Scan Configuration API, supporting fields securityStatus (e.g. 'new') and connectivityStatus (e.g. 'ok') to replace entrypointsStatuses.
   • Adds a new Email Spoofing security test that checks a domain's public DNS records for missing or weak DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit., and BIMI configuration.
   • Adds a new Source Map Exposure security test that detects publicly accessible JavaScript source maps (.js.map) exposing original source code and internal application structure.
   • Adds a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Tool Inventory Disclosure security test that detects when an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered entry point can be made to reveal the list of MCP tools available to it.

   +11 more show less

   • Adds a Fuzzing Mode to STAR Harness that hunts robustness and memory-safety bugs (crashes, hangs, type confusion, unhandled exceptions, unbounded allocation, algorithmic complexity) in code past input validation, without requiring a scan, authentication, or Repeater.
   • Introduces the Bright Optimizer, a new experience surfacing scan improvement opportunities — manually triggered scans, low health scores, and long-running scans — configurable via Organization Settings -> General Details -> Optimizer Settings.
   • Adds four new Task Overview widgets to Organization and Project dashboards: Task Results, Task Triggers, Task Actors, and Task Durations, with support for project, task type, and date-range filters.
   • Workflows can now scan applications with more than 2,000 Entry Points by automatically dividing discovered entry points into sequential batches of up to 2,000 within a single Workflow Run.
   • Adds new built-in Scan templates: Web Application, Web Application (without database), API Scan (without database), OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Web Apps (2025), and LLM & GenAI Applications.
   • Replaces the raw JSON block in the Advanced Authentication Editor with a step-based editor supporting per-step view, edit, add, copy, delete, reorder, JSON validation, and sensitive value masking.
   • Renames built-in templates Light Scan to CI/CD Light Scan and Passive Scan to Passive Scan (production safe) to better describe their intended use.
   • Improved Workflow Run details now show execution progress as executed-out-of-total nodes, a node status breakdown, a warning indicator for problematic nodes, a View Scans action filtered by Workflow Run, and configurable table columns.
   • Extends the ID Enumeration security test to cover list endpoints that return a JSON array at the root, detecting broken object-level authorization previously missed.
   • Extends the Full Path Disclosure security test to recognize hosted CI/CD build roots including Azure DevOps, GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., and Travis.
   • Upgrades the CVE filter in Issues tables to a dropdown populated with CVEs detected in the current project, replacing manual text entry.
   • Deprecates the entrypointsStatuses property in the Scan Configuration API; use the entryPointFilter property instead, which accepts securityStatus and connectivityStatus arrays for more flexible entry point selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds entryPointFilter to the Scan Configuration API, supporting fields securityStatus (e.g. 'new') and connectivityStatus (e.g. 'ok') to replace entrypointsStatuses.
   • Adds a new Email Spoofing security test that checks a domain's public DNS records for missing or weak DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit., and BIMI configuration.
   • Adds a new Source Map Exposure security test that detects publicly accessible JavaScript source maps (.js.map) exposing original source code and internal application structure.
   • Adds a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Tool Inventory Disclosure security test that detects when an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered entry point can be made to reveal the list of MCP tools available to it.

   +4 more show less

   • Adds a Fuzzing Mode to STAR Harness that hunts robustness and memory-safety bugs (crashes, hangs, type confusion, unhandled exceptions, unbounded allocation, algorithmic complexity) in code past input validation, without requiring a scan, authentication, or Repeater.
   • Introduces the Bright Optimizer, a new experience surfacing scan improvement opportunities — manually triggered scans, low health scores, and long-running scans — configurable via Organization Settings -> General Details -> Optimizer Settings.
   • Adds four new Task Overview widgets to Organization and Project dashboards: Task Results, Task Triggers, Task Actors, and Task Durations, with support for project, task type, and date-range filters.
   • Adds new built-in Scan templates: Web Application, Web Application (without database), API Scan (without database), OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Web Apps (2025), and LLM & GenAI Applications.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The GitHub Marketplace Actions and npm packages under the Neuralegion GitHub organization will move to BrightSec on October 20; workflows or integrations that reference Neuralegion directly will need to be updated.
2. announced seen Aug 31, 2026 · issue 060

   Bright Security adds active EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. metadata leakage detection across multipart and JSON image upload flows

   ⤢
   • New check actively tests multipart and JSON upload flows using JPEG and PNG canary images embedded with controlled metadata in fields such as UserComment, ImageDescription, Artist, timestamp fields, and GPS coordinates — a finding is created only when a metadata field matches exactly or a GPS coordinate pair is confirmed preserved in the served image.
   • Scanner validates the full image processing path — upload endpoint, application response, image discovery via response body, redirect headers, JSON/HTML responses, image links, and rendered DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. — rather than flagging storage configuration alone.
   • Detected leakage evidence includes the original upload request, the application response, the specific EXIF fields retained, and the URL where the image was found, giving teams a reproducible proof artifact usable as a testable AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. control in CI/CD.

   3 details in Everything

3. Release of August 25, 2026 Aug 25, 2026 · issue 056

   Bright adds orchestrated Workflows, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 dashboard widget, and connectivity-status-based scan filtering

   ⤢ ⤢ ⤢ ⤢
   • Adds entryPointFilter to the Scan Configuration API, replacing entrypointsStatuses, supporting filtering by both securityStatus and connectivityStatus (e.g. 'ok', 'unauthorized', 'problem', 'unreachable') for precise scan scoping.
   • Introduces Bright Workflows: a visual orchestration layer that chains a trigger, Discovery, and Scan into a reusable, schedulable pipeline that automatically identifies new and changed entry points since the last baseline and passes only those to the Scan.
   • Adds an OWASP Top 10:2025OWASP Top 10:2025A ranked list of the ten most critical web application risk categories, maintained by the Open Worldwide Application Security Project, used by cyber tools to prioritize detection, testing, and remediation coverage. Risk Overview widget to both Organization and Project dashboards, aggregating open issues across selected projects mapped to OWASP categories.
   • Adds Connectivity Status filtering to Scan by Status, defaulting to entry points with OK status; optionally includes Unauthorized, Problem, or Unreachable endpoints alongside the existing Entry Point Status filter.
   • Expands CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. Misconfiguration detection to cover origin reflection with credentials, the highest-severity CORS bypass scenario.

   +3 more show less

   • Broadens EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. Metadata detection to cover API responses that return site-root image paths without a leading slash.
   • Improves Secret Tokens detection accuracy for Bing Maps and LinkedIn keys with tighter patterns that exclude bundled content and unrelated marketing data.
   • Improves CSS Injection out-of-band confirmation by maintaining browser context during callback verification.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The entrypointsStatuses property in the Scan Configuration API is scheduled for deprecation on 22 September 2026; migrate integrations to entryPointFilter (with securityStatus and connectivityStatus sub-fields) before that date.
   • !Removes the X-XSS-Protection misconfiguration check from Header Security tests; scanners that previously relied on this finding will no longer receive it.
4. Release of August 11, 2026 Aug 11, 2026 · issue 042

   Bright Security adds EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. metadata leakage detection, repeater infrastructure widget, per-project authentication management, and project classification.

   ⤢ ⤢ ⤢ ⤢
   • New EXIF Metadata Leakage security test uploads canary images with GPS coordinates, device identifiers, timestamps, and comment fields to file upload endpoints, then checks served copies across upload responses, redirects, API responses, rendered HTML, and linked image URLs; reports Medium severity findings under CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-1230. Covers JPEG and PNG formats and supports multipart and JSON-encoded uploads.
   • New Repeater Insights widget on the Organization Dashboard shows connected, active, idle, disconnected, and disabled repeaters alongside running, queued, and scheduled Scan and Discovery tasks across selected projects.
   • New Authentications tab on the Project page lets teams view, create, and edit project-scoped authentications — with automatic assignment to the current project on creation — without leaving the project context.
   • New project classification attributes (Environment, Business Criticality, Exposure) available for filtering on the Projects page and Organization Dashboard to prioritize security efforts.
   • Host-based project search now available in the Projects table and the project selector in the Organization Dashboard.

   +1 more show less

   • Entry Points table now displays the skip reason when an entry point is omitted due to a missing Content-Type header, with additional tooltip guidance and the ability to sort by skip reason.

   6 details in Everything

5. Release of July 28, 2026 Jul 23, 2026 · release notes

   Bright Security adds auto-detection for protected resources/trigger via traffic recording, bulk auth assignment, Top 5 dashboard widget, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tests, and Xygeni integration.

   └──▷ HOW TO FIND IT
   Automatically configure authentication for a newly recorded login flow without manual endpoint entry.
   📍In the authentication configuration interface, check Auto Protected Resource and record the login flow to trigger suggestion.
   Apply one authentication object to multiple entry points at once to speed up setup.
   📍Select multiple Entry Points in the list, click Assign Authentication, and choose an existing Authentication Object from the current project.
   Prioritize remediation by viewing the most common vulnerability types across the organization.
   📍View the Organization Dashboard to see the Top 5 Issue Types, then select a type to filter the Issues page by project.
   • Auto Protected Resource checkbox enables automatic suggestion of Protected Resources from recorded authentication traffic
   • Automatic detection of authentication triggers including 401/403 response statuses and 302 redirects with Location headers
   • Organization Dashboard widget displaying Top 5 Vulnerability Types with drill-down to filtered Issues pages
   • Assign Authentication bulk operation allowing assignment of a single Authentication Object to multiple Entry Points simultaneously
   • New MCP security tests: Predictable Session ID, Session Used as Authentication, and Session Not Invalidated After Logout

   +1 more show less

   • Xygeni integration allowing import of validated DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings into the Xygeni platform

   6 details in Everything

6. Release of June 29, 2026 Jun 29, 2026 · release notes

   Adds AESI detection for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. entry points and Secret Tokens per-leak findings

   • Adds AESI (ANSI Escape Sequence Injection) detection for MCP tool, resource, and prompt entry points to catch stored scenarios where malicious content written through one entry point appears in MCP responses consumed by AI agents.
   • Improves the Secret Tokens test so that each leaked token is now reported as a separate finding for full visibility, and adds detection of generic access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. in application responses.

   2 details in Everything

7. Release of June 2, 2026 Jun 2, 2026 · release notes

   New GitHub AgentHQ agent integration, flexible Jira field mapping, and automatic scan pause on connectivity loss

   • Introduces Bright Security as an agent in GitHub AgentHQ to run dynamic scans directly within GitHub sessions
   • Adds automatic mapping support for mandatory custom fields (e.g., Story Points, Priority) during Jira integration setup
   • Enables automatic pausing of scans and discoveries for up to seven days when infrastructure or connectivity issues are detected

   3 details in Everything

8. Release of May 5, 2026 May 5, 2026 · release notes

   Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server detection, runtime repeater indicators, task duration limits, and Anthropic/OpenAI-compatible STAR inference.

   • The crawler now detects MCP servers, extracting tools, resources, and prompts as separate entrypoints visible in a new MCP server name column with filter support
   • Adds runtime indicators to the Repeater selector and settings page showing queued, running, and scheduled execution counts
   • Allows filtering and searching repeaters by connectivity and workload in the Repeater selector and settings page
   • Shows the number of projects connected to each repeater in the Repeater settings page alongside new filtering and searching options
   • Supports using Anthropic inference for STAR agents

   +2 more show less

   • Supports any OpenAI-compatible endpoint (such as Azure or self-hosted inference) for STAR
   • Improves STAR agents' ability to understand connectivity between affected code and entry points in Go applications

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The GET /api/v1/scans/:scanId/issues endpoint is limited to a maximum of 100 issues per request on July 7, 2026; migration to the paginated GET /api/v2/scans/:scanId/issues endpoint is required for full dataset retrieval.
9. Release of April 7, 2026 Apr 7, 2026 · release notes

   Bright Security adds Organization Dashboard, API access to widget data, and BitBucket integration

   └──▷ HOW TO FIND IT
   Configure BitBucket as a code source in the STAR integration flow
   📍Navigate to Settings › Integrations › STAR and select Atlassian BitBucket from the provider list.
   • Adds the Organization Dashboard for a unified view across all projects with widgets for security grade, aging issues, and remediation trends
   • Enables API keys with projects:read scope to retrieve Project and Organization dashboard widget data programmatically
   • Adds Atlassian BitBucket code repositories and BitBucket Pipelines CI/CD service support in STAR

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MongoDB (NoSQL) Injection test is deprecated and removed from the platform
   • !Unconfirmed issues will no longer be generated as of May 5th
10. Release of March 10, 2026 Mar 10, 2026 · release notes

    Bright Security adds a Scans tab to the Project page for in-context scan management

    └──▷ HOW TO FIND IT
    Manage scans without leaving the project context
    📍In the console, go to Project › Scans tab
    • Adds a Scans tab directly within the Project page for viewing and managing scan activity

    1 detail in Everything