ZeroPath

No entries match these filters. Clear filters

1. changelog Oct 25, 2026 · issue 120

   ZeroPath adds configurable SD Elements task-status mapping and new Security Compass API/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. methods for verification push workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Re-push a repo's latest full scan to SD Elements after updating the task status mapping, to immediately reflect the new Pass/Partial/Fail→status rules.
   copy

   $ pushLatestScan

   List available SD Elements task statuses (admin only) before configuring a new project mapping.
   copy

   $ securityCompass.listTaskStatuses

   • Adds securityCompass.listTaskStatuses, updateProjectMapping, and pushLatestScan API and MCP methods for Security Compass integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds per-integration and per-project Task status mapping configuration to control which SD Elements task status each ZeroPath verification outcome (Pass, Partial, Fail) sets.
   • Adds Push latest scan action to re-push a repository's latest finished full scan to SD Elements on demand.
   • Adds lastPushStats object with fields countermeasuresMarkedDone, statusChangesRequested, passCount, partialCount, failCount, and notApplicableSkipped to track Security Compass push results.
   • Writes one verification note per countermeasure (Pass, Partial, or Fail) with finding list and links back to ZeroPath on every full scan push to SD Elements.

   +1 more show less

   • Restricts securityCompass.listTaskStatuses to users with the admin role, matching the mapping mutation permissions.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Integrations created before this change were given a default task status mapping of Pass→Complete, Partial→Incomplete, Fail→Incomplete; new integrations start with verification notes only and no task status changes by default.
2. changelog Oct 17, 2026 · issue 111

   ZeroPath: Issue search now accepts presentation: true and knownVulnerableVersion fields, and can filter by lane and sort by priority.

   └──▷ HOW TO FIND IT
   Download your organisation's full SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. inventory in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. format after a release, to feed into a downstream SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. pipeline.
   📍In the app, go to Reporting › Organization SBOM, select CycloneDX 1.6 JSON, then click Export. The downloaded ZIP contains one SBOM per repository plus a manifest listing included and skipped repositories.
   Pull the Audit log for the last 90 days filtered to admin actions, then export to CSV for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.
   📍In the app, go to Reporting › Audit log, set the date range to 90 days, filter by actor and level, then click Export CSV (up to 100,000 events).
   • Adds scans.list returning issue counts that include dependency findings.
   • listTags now returns tag ids and names; tag create/update requests take explicit include, exclude, and release changes.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Re-investigation from the app, API, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., or Assistant now requires Close Issues permission on the finding's repository; members who previously could re-investigate without it will receive a 403 until the permission is granted.
   • !Creating, editing, and deleting repository tags now requires Manage Teams or Edit SAST Configuration; members who previously had tag management access without these permissions will lose it.
   • !API key create, list, and delete operations now return 403 for requests authenticated with an API key or Authorization header; callers that managed keys programmatically must switch to a signed-in browser session.
   • !Tag create/update requests that include the (unspecified) previously accepted field are now refused; callers must use the explicit include, exclude, and release change fields instead.
3. Priority lanes, the lifecycle board, issue history, the Audit log page, and a regrouped dashboard seen Oct 16, 2026 · issue 110

   ZeroPath adds exploit-evidence priority lanes, a lifecycle board with expiring accepted risk, an Audit log, and expanded Issue search API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Download the organisation-wide SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. bundle (CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. for every repo) for an audit or supply-chain review.
   📍In the ZeroPath app, go to Reports › Generate, select Organization SBOM, choose CycloneDX 1.6 or SPDX 2.3 JSON, and click Generate. The resulting ZIP contains one SBOM per repository plus a manifest of included and skipped repositories.
   Export the last 90 days of admin activity as CSV for a compliance audit — filter to a specific actor first to narrow scope.
   📍In the ZeroPath app, go to Reporting › Audit log, set the date range to 90 days, filter by actor and level, then click Export CSV to download up to 100,000 events.
   • Adds Priority lanes on the Issues page, grouping open findings into Fix now, Needs decision, and Lower priority lanes (with Fix now requiring High/Critical CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. severity plus at least one exploit-evidence chip: Runtime Validation verdict, known exploited advisory, reachable dependency, Wiz internet exposure, or verified live secret), and an Issues scan source menu offering All, Full Scans, and Latest PR Scans for code scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Board view (lifecycle board) where findings move through Needs review, Backlog, Reviewing, and Patching stages by drag-and-drop, with a required close-reason dialog, an Undo window of 6 seconds, and Accepted risk expiry that automatically reopens a finding once its accepted-until date passes unless it was closed by other evidence.
   • Adds the Audit log page under Reporting for organization admins, filterable by actor, source, and level up to 90 days, with per-event endpoint and argument detail and Export CSV up to 100,000 events.
   • Adds a History tab on every finding showing status changes and detections in one timeline (naming the job, e.g. ZeroPath risk acceptance expiry, or ticket, e.g. Jira · SEC-12, behind each change) and a Dependencies tab on the issue panel grouping advisories by package with an exploit probability chart and quick filters including Known exploited and EPSS over 10%.
   • Adds a Repository risk overview on the Repositories page, listing repositories riskiest first with columns for open findings, Fix now findings, exploit evidence, and Protection status (scheduled scans, PR scanning, PR comments).

   +5 more show less

   • Adds issue search API support for returning and filtering by lane and evidence, sorting by priority, and returning linked tickets on issue list and search results.
   • Adds issues.vulnerabilityReport API/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. field returning the per-finding report, and presentation.evidence to issue search when called with presentation: true, where evidence.validated covers agent-, Runtime Validation-, and person-confirmed findings (with validationProvenance: "legacy" for findings confirmed before tracking) and knownVulnerableVersion: true marks version-match-only dependency findings without asserting reachability: "reachable".
   • Adds Create, list, and delete API key management endpoints accessible only from a signed-in browser session; requests authenticated with an API key or Authorization header receive 403 for these operations.
   • Adds Organization SBOM export that bundles the latest SBOM for every viewable repository into one ZIP in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. or SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. JSON, with a manifest of included and skipped repositories.
   • Adds Export report (.docx) under More actions on the full issue page for a per-finding downloadable report.
   • Adds Priority lanes on the Issues page, grouping open findings into Fix now, Needs decision, and Lower priority lanes (with Fix now requiring High/Critical CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. severity plus at least one exploit-evidence chip: Runtime Validation verdict, known exploited advisory, reachable dependency, Wiz internet exposure, or verified live secret), and an Issues scan source menu offering All, Full Scans, and Latest PR Scans for code scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Board view (lifecycle board) where findings move through Needs review, Backlog, Reviewing, and Patching stages by drag-and-drop, with a required close-reason dialog, an Undo window of 6 seconds, and Accepted risk expiry that automatically reopens a finding once its accepted-until date passes unless it was closed by other evidence.
   • Adds the Audit log page under Reporting for organization admins, filterable by actor, source, and level up to 90 days, with per-event endpoint and argument detail and Export CSV up to 100,000 events.
   • Adds a History tab on every finding showing status changes and detections in one timeline (naming the job, e.g. ZeroPath risk acceptance expiry, or ticket, e.g. Jira · SEC-12, behind each change) and a Dependencies tab on the issue panel grouping advisories by package with an exploit probability chart and quick filters including Known exploited and EPSS over 10%.
   • Adds a Repository risk overview on the Repositories page, listing repositories riskiest first with columns for open findings, Fix now findings, exploit evidence, and Protection status (scheduled scans, PR scanning, PR comments).

   +4 more show less

   • Adds issues.vulnerabilityReport API/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. field returning the per-finding report, and presentation.evidence to issue search when called with presentation: true, where evidence.validated covers agent-, Runtime Validation-, and person-confirmed findings (with validationProvenance: "legacy" for findings confirmed before tracking) and knownVulnerableVersion: true marks version-match-only dependency findings without asserting reachability: "reachable".
   • Adds Create, list, and delete API key management endpoints accessible only from a signed-in browser session; requests authenticated with an API key or Authorization header receive 403 for these operations.
   • Adds Organization SBOM export that bundles the latest SBOM for every viewable repository into one ZIP in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. or SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. JSON, with a manifest of included and skipped repositories.
   • Adds Export report (.docx) under More actions on the full issue page for a per-finding downloadable report.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Requesting a re-investigation from the app, API, MCP, or Assistant now requires the Close Issues permission on the finding's repository; organizations using access control must explicitly grant it to members who re-investigate findings, or those requests will receive 403.
   • !Creating, editing, and deleting repository tags now requires Manage Teams or Edit SAST Configuration; members who are not admins need a team that grants Manage Teams.
   • !Tag create and update API requests that pass the repositoryIds field are now refused; callers must switch to explicit include, exclude, and release fields.
   • !API key management (create, list, delete) now returns 403 for requests authenticated with an API key or an Authorization header; these operations require a signed-in browser session.
   • !A dependency finding confirmed only by a version match now carries knownVulnerableVersion: true and no longer reports reachability: "reachable" on that basis; callers relying on reachability for version-match findings will see a changed response.
4. changelog Oct 5, 2026 · issue 095
   └──▷ TRY IT
   Check whether a scan's SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export is still available before downloading — a 412 means the scan is retired and you must select a current one.
   copy

   $ curl -sf -o sbom.json -w '%{http_code}' \
     -H 'Authorization: Bearer <api_key>' \
     'https://<instance>/api/v1/scans/<scan_id>/export/cyclonedx' \
     || echo 'Scan retired (inventoryRetiredAt set) — select a current scan'

   Retrieve branch inventory and threat model metadata for a repository to feed an asset-management pipeline.
   copy

   $ curl -s \
     -H 'Authorization: Bearer <api_key>' \
     'https://<instance>/api/v1/repositories/<repo_id>/inventory?branch=main'

   Migrate a CI script from the deprecated remediation-time field to the new one so averages and sample sizes are both captured.
   copy

   $ curl -s \
     -H 'Authorization: Bearer <api_key>' \
     'https://<instance>/api/v1/trends' \
     | jq '{period: .trends[].period, remediationTime: .trends[].meanRemediationTimeInPeriod, sampleSize: .trends[].resolvedIssues}'

   └──▷ BREAKING ON UPGRADE

   • !trends[].meanRemediationTime is deprecated and replaced by trends[].meanRemediationTimeInPeriod; integrations reading the old field must migrate to the new one.
   • !For scans marked with inventoryRetiredAt, requests for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. exports now return 412 PRECONDITION_FAILED instead of results; callers must select a current scan.
   • !When scaPackage.dependencyPathsRetiredAt is set, dependencyPaths is omitted and transitiveDependencies may be empty; callers must treat dependency-path data as unavailable.
   • !On-premises scanner-setting updates must omit allowDeepSeekModels; payloads that include it will be rejected.
5. changelog Oct 4, 2026 · issue 094

   ZeroPath: Issue severity score may now be null, meaning unavailable rather than zero.

   └──▷ TRY IT
   Detect when a SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export is no longer available for a retired scan and fall back to selecting a current one.
   copy

   $ curl -s -o /dev/null -w '%{http_code}' \
     -H 'Authorization: Bearer <api_key>' \
     'https://api.zeropath.com/sbom/export?scanId=<scan_id>&format=cyclonedx'
   # 412 PRECONDITION_FAILED means the scan is marked inventoryRetiredAt — re-query for a current scan ID

   Guard a CI pipeline integration against the renamed remediation-time field before reading trend data.
   copy

   $ curl -s -H 'Authorization: Bearer <api_key>' \
     'https://api.zeropath.com/trends' \
     | jq '.trends[] | {period: .period, meanRemediationTimeInPeriod, sampleSize: .resolvedIssues}'

   Handle a nullable severity score safely when ingesting issues into a downstream risk tracker.
   copy

   $ curl -s -H 'Authorization: Bearer <api_key>' \
     'https://api.zeropath.com/issues' \
     | jq '[.issues[] | {id, severity: (.severity.score // "unavailable")}]'

   └──▷ BREAKING ON UPGRADE

   • !For scans marked with inventoryRetiredAt, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. exports now return 412 PRECONDITION_FAILED; callers must select a current scan.
   • !When scaPackage.dependencyPathsRetiredAt is set, dependencyPaths is omitted and transitiveDependencies may be empty; clients must treat this as unavailable data rather than an empty result.
   • !On-premises scanner-setting updates must omit allowDeepSeekModels; any existing configuration passing this field will be rejected.
   • !trends[].meanRemediationTime is deprecated and replaced by trends[].meanRemediationTimeInPeriod; integrations reading the old field must migrate.
   • !Issue severity score may now be null; clients that treat a zero score as unavailable must now handle null explicitly.
   • !Changes to shared rules, context, and scan locations now require access to both their current and destination scopes; operations that previously succeeded with narrower permissions may now fail.
6. docs update Oct 3, 2026 · issue 093

   ZeroPath: Adds inventoryRetiredAt signal on scans: CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. exports return 412 PRECONDITION_FAILED for retired scans; ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. exports are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Migrate a trends API consumer from the deprecated field to the replacement before the old field is removed.
   copy

   $ # Before
   echo $trends_meanRemediationTime
   
   # After
   echo $trends_meanRemediationTimeInPeriod
   # Sample size now in:
   echo $trends_resolvedIssues

   • Adds agent.getRepoCloneUrl gitConfig for Bitbucket Data Center to apply when cloning.
   • On-premises deployments must omit allowDeepSeekModels from scanner-setting updates; model selection belongs to deployment configuration.
   • Replaces deprecated trends[].meanRemediationTime with trends[].meanRemediationTimeInPeriod; trends[].resolvedIssues provides the sample size.
   • Adds branch inventory and threat model metadata through the API.
   • Adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. summary notifications — sent daily, weekly, or as detected with hourly checks — with findings preview, deadlines, and a link to overdue work; summaries and policy can be muted or paused independently.

   +2 more show less

   • Enables searching repositories and selecting current or earlier scans for reports.
   • Supports uploading directories from Windows with the CLI.
   • Adds agent.getRepoCloneUrl gitConfig for Bitbucket Data Center to apply when cloning.
   • On-premises deployments must omit allowDeepSeekModels from scanner-setting updates; model selection belongs to deployment configuration.
   • Adds branch inventory and threat model metadata through the API.
   • Adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. summary notifications — sent daily, weekly, or as detected with hourly checks — with findings preview, deadlines, and a link to overdue work; summaries and policy can be muted or paused independently.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !For scans marked with inventoryRetiredAt, CycloneDX, SPDX, and VEX exports now return 412 PRECONDITION_FAILED; callers must select a current scan.
   • !When scaPackage.dependencyPathsRetiredAt is set, dependencyPaths is omitted and transitiveDependencies may be empty; callers must treat dependency-path data as unavailable.
   • !trends[].meanRemediationTime is deprecated and replaced by trends[].meanRemediationTimeInPeriod; integrations reading the old field must migrate.
   • !On-premises scanner-setting updates must omit allowDeepSeekModels; including it will cause the update to fail.
   • !Issue severity score may now be null (meaning unavailable), not just zero; callers that treat null as zero must be updated.
   • !Changes to shared rules, context, and scan locations require access to both the current and destination scopes.
7. On-premises support, self-updating threat models, dashboard profiles, and repository inventory seen Oct 3, 2026 · issue 093

   ZeroPath adds on-premises Kubernetes support, self-updating threat models, dashboard profiles, a repository Inventory tab, a Scanner workspace, personal and service API keys, and new API fields for branch inventory and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings control.

   • New supported platformNew detectionAdds on-premises deployment in Kubernetes with OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., local accounts, AI gateway, S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage, and webhook delivery to private receivers.
   • Automatically updates threat models during full scans when architecture changes are detected, preserving user edits and recording section authorship and last-update timestamps.
   • Adds dashboard profiles to save layouts and filters across 13 widgets, kept personal or shared as organization templates, synchronized across devices.
   • Adds saved issue filters using CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0 metrics, Runtime Validation results, dates, and priority scores; Fix Now rules select findings by exploitability and CVSS criteria.
   • Adds the Inventory tab for exploring packages, licenses, dependency risk, and AI components by branch.

   +8 more show less

   • Adds the Scanner workspace for managing settings, scan locations, context, rules, and sources and sinks with consistent categories across organization, tag, and repository scope.
   • Adds personal API keys and administrator-created service API keys with a separate key per organization.
   • Adds detectionTypes parameter to issues.list, issues.search, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. issues_list; branch inventory and threat model metadata now available through the API.
   • Adds administrator download of service and scan diagnostic logs on-premises.
   • Adds PR scan timeout configuration starting from five minutes and directory upload from Windows via the CLI.
   • Adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. policy summaries configurable by event type, frequency (daily, weekly, or as detected), with mute and independent pause controls.
   • Adds repository search, current-or-earlier scan selection for reports, and remediation-time comparison by period with sample sizes.
   • Adds organization membership counts, member and repository search within a team, and granular permission assignment from the team editor.

   13 details in Everything

   • New integration Gerrit and CVS repository connections
   • New integration Multiple Bitbucket installations; Bitbucket Data Center PR scanning and instance-level tokens
   • Updated integration AI-authorship evidence extended to GitLab, Bitbucket, and Azure DevOps
   • New compliance framework ML-BOM export from Inventory tab
   └──▷ BREAKING ON UPGRADE

   • !issues.list, issues.search, and MCP issues_list now include SCA findings when detectionTypes is omitted; callers must add detectionTypes to retain code-only results.
   • !Issue severity and score may now be null, meaning unavailable rather than zero.
   • !CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. exports return 412 PRECONDITION_FAILED for scans marked inventoryRetiredAt; integrations must select a current scan.
   • !When scaPackage.dependencyPathsRetiredAt is set, dependencyPaths is omitted and transitiveDependencies may be empty.
   • !When agent.getRepoCloneUrl returns gitConfig for Bitbucket Data Center, that config must be applied when cloning.
   • !On-premises scanner-setting updates must omit allowDeepSeekModels; model selection now belongs to deployment configuration.
   • !Changes to shared rules, context, and scan locations now require access to both their current and destination scopes.
   • !trends[].meanRemediationTime is replaced by trends[].meanRemediationTimeInPeriod; trends[].resolvedIssues provides the sample size.
8. changelog Sep 26, 2026 · issue 086

   ZeroPath Issues API now includes dependency findings by default; Issues page All tab unified with dashboard totals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • The issues.list, issues.search, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. issues_list tool now include dependency findings when detectionTypes is omitted, aligning API defaults with the full open-findings set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The Issues page All tab now counts and lists dependency findings alongside code findings, matching the dashboard's Total Open card and repositories list.
   • The issues.list, issues.search, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. issues_list tool now include dependency findings when detectionTypes is omitted, aligning API defaults with the full open-findings set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The issues.list and issues.search APIs now return dependency findings in addition to code findings when detectionTypes is omitted. Integrations that relied on the previous code-only default must pass detectionTypes explicitly to preserve their prior behavior.
9. docs update Sep 24, 2026 · issue 084

   ZeroPath adds bulk action permission checks, scheduled run safeguards, and per-setting permission controls for repository management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds bulk action permission checking across multiple repositories — actions like scanning, scheduling, toggling PR settings, or deleting are disabled with an explanatory message when you lack permission on the full selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a two-hour runtime cap on scheduled assistant runs, automatically stopping and marking exceeded runs as failed with a timeout message.
   • Adds completion verification for scheduled runs, marking runs that exit without reporting a status and summary as failed rather than silently completed.
   • Adds Slack delivery confirmation for scheduled runs that require a Slack report, marking the run as failed if no confirmed delivery is detected.
   • Adds per-setting permission enforcement on repository settings pages — controls for scanner toggles, scan schedules, monorepo partitions, dependency settings, remediation options, PR templates, and danger zone actions are individually disabled with an explanation when you lack permission.

   +1 more show less

   • Adds a retry option on the repository settings page when the permission check itself fails, allowing re-check without a full page reload.

   6 details in Everything

10. docs update Sep 24, 2026 · issue 084

    ZeroPath adds saveable Dashboard Profiles with per-user layouts, filter presets, and org-wide shared templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Share a standardized vulnerability dashboard view with your whole org so every analyst opens the same widget layout and filters by default.
    📍1. On the ZeroPath dashboard, configure the filters (severity, application, date range) and arrange widgets via Edit Layout. 2. Click Save profile → Save as new, name it, and choose Org template. 3. Go to Settings → Teams and grant the Manage Dashboard Templates permission to the relevant team if needed. 4. Team members will see the template in their profile switcher and can select it to restore the shared layout instantly.
    • Introduces Dashboard Profiles — saved arrangements of dashboard widgets on a 12-column grid, bundled with active filters (date range, period, severity, vulnerability class, application) — so any profile restores both layout and filters in one click.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a profile switcher beside the page title that lists personal profiles and org templates shared across the organization, automatically opening the last-used (starred) profile on every device.
    • Adds Save profile and Save as new actions inside the layout editor to persist the current widget arrangement and filters back to an existing profile or create a new one.
    • Adds Edit Layout mode where widgets can be dragged by header, added from an Add widgets panel, or removed with ×; a red outline indicates an overlap conflict before placement.
    • Adds Manage profiles to open, star, duplicate, or delete profiles; duplicating an org template creates a personal editable copy.

    +1 more show less

    • Adds the Manage Dashboard Templates organization permission — held by admins and delegatable to teams under Settings → Teams — to gate creation, editing, and deletion of org-wide template profiles.

    6 details in Everything

11. docs update Sep 24, 2026 · issue 084

    ZeroPath adds asynchronous SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export jobs supporting CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. JSON, standalone VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., and ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. formats via UI and API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Check whether a scan's SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. inventory is still retained before requesting a CycloneDX or SPDX export, to avoid a 412 at job-creation time.
    copy

    $ # Call scans.getScan and inspect inventoryRetiredAt before submitting an export job
    # If scaScan.inventoryRetiredAt is set, target the latest scan instead

    List manifests for a repository and filter to only exportable scans by checking inventoryRetiredAt before queuing an SBOM job.
    copy

    $ # Call sca.listManifestsForRepository and select entries where inventoryRetiredAt is null
    # Use the matching scan ID when creating a CycloneDX JSON, SPDX JSON, VEX, or ML-BOM export job

    Trigger an SBOM export for a release branch via the UI so the artifact is available as a pre-signed URL for CI/CD or audit tickets.
    📍In the repository view, go to the Inventory tab, select the target branch, then click Export SBOM and choose the desired format (CycloneDX JSON, SPDX JSON, standalone VEX, or ML-BOM).
    • Adds 412 PRECONDITION_FAILED response (with message 'SCA inventory for scan … was retired on …; export the latest scan') when a CycloneDX, SPDX, or VEX export is requested against a scan whose inventory has been retired.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds scaScan.inventoryRetiredAt field returned by scans.getScan so integrations can detect whether a scan's inventory is still available before requesting an export.
    • Adds inventoryRetiredAt field to manifests returned by sca.listManifestsForRepository so integrations can select an exportable scan without inferring retirement from an empty package list.
    • Supports asynchronous SBOM export jobs in four formats — CycloneDX JSON (with optional embedded VEX), SPDX JSON, standalone VEX, and ML-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. — created via the API or UI.
    • Uploads finished SBOM artifacts to managed object storage and returns a pre-signed download URL, with a 24-hour default retention policy configurable per tenant.

    +3 more show less

    • Tracks export job status, attempt count, and expiration with automatic retries; delivers completion notifications via webhook.
    • Exposes SBOM export from the repository Inventory tab via an Export SBOM action targeting the selected branch's latest finished full scan.
    • ML-BOM exports are built from the AI inventory and are never blocked by SCA inventory retirement, making them always available regardless of scan retention state.
    • Adds 412 PRECONDITION_FAILED response (with message 'SCA inventory for scan … was retired on …; export the latest scan') when a CycloneDX, SPDX, or VEX export is requested against a scan whose inventory has been retired.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports asynchronous SBOM export jobs in four formats — CycloneDX JSON (with optional embedded VEX), SPDX JSON, standalone VEX, and ML-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. — created via the API or UI.
    • Uploads finished SBOM artifacts to managed object storage and returns a pre-signed download URL, with a 24-hour default retention policy configurable per tenant.
    • Tracks export job status, attempt count, and expiration with automatic retries; delivers completion notifications via webhook.
    • Exposes SBOM export from the repository Inventory tab via an Export SBOM action targeting the selected branch's latest finished full scan.

    +1 more show less

    • ML-BOM exports are built from the AI inventory and are never blocked by SCA inventory retirement, making them always available regardless of scan retention state.

    2 more in Everything

12. docs update Sep 24, 2026 · issue 084

    ZeroPath SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. adds AI bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts., per-repo Inventory tab, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export (CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format./VEX/ML-BOM), and SPDX license grouping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Share a direct link to a specific branch's AI components inventory view with your security team for review.
    📍https://<your-zeropath-instance>/repo/<repo-name>?tab=inventory&view=ai-components&branch=main
    Export a CycloneDX SBOM for a specific repository scan to feed into your supply chain compliance pipeline.
    📍In the repository detail page, open the Inventory tab, select the target branch from the Branch picker, then click Export SBOM and choose CycloneDX.
    • Adds ?tab=inventory&view=<view>&branch=<name> URL parameters to per-repository Inventory tab pages, making branch-specific inventory views directly shareable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exports CycloneDX, SPDX, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., and ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. artifacts via an Export SBOM action on the per-repository Inventory tab, generated from the same inventory the UI shows.
    • Adds a per-repository Inventory tab with Supply Chain sub-views — Overview (posture and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. exposure), Risk, Dependencies, Licenses, and AI components — scoped to a single repository and selectable by branch.
    • Introduces an AI Bill of Materials view covering SDKs, agent frameworks, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, model files, and agent configs found in the codebase.
    • Adds per-package SPDX licenses enriched and grouped into informational obligation categories to support legal and compliance reviews.

    +1 more show less

    • Enables SCA by default in scanner settings so every full scan also parses manifests and lockfiles, surfacing dependency findings alongside SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. results.
    • Adds ?tab=inventory&view=<view>&branch=<name> URL parameters to per-repository Inventory tab pages, making branch-specific inventory views directly shareable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exports CycloneDX, SPDX, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., and ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. artifacts via an Export SBOM action on the per-repository Inventory tab, generated from the same inventory the UI shows.
    • Adds a per-repository Inventory tab with Supply Chain sub-views — Overview (posture and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. exposure), Risk, Dependencies, Licenses, and AI components — scoped to a single repository and selectable by branch.
    • Introduces an AI Bill of Materials view covering SDKs, agent frameworks, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, model files, and agent configs found in the codebase.
    • Adds per-package SPDX licenses enriched and grouped into informational obligation categories to support legal and compliance reviews.

    1 more in Everything

13. docs update Sep 24, 2026 · issue 084

    ZeroPath self-hosted gains Dynamic Testing / Runtime Validation starting in onprem-2026.09.07-beta, enabled via a Helm value.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable Runtime Validation on a self-hosted ZeroPath cluster so DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. runs stay entirely inside your private network.
    yaml copy

    runtimeValidation:
      enabled: true

    • Enables Runtime Validation (Dynamic Testing / DAST) on self-hosted deployments via the Helm value runtimeValidation.enabled: true, available from release onprem-2026.09.07-beta onward.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Runs sandboxes as short-lived pods under a RuntimeClass (gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. by default) on designated nodes, with each run getting its own isolated pod.
    • Routes OOB callbacks to a private collector on a team-delegated DNS zone (e.g. oob.security.internal) instead of the cloud callback domain, requiring resolvers to forward that zone and reachability on ports 53, 80, and 443.
    • Restricts sandbox network egress via NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. to private networks only — the application under test, model proxy, internal package mirrors, and the callback collector — with no public internet access.
    • Stages local artifacts on a shared scan volume backed by an S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. object store, with a 30-day expiry.

    +1 more show less

    • Guarantees callback channel health by running a positive control against the collector before and after each test, so a negative OOB verdict is only returned when the channel is confirmed healthy.

    6 details in Everything

14. docs update Sep 24, 2026 · issue 084

    ZeroPath adds automatic Jira & Linear ticket sync on finding status changes, plus smarter PR false-positive filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    When triaging a PR finding as a false positive, set its status so ZeroPath automatically comments on and closes the linked Jira or Linear ticket without manual follow-up.
    📍In the ZeroPath findings view, open the finding, change its status to False Positive (or Resolved / Non-exploitable). ZeroPath posts a comment to the linked Jira or Linear ticket recording the status, reason, and actor — and closes the ticket if all linked findings are now closed.
    • Filters out pre-existing vulnerabilities that appear newly introduced due to file moves or refactors defeating diff rename detection, so only vulnerabilities genuinely introduced by the PR are reported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Omits individual findings that cannot receive a clear verdict during deep confirmation (due to ambiguous evidence or missing context) rather than failing the entire confirmation phase, so more PR scans complete successfully.
    • Filters out pre-existing vulnerabilities that appear newly introduced due to file moves or refactors defeating diff rename detection, so only vulnerabilities genuinely introduced by the PR are reported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

15. docs update Sep 24, 2026 · issue 084

    ZeroPath adds automatic fix verification, Verified Fixed state, and cross-tracker sync for Jira and Linear on investigation completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Automatically updates connected Jira or Linear tickets with the investigation outcome and verdict reason when an investigation completes, keeping external trackers in sync without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Investigation results now refresh the finding's confidence value and recompute its priority score from current severity and new confidence for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings; manually overridden severity is preserved.
    • Findings where automated review could not complete surface as a standardized unverified assessment in the default issue queue, signaling that they require manual triage.
    • File paths referenced in findings are validated against actual repository contents, preventing phantom path references in assessments.
    • Preconditions in findings are stated as objective security conditions — network exposure, infrastructure controls, authentication requirements, and reachable entry points — with concrete code or configuration evidence cited when available.

    +1 more show less

    • Investigations can be requested via the API, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, or directly from the issue detail view in the dashboard.
    • Automatically updates connected Jira or Linear tickets with the investigation outcome and verdict reason when an investigation completes, keeping external trackers in sync without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Findings where automated review could not complete surface as a standardized unverified assessment in the default issue queue, signaling that they require manual triage.

    4 more in Everything

16. docs update Sep 24, 2026 · issue 084

    ZeroPath adds Bitbucket Cloud and Bitbucket Data Center as supported repository integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect an entire Bitbucket Data Center instance to ZeroPath using a user HTTP access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. so every project that user can see is scanned automatically.
    📍In the ZeroPath UI, go to repository connections and choose Bitbucket Data Center. Enter your user HTTP access token and instance domain, select All accessible projects, then choose Add all accessible Bitbucket repositories. Grant the Project administration / Webhooks permission on the token to enable automatic pull-request webhooks.
    • Adds Bitbucket Cloud support via workspace access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., connecting all repositories in a workspace to ZeroPath.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Bitbucket Data Center support via user HTTP access tokens (all projects visible to that user) or project-scoped tokens, with the instance domain required at connection time.
    • Supports Project administration / Webhooks permission on Bitbucket tokens to enable automatic pull-request webhooks.
    • Adds Add all accessible Bitbucket repositories bulk-import option alongside individual repository selection when connecting Bitbucket.

    4 details in Everything

17. docs update Sep 24, 2026 · issue 084

    ZeroPath self-hosted deployments gain direct webhook delivery with custom headers, internal address support, and encrypted credential storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Self-hosted (on-prem) deployments now accept a webhook endpoint URL and optional custom authorization header directly in the integration form, delivering events straight from the ZeroPath instance without any Svix dependency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Self-hosted webhook receivers support internal addresses including internal DNS names, private IP ranges, non-standard ports, and plain http, since the receiver sits inside the operator's own network.
    • Setting CREDENTIAL_ENCRYPTION_KEY on the frontend causes custom authorization headers to be stored encrypted at rest; without the key, headers are stored as plaintext.

    3 details in Everything

18. docs update Sep 24, 2026 · issue 084

    ZeroPath API gains member-action permission fields on team responses and cron schedule listing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Team API responses now include memberActions: { add: boolean, remove: boolean } to indicate whether the calling user can add or remove members, based on team-level and organization-level permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds endpoint to list all cron schedules, each including its cronExpression.

    2 details in Everything

19. docs update Sep 24, 2026 · issue 084

    ZeroPath adds Bitbucket Data Center integration and self-hosted OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports connecting a self-hosted Bitbucket Server or Data Center instance to ZeroPath via HTTP access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., enabling full scans, pull request scans, build statuses, and inline comments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds OIDC single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration for self-hosted ZeroPath deployments, with a Keycloak walkthrough included.

    2 details in Everything

20. docs update Sep 15, 2026 · issue 075

    ZeroPath MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server authentication gains service keys for org-wide, user-independent machine integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for service API keys (organization-admin authority, not tied to any individual user) as an alternative to personal API keys — recommended for long-lived machine integrations such as MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

21. docs update Sep 15, 2026 · issue 075

    ZeroPath adds a 0–100 priority score per finding, blending severity and agent confidence to surface validated results first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces a 0–100 finding priority score calculated as severity × confidence for validated findings and a reduced 0–10 scale (severity only) for unvalidated findings, ensuring agent-confirmed results surface first in issue lists and dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Preserves customer-edited application overviews and threat model sections even when the underlying directory is renamed or removed.
    • Introduces a 0–100 finding priority score calculated as severity × confidence for validated findings and a reduced 0–10 scale (severity only) for unvalidated findings, ensuring agent-confirmed results surface first in issue lists and dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

22. docs update Sep 15, 2026 · issue 075

    ZeroPath adds granular repository permissions and server-side access enforcement for Rules, Custom Sources, and Sinks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a repository-create permission that gates creating repositories, uploading scan targets, and configuring or redrawing monorepo partitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds server-side permission enforcement for configuration pages — Rules, Context, Locations, Custom Sources & Sinks, Members, Notifications, and Tags — returning an Access Denied error with actionable messaging instead of a blank page when access is missing.
    • Read access to Custom Rules, Custom Sources, and Custom Sinks is now gated by the same permission that controls sidebar visibility, causing the list and detail API endpoints for those resources to return an authorization error when a user lacks access.
    • API tokens and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. admin sessions bypass the Custom Rules / Custom Sources / Custom Sinks read-access gating, matching existing write-operation behavior.
    • Adds a repository-create permission that gates creating repositories, uploading scan targets, and configuring or redrawing monorepo partitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds server-side permission enforcement for configuration pages — Rules, Context, Locations, Custom Sources & Sinks, Members, Notifications, and Tags — returning an Access Denied error with actionable messaging instead of a blank page when access is missing.
    • Read access to Custom Rules, Custom Sources, and Custom Sinks is now gated by the same permission that controls sidebar visibility, causing the list and detail API endpoints for those resources to return an authorization error when a user lacks access.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !List and detail API endpoints for Custom Rules, Custom Sources, and Custom Sinks now return an authorization error for users who lack the corresponding read permission, where they previously may have returned data.
23. docs update Sep 15, 2026 · issue 075

    ZeroPath SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. policies gain an enabled/disabled toggle to pause enforcement without losing configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Pause SLA enforcement during a migration without losing policy configuration, then re-enable when ready.
    📍1. Go to your SLA Policies dashboard. 2. Locate the policy card you want to pause. 3. Click the enabled/disabled toggle on the policy card to disable it — breach tracking, SLI snapshots, and compliance reports stop immediately. 4. When the migration is complete, click the toggle again to re-enable; if the policy has an SLO target, measurement resumes at the next nightly SLI snapshot.
    • Adds an enabled/disabled toggle to each SLA policy card, letting you suspend breach tracking, SLISLISite Level Indicator — a Google SRE concept for a quantitative measure of service reliability, such as request latency or error rate, used by tools to track whether a system meets its availability targets. snapshots, and compliance reports temporarily without deleting the policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

24. docs update Sep 15, 2026 · issue 075

    ZeroPath threat models now track edit attribution and dual freshness timestamps so teams can distinguish agent-generated from human-revised content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    After a scan regeneration, quickly verify which threat model sections still reflect your team's input vs. what the agent rewrote.
    📍In the ZeroPath platform, open the threat model for your application. For each fixed section, check the attribution label: customer-edited shows your team's last editor name and save time; agent-generated sections show the Agent generated at timestamp. Compare Evidence checked at against Agent generated at to see if evidence was rechecked without triggering a rewrite.
    • Adds edit attribution to threat model sections, recording who last saved each fixed section and when, and marking content as customer-edited vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ agent-generated.
    • Adds Agent generated at and Evidence checked at timestamps to each threat model so teams can distinguish when content was last written from when evidence was last checked.
    • Customer-edited sections are pinned so that subsequent scan refreshes do not overwrite team-written content.

    3 details in Everything

25. docs update Sep 15, 2026 · issue 075

    ZeroPath scan-completion webhook now includes metadata.prUrl to link PR scan results back to the originating pull request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds metadata.prUrl field to scan-completion webhook payloads for PR scans, providing the pull request URL without additional API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

26. docs update Sep 15, 2026 · issue 075

    ZeroPath adds complete finding exports, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. boundary reasoning, and fixes severity handling for unlabelled SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. advisories⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Exports now include all matching findings regardless of whether they have a confidence or priority score, with unassessed findings reporting null confidence and score values instead of being silently omitted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • SCA findings from advisories without a severity label now display no severity rather than a fabricated default Low value of 2.5.
    • CVSS Subsequent System metrics (SC, SI, SA) are now scored independently from Vulnerable System metrics (VC, VI, VA), each with dedicated written rationale explaining whether an exploit crosses a security boundary.
    • Stale application records (directories that no longer exist in the current checkout) are now skipped during scanning while preserving any customer-authored overviews or threat models in the database.
    • Investigations can now be requested via the API, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, or directly from the issue detail view in the dashboard.

    +2 more show less

    • Investigation results for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings now preserve any manually overridden severity, updating only the confidence and resulting priority score.
    • Severity labels now follow the standard CVSS rating scale: Critical (9.0–10.0), High (7.0–8.9), Medium (4.0–6.9), Low (0.1–3.9).
    • Exports now include all matching findings regardless of whether they have a confidence or priority score, with unassessed findings reporting null confidence and score values instead of being silently omitted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • CVSS Subsequent System metrics (SC, SI, SA) are now scored independently from Vulnerable System metrics (VC, VI, VA), each with dedicated written rationale explaining whether an exploit crosses a security boundary.
    • Stale application records (directories that no longer exist in the current checkout) are now skipped during scanning while preserving any customer-authored overviews or threat models in the database.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !SCA findings from advisories without a severity label no longer default to a Low severity of 2.5 — they now display no severity. Any workflow or export that previously relied on unlabelled advisories carrying a numeric severity will now receive a null/absent value instead.
27. changelog Sep 14, 2026 · issue 074

    ZeroPath: Adds access sync and repository permissions import from GitHub (five roles, including direct collaborators) and Bitbucket (Cloud workspace groups and Server project groups), mapping provider roles onto 39 permissions across 10 groups.

    └──▷ TRY IT
    Connect an AI coding assistant to your ZeroPath findings without installing anything or copying an API key.
    copy

    $ # In Claude, Cursor, Codex, or any Streamable HTTP MCP client,
    # add the following as a remote MCP server URL:
    https://zeropath.com/mcp
    # Sign in through your browser when prompted. The session is read-only
    # until you explicitly approve a change.

    Route scan notifications and vulnerability alerts to a Microsoft Teams channel without an Azure AD app registration.
    📍In Microsoft Teams: 1. Open the channel you want to receive alerts -> Manage channel -> Connectors -> Incoming Webhook -> Configure. 2. Copy the generated webhook URL. In ZeroPath: 3. Go to Settings -> Connections -> Notifications. 4. Add a new Microsoft Teams channel and paste the webhook URL. 5. Configure notification rules to select which events (scan complete, new vulnerability, SLA breach) reach that channel.
    Enable Continuous Scanning on a repository so findings always reflect the default branch between scheduled scans.
    📍In ZeroPath: 1. Open Scanner -> Configuration -> Scanner settings for the target repository (or org/tag scope). 2. Under the Full scans category, enable Continuous Scanning. 3. Save. From this point, every meaningful commit to the default branch (including merged pull requests) triggers a follow-up scan that closes findings the commits resolved.
    └──▷ BREAKING ON UPGRADE

    • !On repository objects, lastScanError is replaced by lastScanFailure; any API consumer reading lastScanError will receive no value.
    • !Eleven measurements on the security posture endpoint now return no value where there is nothing to measure — consumers must treat these fields as optional.
    • !On secret findings, the dismissal explanation generated by ZeroPath is withheld from the API response; only a reviewer's own note is returned.
    • !Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories.
    • !Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it.
28. changelog Sep 13, 2026 · issue 073

    ZeroPath: Adds a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://zeropath.com/mcp supporting Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. clients (Claude, Cursor, Codex); connections are read-only until approved, and administrators can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect an AI coding assistant to your ZeroPath findings without installing anything or managing API keys.
    📍# In Claude, Cursor, Codex, or any Streamable HTTP MCP client, # set the MCP server URL to: https://zeropath.com/mcp # Then authenticate via browser when prompted. The session is read-only until you explicitly approve changes.
    • Adds Microsoft Teams channel notifications via Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer.; a channel owner pastes an incoming webhook URL into ZeroPath — no Azure AD app registration required — and notification rules control which events reach which channels.
    • Adds Continuous Scanning mode: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), re-examines what changed on follow-up scans, and closes findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
    • Adds Assistant skills: administrators author reusable methodology (triage approach, patch-review criteria, report structure, codebase conventions) from the Skills tab; four built-in skills ship for triage, dependency reachability, report writing, and patch review, each forkable into an editable copy.
    • Adds Plan first mode for the Assistant: proposes an editable plan before anything runs, with the option to save the approved plan as a schedule, trigger, or playbook.
    • Adds a Scanner workspace consolidating all scan-configuration pages (Configuration: scanner settings and scan locations; Detection: repository context, rules, sources and sinks) under a single sidebar entry.

    +5 more show less

    • Adds scoped scanner permissions: rules, repository context, and scan location pages reflect the actions a member holds; Teams permission editor lists every grantable permission.
    • Raises final validation coverage to up to 1,000 findings per scan (up from 50).
    • Adds Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero to repository size measurement, enabling analysis-depth scaling for those codebases.
    • Adds pull request address to pull request scan webhooks.
    • Adds Jira and Linear ticket creation as a per-repository permission (must be granted explicitly when access control is enabled).
    • Adds Microsoft Teams channel notifications via Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer.; a channel owner pastes an incoming webhook URL into ZeroPath — no Azure AD app registration required — and notification rules control which events reach which channels.
    • Adds Continuous Scanning mode: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), re-examines what changed on follow-up scans, and closes findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
    • Adds Assistant skills: administrators author reusable methodology (triage approach, patch-review criteria, report structure, codebase conventions) from the Skills tab; four built-in skills ship for triage, dependency reachability, report writing, and patch review, each forkable into an editable copy.
    • Adds Plan first mode for the Assistant: proposes an editable plan before anything runs, with the option to save the approved plan as a schedule, trigger, or playbook.
    • Adds a Scanner workspace consolidating all scan-configuration pages (Configuration: scanner settings and scan locations; Detection: repository context, rules, sources and sinks) under a single sidebar entry.

    +2 more show less

    • Adds scoped scanner permissions: rules, repository context, and scan location pages reflect the actions a member holds; Teams permission editor lists every grantable permission.
    • Adds Jira and Linear ticket creation as a per-repository permission (must be granted explicitly when access control is enabled).

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On repository objects, lastScanError is replaced by lastScanFailure; any API consumer or integration reading lastScanError will receive no value and must update to lastScanFailure.
    • !Eleven measurements on the security posture endpoint now return no value where there is nothing to measure — consumers must treat these fields as optional.
    • !On secret findings, the dismissal explanation generated by ZeroPath is withheld from API responses; only a reviewer's own note is returned.
29. changelog Sep 12, 2026 · issue 072

    ZeroPath adds a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, Microsoft Teams alerts, Gerrit/CVS support, Continuous Scanning, and Assistant skills in this release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect an AI coding assistant to your ZeroPath findings via the hosted MCP server — no install, no API key.
    📍# In Claude Desktop, Cursor, or any Streamable HTTP MCP client, point the server URL at: https://zeropath.com/mcp # Sign in through your browser when prompted. The session is read-only until you explicitly approve changes.
    • Adds a remote MCP server at https://zeropath.com/mcp — connect Claude, Cursor, Codex, or any Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. client to your findings with no install and no API key; connections are read-only until you approve changes, and an administrator can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds lastScanFailure field on repository objects, replacing lastScanError, carrying both the error message and the outcome.
    • Adds Continuous Scanning mode — triggers a full scan on every meaningful commit to a default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; configurable per organization, tag, or repository on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server.
    • Adds Gerrit integration: imports projects for full scans and scans each open change as new patch sets arrive, posting findings as a review message on the patch set.
    • Adds CVS integration: imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning.

    +19 more show less

    • Adds GitHub Enterprise Cloud with data residency as a supported version control host.
    • Adds Microsoft Teams channel notifications — scan notifications and vulnerability alerts delivered as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer. via an incoming webhook, with no Azure AD app registration required; notification rules control which events reach which channels.
    • Adds Assistant skills: reusable methodology definitions (triage, dependency reachability, report writing, patch review) that the Assistant applies while working, authorable from the Skills tab with four built-in forkable skills.
    • Adds pull request submission status tracking on approved patches — showing queued, in-progress step, retry state, or stop reason — with Cancel and Retry actions and up to five automatic submission attempts.
    • Adds Jira and Linear ticket links to CSV exports and the export endpoint.
    • Adds a dependency findings tab on the Issues page with CVE, advisory, and package search.
    • Adds scoped tag and repository filtering to monthly, organization summary, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. compliance, and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports, stated on the report cover.
    • Adds on-demand Jira ticket sync preview showing each linked ticket's pending action before you apply it.
    • Adds a What's new panel in the top bar surfacing the three most recent releases, with unread indicators.
    • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vector support, assessing subsequent-system impact on its own evidence.
    • Adds severity labels following CVSS rating bands: Critical ≥ 9.0, High ≥ 7.0, Medium ≥ 4.0, Low ≥ 0.1.
    • Adds a scope control at the top of Supply Chain to narrow all tabs to a selected set of repositories, teams, and tags.
    • Adds Wiz export behavior: first export marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records.
    • Secrets scanning now reports the coverage it achieved, naming any file too large to read within the scan's time budget.
    • Adds Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero to repository size calculations, qualifying those repositories for deeper analysis.
    • Ticket creation for Jira and Linear is now a per-repository permission requiring an explicit grant when access control is enabled.
    • MCP tool calls are recorded in the audit log by parameter name, ensuring credentials passed to a tool never appear in audit rows or a connected SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    • A completed pull request scan links to the findings list it produced, with a separate dependency findings link.
    • The dashboard now covers a full year at a glance, with a quarterly period option.
    • Adds a remote MCP server at https://zeropath.com/mcp — connect Claude, Cursor, Codex, or any Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. client to your findings with no install and no API key; connections are read-only until you approve changes, and an administrator can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds lastScanFailure field on repository objects, replacing lastScanError, carrying both the error message and the outcome.
    • Adds Continuous Scanning mode — triggers a full scan on every meaningful commit to a default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; configurable per organization, tag, or repository on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server.
    • Adds Gerrit integration: imports projects for full scans and scans each open change as new patch sets arrive, posting findings as a review message on the patch set.
    • Adds CVS integration: imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning.

    +12 more show less

    • Adds GitHub Enterprise Cloud with data residency as a supported version control host.
    • Adds Microsoft Teams channel notifications — scan notifications and vulnerability alerts delivered as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer. via an incoming webhook, with no Azure AD app registration required; notification rules control which events reach which channels.
    • Adds Assistant skills: reusable methodology definitions (triage, dependency reachability, report writing, patch review) that the Assistant applies while working, authorable from the Skills tab with four built-in forkable skills.
    • Adds pull request submission status tracking on approved patches — showing queued, in-progress step, retry state, or stop reason — with Cancel and Retry actions and up to five automatic submission attempts.
    • Adds a dependency findings tab on the Issues page with CVE, advisory, and package search.
    • Adds a What's new panel in the top bar surfacing the three most recent releases, with unread indicators.
    • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vector support, assessing subsequent-system impact on its own evidence.
    • Adds severity labels following CVSS rating bands: Critical ≥ 9.0, High ≥ 7.0, Medium ≥ 4.0, Low ≥ 0.1.
    • Adds a scope control at the top of Supply Chain to narrow all tabs to a selected set of repositories, teams, and tags.
    • Adds Wiz export behavior: first export marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records.
    • Ticket creation for Jira and Linear is now a per-repository permission requiring an explicit grant when access control is enabled.
    • MCP tool calls are recorded in the audit log by parameter name, ensuring credentials passed to a tool never appear in audit rows or a connected SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..

    7 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On repository objects, lastScanError is replaced by lastScanFailure; any integration or script reading lastScanError will receive no value after upgrade.
    • !On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned.
    • !Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories.
    • !A finding ZeroPath has not assessed now appears in the queue as Needs Review (ranked on severity alone), widening the previous rule that only verified findings appeared — open counts will rise after upgrade.
30. changelog Sep 11, 2026 · issue 071

    ZeroPath: Adds Microsoft Teams channel notifications via Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer.; a channel owner pastes an incoming webhook URL into ZeroPath — no Azure AD app registration or tenant-admin required.

    └──▷ HOW TO FIND IT
    Connect an AI coding assistant to your ZeroPath findings without installing anything or managing API keys — useful for letting Claude or Cursor query live vulnerability data during a code review session.
    📍# In Claude, Cursor, Codex, or any Streamable HTTP MCP client, # set the server URL to: https://zeropath.com/mcp # Sign in through the browser prompt; the session is read-only until you explicitly approve changes.
    • Adds Gerrit project scanning: full scans and per-patch-set scanning of open changes, with findings posted as review messages on the patch set.
    • Adds Assistant Skills: reusable, administrator-authored methodology files (triage, dependency reachability, report writing, patch review) that guide the Assistant's behavior; four built-in skills ship forkable; changes apply to the next run.
    • Adds access sync for GitHub and Bitbucket teams (including Bitbucket Cloud workspace groups and Bitbucket Server project groups), mapping provider roles to 39 ZeroPath permissions across 10 groups.
    • Adds Jira and Linear ticket creation as a per-repository permission; organizations using access control must grant it explicitly.
    • Hardcoded-credential findings are redacted on every surface and classified by CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances..

    +4 more show less

    • Final validation now covers up to 1,000 findings per scan, twenty times the previous limit.
    • Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero now count toward repository size for analysis-depth decisions.
    • Select-all across pages now acts on the full filtered findings set, so bulk triage applies to exactly the displayed results.
    • Eleven measurements on the security posture endpoint return no value (instead of a placeholder) where there is nothing to measure.
    • Adds Gerrit project scanning: full scans and per-patch-set scanning of open changes, with findings posted as review messages on the patch set.
    • Adds Assistant Skills: reusable, administrator-authored methodology files (triage, dependency reachability, report writing, patch review) that guide the Assistant's behavior; four built-in skills ship forkable; changes apply to the next run.
    • Adds access sync for GitHub and Bitbucket teams (including Bitbucket Cloud workspace groups and Bitbucket Server project groups), mapping provider roles to 39 ZeroPath permissions across 10 groups.
    • Adds Jira and Linear ticket creation as a per-repository permission; organizations using access control must grant it explicitly.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On repository objects, lastScanError is replaced by lastScanFailure; any integration reading lastScanError will receive no data after upgrade.
31. changelog Sep 10, 2026 · issue 070

    ZeroPath: Adds a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://zeropath.com/mcp — point Claude, Cursor, Codex, or any Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. client at it, authenticate via browser, and work with findings with no install and no API key required; connections are read-only until changes are approved, and administrators can revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect an AI coding assistant to your ZeroPath findings instantly, without managing API keys.
    📍# In Claude, Cursor, Codex, or any Streamable HTTP MCP client, # set the MCP server URL to: https://zeropath.com/mcp # Then authenticate via your browser when prompted.
    Keep findings current on an active default branch between scheduled scans by enabling Continuous Scanning.
    📍In ZeroPath: go to Scanner › Configuration › Scanner Settings, select the Full Scans category at organization, tag, or repository scope, and enable Continuous Scanning.
    • Adds Microsoft Teams channel notifications — paste an incoming webhook from Teams into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., with no Azure AD app registration required.
    • Adds Assistant skills — author reusable methodology (triage, dependency reachability, report writing, patch review) from the Skills tab; four built-in skills ship and are forkable into editable copies.
    • Adds a quarterly period option to the dashboard, which now covers a full year at a glance.
    • Adds Slack reconnection in place, with missing-permission scopes named explicitly.
    • Adds a duplicate-detection surface when adding repositories, surfacing likely duplicates from host migrations with a git history probe per match.

    +5 more show less

    • Adds a unified Scanner workspace in the main sidebar, grouping Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks) with permission-scoped actions.
    • Adds grouped Settings navigation with Workspace, Security, and Connections sidebars, and consistent five-category scanner settings (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope.
    • Raises final validation coverage to up to 1,000 findings per scan, up from 50.
    • Adds Ticket creation as a per-repository permission for Jira and Linear, required for organizations using access control.
    • Adds integration connection permissions: connecting an integration requires Create Integrations or Create Installations; adding a repository by URL requires Create Repositories.
    • Adds Microsoft Teams channel notifications — paste an incoming webhook from Teams into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., with no Azure AD app registration required.
    • Adds Assistant skills — author reusable methodology (triage, dependency reachability, report writing, patch review) from the Skills tab; four built-in skills ship and are forkable into editable copies.
    • Adds a duplicate-detection surface when adding repositories, surfacing likely duplicates from host migrations with a git history probe per match.
    • Adds a unified Scanner workspace in the main sidebar, grouping Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks) with permission-scoped actions.
    • Adds grouped Settings navigation with Workspace, Security, and Connections sidebars, and consistent five-category scanner settings (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope.

    +2 more show less

    • Adds Ticket creation as a per-repository permission for Jira and Linear, required for organizations using access control.
    • Adds integration connection permissions: connecting an integration requires Create Integrations or Create Installations; adding a repository by URL requires Create Repositories.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On repository objects, lastScanError is replaced by lastScanFailure; any API client or integration reading lastScanError will receive no value and must be updated to read lastScanFailure.
    • !On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned.
    • !Eleven measurements on the security posture endpoint now return no value where there is nothing to measure; clients that expected a numeric zero must treat these fields as optional.
    • !Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories — existing automations without these grants will be refused.
    • !Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it or ticket creation will be refused.
32. changelog Sep 9, 2026 · issue 069

    ZeroPath adds a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, Microsoft Teams alerts, Gerrit/CVS support, Continuous Scanning, and Assistant skills in this release.

    └──▷ TRY IT
    Connect Claude Desktop or Cursor to your ZeroPath findings with no API key — just point the client at the hosted MCP server and authenticate via browser.
    copy

    $ https://zeropath.com/mcp

    Route ZeroPath scan notifications to a Microsoft Teams channel without Azure AD — create an incoming webhook in Teams and register it in ZeroPath.
    📍In ZeroPath, go to Settings › Connections › Notifications, select Microsoft Teams, and paste the incoming webhook URL generated from your Teams channel settings.
    • Adds a remote MCP server at https://zeropath.com/mcp supporting Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. clients (Claude, Cursor, Codex); connections are read-only until changes are approved, and administrators can revoke all org connections at once.
    • Adds lastScanFailure to the repository object in the API, carrying both the message and the outcome of a failed scan.
    • Adds Microsoft Teams channel notifications via incoming webhook — paste the webhook URL into ZeroPath to deliver scan notifications and vulnerability alerts as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., with no Azure AD app registration required.
    • Adds Gerrit project support: imports projects for full scans and scans each open change on new patch sets, posting findings as a review message on the patch set.
    • Adds CVS module support: imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning.

    +23 more show less

    • Adds GitHub Enterprise Cloud with data residency as a supported version control connection.
    • Adds Continuous Scanning: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
    • Adds Assistant skills: reusable methodology definitions authored from the Skills tab, with four built-in skills for triage, dependency reachability, report writing, and patch review — each forkable into an editable copy.
    • Adds a Plan first mode to the Assistant: proposes an editable plan before execution and offers to save the approved plan as a schedule, trigger, or playbook.
    • Adds team import from GitHub and Bitbucket (covering Bitbucket Cloud workspace groups and Bitbucket Server project groups) to sync repository permissions and access control.
    • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vector support, assessing subsequent-system impact on its own evidence.
    • Adds pull request submission status to approved patches: queued, in progress, waiting on retry, or stopped — with Cancel and Retry actions on the issue itself and up to five automatic submission attempts.
    • Adds a What's new panel in the top bar showing the three most recent releases, marking unread ones.
    • Adds severity labels following CVSS rating bands: Critical (9.0+), High (7.0+), Medium (4.0+), Low (0.1+), applied to existing findings without a rescan.
    • Adds an optional tag and repository scope parameter to monthly, organization summary, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. compliance, and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports, stated on the report cover.
    • Adds on-demand Jira ticket sync preview — shows what each linked ticket will do before you apply it.
    • Adds Jira and Linear ticket links to CSV exports and the export endpoint.
    • Adds a dependency findings tab to the Issues page with CVE, advisory, and package search.
    • Adds a scope control at the top of Supply Chain to narrow every tab to a selected set of repositories, teams, and tags.
    • Adds Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero to repository size calculations, ensuring those repositories receive the analysis depth their size warrants.
    • Adds Wiz export support: marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records.
    • Adds a per-repository permission for creating Jira and Linear tickets; organizations using access control must grant it explicitly.
    • Adds secrets scanning coverage reporting: states the coverage achieved and names any file too large to read within the scan's time budget.
    • Adds MCP tool call recording to the audit log by parameter name, ensuring credentials passed to a tool are never stored in audit rows or forwarded to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    • Adds pull request address to pull request scan webhooks.
    • Adds grouped Settings navigation with Workspace, Security, and Connections sidebar sections; scanner settings expose the same five categories (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope.
    • The dashboard now covers a full year at a glance with a quarterly period option.
    • Adds a Needs Review queue state for findings ZeroPath has not yet assessed, ranking on severity alone.
    • Adds a remote MCP server at https://zeropath.com/mcp supporting Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. clients (Claude, Cursor, Codex); connections are read-only until changes are approved, and administrators can revoke all org connections at once.
    • Adds Microsoft Teams channel notifications via incoming webhook — paste the webhook URL into ZeroPath to deliver scan notifications and vulnerability alerts as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., with no Azure AD app registration required.
    • Adds Gerrit project support: imports projects for full scans and scans each open change on new patch sets, posting findings as a review message on the patch set.
    • Adds CVS module support: imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning.
    • Adds GitHub Enterprise Cloud with data residency as a supported version control connection.

    +16 more show less

    • Adds Continuous Scanning: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
    • Adds Assistant skills: reusable methodology definitions authored from the Skills tab, with four built-in skills for triage, dependency reachability, report writing, and patch review — each forkable into an editable copy.
    • Adds a Plan first mode to the Assistant: proposes an editable plan before execution and offers to save the approved plan as a schedule, trigger, or playbook.
    • Adds team import from GitHub and Bitbucket (covering Bitbucket Cloud workspace groups and Bitbucket Server project groups) to sync repository permissions and access control.
    • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vector support, assessing subsequent-system impact on its own evidence.
    • Adds pull request submission status to approved patches: queued, in progress, waiting on retry, or stopped — with Cancel and Retry actions on the issue itself and up to five automatic submission attempts.
    • Adds a What's new panel in the top bar showing the three most recent releases, marking unread ones.
    • Adds severity labels following CVSS rating bands: Critical (9.0+), High (7.0+), Medium (4.0+), Low (0.1+), applied to existing findings without a rescan.
    • Adds on-demand Jira ticket sync preview — shows what each linked ticket will do before you apply it.
    • Adds a dependency findings tab to the Issues page with CVE, advisory, and package search.
    • Adds a scope control at the top of Supply Chain to narrow every tab to a selected set of repositories, teams, and tags.
    • Adds Wiz export support: marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records.
    • Adds a per-repository permission for creating Jira and Linear tickets; organizations using access control must grant it explicitly.
    • Adds MCP tool call recording to the audit log by parameter name, ensuring credentials passed to a tool are never stored in audit rows or forwarded to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    • Adds grouped Settings navigation with Workspace, Security, and Connections sidebar sections; scanner settings expose the same five categories (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope.
    • Adds a Needs Review queue state for findings ZeroPath has not yet assessed, ranking on severity alone.

    7 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On the repository object, lastScanError is replaced by lastScanFailure; any API client or integration reading lastScanError will receive no value.
    • !Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories — existing automations lacking these grants will be refused.
    • !Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it or ticket creation will be unavailable.
    • !On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned.
33. docs update Sep 8, 2026 · issue 068

    ZeroPath adds SLOSLOA Service Level Objective is a target threshold for a system's reliability or performance, such as 99.9% uptime or sub-200ms latency, giving cyber tools a measurable contract to enforce or report against./SLISLISite Level Indicator — a Google SRE concept for a quantitative measure of service reliability, such as request latency or error rate, used by tools to track whether a system meets its availability targets. tracking and audit trail under Settings → Service levels

    └──▷ HOW TO FIND IT
    Set an SLO target on a policy and monitor compliance trends over time.
    📍In the console, go to Settings → Service levels → Policies, select a policy, and set an SLO target. Then navigate to Settings → Service levels → SLO / SLI to view trend charts tracking compliance against that target.
    • Adds Settings → Service levels → Policies to configure SLO targets on individual policies.
    • Adds Settings → Service levels → SLO / SLI section with trend charts that turn SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. activity into a time-series view.
    • Adds Audit trail section under Settings → Service levels to record SLA-related activity.

    3 details in Everything

34. docs update Sep 8, 2026 · issue 068

    ZeroPath adds org-level toggle to redact AI-generated descriptions and exploit walkthroughs for secret findings across all surfaces.

    └──▷ HOW TO FIND IT
    Prevent prose that might quote a secret value from appearing in dashboards, API responses, webhooks, and exported tickets — useful when sharing findings with contractors or exporting to third-party systems.
    📍In the ZeroPath console, go to Repositories & data and click Hide Descriptions to enable the org-wide redaction toggle.
35. docs update Sep 8, 2026 · issue 068

    ZeroPath: Adds a unified Scanner workspace in the main sidebar that consolidates all scanning configuration — Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks) — into one place.

    └──▷ HOW TO FIND IT
    Grant a team organization-wide repository permissions so automation can save scan location sets across all repositories without per-repo configuration.
    📍In the permission editor, open the team's grant, select the repository permission that includes 'save scan location set', and enable the organization-wide grant — automation using that team's credentials will then be authorized to write scan location sets across all repositories.
    Let a developer with per-repository scanner access configure only their own repos without exposing organization-wide settings.
    📍In the main sidebar, click Scanner — members with per-repository scanner permission will see a searchable list scoped to only the repositories they hold permission on, with Add/Save/Delete showing inline reasons when unavailable.
    • Adds consistent five-category scanner settings layout (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope, so any setting is found in the same place regardless of which scope you are overriding.
    • Adds scoped scanner permissions: rules, repository context, and scan locations now reflect the viewer's permissions, surfacing only the actions they are authorized to perform, with inline reasons when Add, Save, or Delete are unavailable.
    • Enables members with scanner permission on individual repositories to access the Scanner workspace and select from a searchable list of only the repositories they are authorized to configure.
    • Adds authorization checks when editing or deleting a rule, repository context, or scan location set against both the scope the definition already holds and the scope being assigned, blocking moves outside a member's granted repositories.
    • Adds scoped scanner permissions: rules, repository context, and scan locations now reflect the viewer's permissions, surfacing only the actions they are authorized to perform, with inline reasons when Add, Save, or Delete are unavailable.
    • Enables members with scanner permission on individual repositories to access the Scanner workspace and select from a searchable list of only the repositories they are authorized to configure.
    • Adds authorization checks when editing or deleting a rule, repository context, or scan location set against both the scope the definition already holds and the scope being assigned, blocking moves outside a member's granted repositories.

    1 more in Everything

36. Scanner workspace, grouped settings navigation, and scoped scanner permissions seen Sep 8, 2026 · issue 068

    ZeroPath adds a unified Scanner workspace, purpose-grouped Settings navigation, and scope-aware scanner permissions.

    └──▷ HOW TO FIND IT
    Navigate to scanner detection rules for a specific repository using the new Scanner workspace sidebar.
    📍In the main sidebar, select Scanner › Detection › Rules, then pick the target repository or tag scope from the scope selector to view or edit rules scoped to that repository.
    Override pull request scan settings at the repository level without losing your place in the settings hierarchy.
    📍In Settings › Security › Scanner settings, select the target repository scope, open the Pull requests category, adjust the threshold, and switch to another category — the edit is preserved until you save.
    • Adds a dedicated Scanner workspace in the main sidebar that consolidates all scanning configuration under Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks).
    • Groups Settings sidebar pages by purpose: Workspace (general, members, teams, billing), Security (scanner settings, repository tags, service levels), and Connections (integrations, notifications, API keys).
    • Surfaces scanner settings across five consistent categories — General, Full scans, Pull requests, Dependencies, and Remediation — at organization, tag, and repository scope so overrides appear in the same location at every level.
    • Scope-aware scanner permissions now control Rules, repository context, and scan locations, surfacing only the actions a member or team is authorized to perform and explaining unavailable Add, Save, and Delete actions inline.
    • Teams permission editor lists every grantable permission, and an organization-wide repository permission grant carries its named actions across all repositories — including saving repository context or scan location sets.

    +2 more show less

    • Members with per-repository scanner permission access a searchable repository list under Scanner to select which repositories they can configure.
    • Definitions linked to a repository removed from the version control host remain deletable.
    • Adds a dedicated Scanner workspace in the main sidebar that consolidates all scanning configuration under Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks).

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Editing or deleting a rule, repository context, or scan location set is now authorized against the scope the definition already holds as well as the scope being assigned — members and automation moving a definition outside their granted repositories will be refused.
37. docs update Sep 3, 2026 · issue 063

    ZeroPath launches a hosted remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://zeropath.com/mcp, letting AI tools query security findings via OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. with no install or API keys.

    └──▷ TRY IT
    Register the ZeroPath remote MCP server in Claude Code to query security findings from the CLI without installing anything locally.
    copy

    $ claude mcp add --transport http zeropath https://zeropath.com/mcp

    Wire ZeroPath into Cursor (or any MCP client that reads a JSON config) so it can access your findings on first launch.
    json copy

    {
      "mcpServers": {
        "zeropath": {
          "url": "https://zeropath.com/mcp"
        }
      }
    }

    Verify the OAuth protected-resource metadata endpoint directly during a security review of the MCP integration.
    copy

    $ curl https://zeropath.com/.well-known/oauth-protected-resource/mcp

    • New hosted MCP server at https://zeropath.com/mcp supports any MCP client using the Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. transport (POST /mcp with a bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. returning application/json); no local install or API key management required.
    • Connect Claude Code via claude mcp add --transport http zeropath https://zeropath.com/mcp; a browser window opens for OAuth sign-in and approval on first use.
    • Connect Claude desktop/web via Settings → Connectors → Add custom connector using https://zeropath.com/mcp.
    • Connect Cursor and other MCP clients using a mcpServers config block with "url": "https://zeropath.com/mcp".
    • Implements OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 with PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. (S256 mandatory) across standard endpoints: /.well-known/oauth-protected-resource/mcp (RFC 9728), /.well-known/oauth-authorization-server (RFC 8414), /oauth/register (RFC 7591 dynamic client registration), /oauth/authorize, and /oauth/token with refresh-token rotation.

    +4 more show less

    • Supports MCP protocol versions 2025-06-18 and 2025-03-26.
    • Self-hosted or dedicated-instance users substitute their own domain (e.g. https://your-company.zeropath.com/mcp) with no other changes.
    • Admins can view all connections (who approved them, last used), and disable remote MCP org-wide under Settings → Integrations → MCP Config; revocation takes effect immediately including for active connections.
    • Every MCP tool call, approval, and revocation is recorded in the organization audit log.

    9 details in Everything

38. docs update Sep 3, 2026 · issue 063

    ZeroPath MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. now supports a hosted remote endpoint at https://zeropath.com/mcp via OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. alongside the existing local stdio server.

    └──▷ TRY IT
    Point a Cursor or Claude MCP client at the hosted ZeroPath endpoint to start using it with no local install.
    copy

    $ https://zeropath.com/mcp

    • Adds a hosted remote MCP endpoint at https://zeropath.com/mcp using OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 authentication over the Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. transport — no installation required for clients like Claude and Cursor.
    • Supports a local stdio transport mode running the open-source Python server with API-token credentials for scripted setups and self-managed credential environments.

    2 details in Everything

39. docs update Sep 3, 2026 · issue 063

    ZeroPath adds an AI AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Assistant with planning mode, patch submission state tracking, and auto-cancellation of stale PR scans.

    └──▷ HOW TO FIND IT
    Review and approve an AI-proposed plan before the assistant bulk-opens fix PRs for critical findings, so you can verify scope and risks before any irreversible action is taken.
    📍In the AppSec Assistant chat, type your request (e.g. 'Open fix PRs for all critical findings in this repo'). The assistant displays a plan with Steps, Risks, and scope. Review each field, then click Approve to proceed — or tick Plan first on the message before sending to always force a plan.
    Track the progress of an automated fix PR from submission through to merge, and manually retry if submission fails due to a resolvable issue such as missing push credentials.
    📍Open the finding panel after promoting a patch. Watch the status chip cycle through Queued → Submitting PR → PR opened. If it lands on Submission failed, read the displayed failure reason (e.g. Missing push credentials), reconnect the repository through your VCS integration, then click the Retry button.
    • Adds an AI-powered AppSec Assistant (enabled per-repository) with a chat interface for asking security questions and requesting automated actions on findings.
    • Adds Planning Mode for the AppSec Assistant: before executing complex or irreversible actions (such as opening pull requests or bulk-updating findings), the assistant proposes a reviewable plan listing Steps, Risks, and scope, and does not proceed until you approve.
    • Adds a Plan first toggle on any assistant message to force a plan regardless of task complexity.
    • Adds Scheduling and Trigger Suggestions inside assistant plans — when a request has a recurring cadence or is reactive, the plan surfaces a cron schedule expression, event trigger, or playbook activation as advisory options.
    • Adds Skills configuration (via the Skills tab) for organization-specific guidance that shapes assistant behavior; active skills are listed in the plan's skills used field.

    +5 more show less

    • Adds Patch Submission States for fix PRs — findings now display progress through Queued, Submitting PR, Retrying, Submission failed, Cancelled, and PR opened states, with specific failure reasons and a Retry button for unrecoverable failures.
    • Adds Continuous Scanning mode: when enabled, ZeroPath runs a full scan on every meaningful commit to the default branch and incrementally re-examines only changed code on follow-up scans.
    • Automatically cancels in-progress PR scans for older commits when a newer commit is pushed to the same PR, across GitHub, GitHub Enterprise Server, GitLab, Bitbucket, Azure DevOps Services, and Gerrit.
    • Adds filter chips to the feedback list to narrow by disposition type; the Needs review disposition replaces the previous Pending review label.
    • The Non-exploitable disposition now immediately removes a finding from the open issues queue (same as False Positive or Accepted Risk), whether set by a human or an automated agent.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Pending review disposition label is renamed to Needs review in the feedback list filter chips.
40. docs update Sep 3, 2026 · issue 063

    ZeroPath adds Bitbucket Access Sync, cross-VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. permission mapping editor, and Jira/Linear ticket creation from findings

    └──▷ HOW TO FIND IT
    Enable hourly Bitbucket group sync to automatically keep ZeroPath team membership in step with Bitbucket Cloud or Server groups.
    📍In ZeroPath, go to Team Settings › Bitbucket Access Sync and toggle on Enable auto-sync. A first sync is queued immediately; subsequent syncs run hourly.
    Customize how Bitbucket roles map to ZeroPath permissions — for example, restricting Write-role users from triggering scans.
    📍In ZeroPath, go to Team Settings › Bitbucket Access Sync, click the permission mapping editor button, then adjust the permission matrix (VCS roles as columns, ZeroPath permission groups as rows) and save. A warning is shown if a higher role ends up with fewer permissions than a lower one.
    • New Bitbucket Access Sync section in team settings lets you import Bitbucket Cloud user groups and Bitbucket Server groups as ZeroPath teams, with optional hourly auto-sync to keep group membership in step automatically.
    • Adds Re-sync now / Sync now button to trigger a one-off Bitbucket group import without enabling continuous sync — useful for first-time imports or manual refreshes.
    • Warns when a custom permission mapping grants fewer permissions to a higher VCS role than a lower one, surfacing the inconsistency for correction.
    • Unmatched Bitbucket group members are surfaced in the same manual-linking panel already used for GitHub contributor matching, with a platform badge indicating which VCS host the unmatched account came from.
    • Adds Create Jira tickets from findings and Create Linear tickets from findings as a distinct Issue Tracker Export group in the team permissions editor, separate from Issue Management.

    5 details in Everything

41. docs update Sep 3, 2026 · issue 063

    ZeroPath adds SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Compliance, and scoped org-level reports plus new dashboard widgets for PR authors and exposure windows

    └──▷ HOW TO FIND IT
    Generate a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 audit report scoped to a specific team tag so only the relevant repositories appear in the cover-page Scope field.
    📍In the Reports tab, open the SOC 2 report card, select the desired tag(s) or repository names under the scope picker, then click Generate. The produced PDF cover page will read the specific tags and repository names you chose rather than All repositories.
    Review which PR authors introduced the most open issues shipped to production, filtering out unmerged PR noise.
    📍In the Reports tab, open the Issues By PR Author chart. The chart automatically shows open issues from each repository's latest merged pull request scan only — unmerged PRs and full-scan findings are excluded — grouped by author.
    • Adds four organization-level report cards — Monthly Security Report (DOCX), Organization Summary Report (PDF), SLA Compliance Report (PDF), and SOC 2 (PDF) — visible only to users with organization-level permission.
    • New SOC 2 PDF report delivers compliance-focused metrics and repository scan activity structured for SOC 2 audit evidence, with a Scope field on the cover page.
    • New SLA Compliance Report PDF tracks policy-based SLA compliance, showing which findings are within or past configured remediation windows, scoped to selected tags or repositories.
    • All organization-level reports include a Scope field on the cover page or header, listing either All repositories (N) or the specific tags and repository names chosen at generation time, making reports self-describing for audit purposes.
    • Report scope can be narrowed by selecting specific tags or repositories at generation time; by default the report covers the entire organization.

    +6 more show less

    • New Issues By PR Author chart groups open issues from each repository's latest merged pull request scan by PR author, excluding unmerged PR scans and full-scan-only findings.
    • New Exposure Window chart shows, for each period, the average days that open issues of each severity had been exposed; severity lines break rather than dropping to zero when no issues of that severity are open.
    • Date range picker adds a Last 1 year preset window and a Quarterly granularity option alongside existing daily, weekly, and monthly period pickers.
    • The Top Issues widget and scored-findings tables sort unscored findings to the bottom so that scored, actionable findings are always surfaced first; scored tables support up to 500 findings with columns for severity, score, title, repository, vulnerability class, status, and detection date.
    • Findings tables support clicking any row to open a side pane with full issue details; actions such as marking false positive or changing status refresh the report in the background without losing filters, scroll position, or selected report.
    • The Monthly Security Report DOCX includes an AI-generated executive summary for stakeholder communication alongside per-repository scan activity, severity breakdown, and top vulnerability families.

    11 details in Everything

42. docs update Sep 3, 2026 · issue 063

    ZeroPath PR scanning adds Gerrit support and split scan-result links for code vs. dependency findings

    • Adds Gerrit change scanning via poll-based triggering (no webhook required), posting findings as inline review comments on diff lines.
    • The check run Details link now points directly to the dependency view when a scan finds only SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings, avoiding a dashboard view that appears empty.

    2 details in Everything

43. docs update Sep 3, 2026 · issue 063

    ZeroPath adds a Dependencies tab, Jira/Linear export controls, live PR-submission status, and transitive SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. verdicts for Java, Scala, Python, .NET, and Rust.

    └──▷ HOW TO FIND IT
    Triage SCA supply-chain findings by CVE ID directly from the unified issue queue without touching the scan-type dropdown.
    📍In the dashboard, go to Issues › Dependencies tab, then use the search bar to filter by a CVE ID (e.g. CVE-2024-12345) or GHSA identifier to see all matching dependency findings and their investigation verdicts.
    Recover a stalled patch submission without re-approving — useful when a repo credential was rotated after the patch was already approved.
    📍In the dashboard, open the finding › patch panel, note the status PR creation failed, reconnect the repository credential under Settings, then click Retry to resubmit the queued patch.
    • Transitive dependency findings that complete investigation can now receive confirmed or disconfirmed verdicts — previously all transitive findings were withheld as Unknown; transitive resolution covers Java (Maven, Gradle), Scala (sbt), Python (pip), .NET, and Rust (Cargo).
    • Export to Jira and Export to Linear buttons — available in the issues list, the bulk action toolbar, and individual issue detail views — are now role-gated, visible only to members with permission to create tickets in the respective integration.
    • Findings where validation could not run (budget exceeded, recursion limit, or timeout) surface as Needs Review in the default issue queue; findings an agent examined but could not reach a verdict on are categorized separately and withheld from the default queue to reduce low-signal noise.
    • Automatic serial retry kicks in when a parallel analysis run fails due to known engine instability, preventing scans from completing with zero findings.

    4 details in Everything

44. docs update Sep 3, 2026 · issue 063

    ZeroPath: New remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://zeropath.com/mcp lets Claude, Cursor, Codex, or any Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. client work with findings — no install, no API key; connections are read-only until changes are approved, and administrators can disable all connections organization-wide from a single control.

    └──▷ HOW TO FIND IT
    Connect an AI coding assistant to your ZeroPath findings without installing anything or managing API keys.
    📍Point your MCP client (e.g. Claude, Cursor, Codex) at: https://zeropath.com/mcp — sign in through your browser when prompted. The connection is read-only until you explicitly approve changes.
    • Adds Microsoft Teams integration: scan notifications and vulnerability alerts delivered as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer. to Teams channels via an incoming webhook pasted into ZeroPath — no Azure AD app registration or tenant administrator required; channels that stop accepting deliveries are paused and reported.
    • New Continuous Scanning mode runs a full scan on every meaningful commit to a repository's default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
    • New Assistant Skills let administrators author reusable methodology — triage rules, patch review checklists, report structures, codebase conventions — from the Skills tab; four built-in skills (triage, dependency reachability, report writing, patch review) ship forkable into editable copies.
    • The Assistant's Plan first mode proposes an editable plan before running anything and can save the approved plan as a schedule, a trigger, or a playbook.
    • Teams now import from GitHub and Bitbucket (including Bitbucket Cloud workspace groups and Bitbucket Server project groups), mapping GitHub's five roles and Bitbucket's three onto 39 permissions across 10 groups; with access control enabled, members see only repositories they hold a grant on.

    +17 more show less

    • Jira and Linear ticket creation is now a per-repository permission, configurable under access control.
    • Severity labels follow CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. rating bands: Critical ≥ 9.0, High ≥ 7.0, Medium ≥ 4.0, Low ≥ 0.1; existing findings adopt labels without a rescan.
    • New Wiz export: marks dependency findings already resolved as resolved in Wiz and sends unassessed findings as new records.
    • Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories.
    • Dependency findings have a dedicated tab on the Issues page with CVE, advisory, and package search.
    • Monthly, organization summary, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. compliance, and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports now accept an optional tag and repository scope.
    • CSV exports and the export endpoint now include the Jira and Linear tickets a finding is linked to.
    • CVSS v4.0 vectors now assess subsequent-system impact on its own evidence.
    • Final validation now covers up to 1,000 findings per scan (up from 50).
    • Hardcoded-credential findings are redacted on every surface and classified by CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances..
    • Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero now count toward repository size for analysis depth.
    • Supply Chain now has a single scope control at the top to filter every tab by repositories, teams, and tags.
    • MCP tool calls are recorded in the audit log by parameter name, with credentials withheld from audit rows and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. forwarding.
    • The lastScanError field on a repository is replaced by lastScanFailure, which carries both the message and the outcome.
    • SLA deadlines now start when a scan of landed code (including merged pull requests) detects a finding; unmerged pull requests carry no deadline.
    • Eleven measurements on the security posture endpoint return no value where there is nothing to measure (treat as optional fields).
    • On secret findings, the explanation ZeroPath generates for a dismissal is withheld from the API; a reviewer's own note is returned in full.

    22 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !On repository objects, lastScanError is replaced by lastScanFailure, which carries the message and the outcome — callers reading lastScanError will no longer receive a value.
    • !On secret findings, the auto-generated dismissal explanation is no longer returned by the API; only a reviewer's own note is returned.
    • !Eleven measurements on the security posture endpoint now return no value where there is nothing to measure — callers must treat these fields as optional.
    • !Creating Jira or Linear tickets now requires a per-repository permission grant; organizations using access control must grant it explicitly.
    • !Connecting an integration now requires Create Integrations or Create Installations; adding a repository by URL requires Create Repositories — existing workflows without these grants will fail.
45. docs update Sep 3, 2026 · issue 063

    ZeroPath adds a Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for browser-based AI tool integration and a new API endpoint for fetching repository branches.

    • Adds a Remote MCP Server (https://zeropath.com/docs/mcp/remote.md) that connects AI tools to ZeroPath in one step via browser sign-in — no local install required.
    • New Get repository branches API endpoint fetches available branches for a linked repository, supporting GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit, CVS, and Generic Git (CVS exposes its single materialized branch).

    2 details in Everything

46. Remote MCP server, Microsoft Teams, Gerrit and CVS, Continuous Scanning, and access sync seen Sep 3, 2026 · issue 063

    ZeroPath adds a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, Microsoft Teams alerts, Gerrit/CVS support, continuous scanning, and access sync in this release.

    └──▷ TRY IT
    Connect an AI coding assistant to your ZeroPath findings without installing anything or managing API keys.
    copy

    $ # In Cursor, Claude, or any Streamable HTTP MCP client, set the MCP server URL to:
    https://zeropath.com/mcp
    # Then authenticate via the browser prompt that appears — no API key needed.

    Enable continuous scanning on a GitHub organization so findings automatically track the default branch between scheduled scans.
    📍1. In ZeroPath, go to Scanner Settings. 2. Select the organization, tag, or repository you want to configure. 3. Enable Continuous Scanning — subsequent merged pull requests and commits to the default branch will each trigger a full scan automatically.
    • Adds a hosted remote MCP server at https://zeropath.com/mcp — point Claude, Cursor, Codex, or any Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. client at it, authenticate via browser (no install, no API key), and interact with findings; connections are read-only until changes are approved.
    • Adds Microsoft Teams integration: paste an incoming webhook URL into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer. in Teams channels — no Azure AD app registration or tenant administrator required.
    • Adds Gerrit repository support: import projects for full scans and scan each open change as new patch sets arrive, posting findings as a review message on the patch set.
    • Adds CVS repository support: import modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning.
    • Adds GitHub Enterprise Cloud with data residency support, connecting on its own host.

    +17 more show less

    • Adds Continuous Scanning: triggers a full scan every time a meaningful commit lands on a repository's default branch (including merged pull requests), with follow-up scans closing findings resolved by those commits; configurable per organization, tag, or repository in scanner settings; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server.
    • Adds Assistant Skills (Early Access): author reusable methodology instructions from the Skills tab that the AI AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Assistant applies during triage, patch review, and report writing; four built-in skills ship for triage, dependency reachability, report writing, and patch review, each forkable into an editable copy.
    • Improves AI AppSec Assistant (Early Access) with a Plan first mode: the Assistant proposes a plan you can edit, add steps to, and approve before execution, with an option to save the approved plan as a schedule, trigger, or playbook.
    • Adds access sync and repository permissions: import teams from GitHub and Bitbucket (including Bitbucket Cloud workspace groups and Bitbucket Server project groups), map GitHub's five roles and Bitbucket's three onto thirty-nine permissions across ten groups, and restrict member visibility to only repositories they hold a grant on.
    • Adds pull request submission status tracking for approved patches: shows state as queued, in progress, waiting on retry, or stopped with reason; Cancel and Retry actions appear on the issue itself, with up to five automatic submission attempts.
    • Adds Jira and Linear ticket links to CSV exports and the export endpoint.
    • Adds an on-demand Jira ticket sync preview showing what each linked ticket will do before applying it.
    • Adds a What's new panel in the top bar showing the three most recent releases with unread indicators.
    • Adds optional tag and repository scope filters to monthly, organization summary, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. compliance, and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports, reflected on the report cover.
    • Adds a Supply Chain scope control that narrows all tabs to a selected set of repositories, teams, and tags.
    • Adds a dependency findings tab in the Issues page with CVE, advisory, and package search; completed pull request scans link to their findings list with a separate dependency link.
    • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vector support for assessing subsequent-system impact, with severity labels following CVSS rating bands: Critical ≥ 9.0, High ≥ 7.0, Medium ≥ 4.0, Low ≥ 0.1.
    • Extends final validation to cover up to 1,000 findings per scan (twenty times more than before).
    • Adds repository-size counting for Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero, ensuring those repositories receive analysis depth matched to their size.
    • Adds duplicate detection when adding repositories, surfacing likely duplicates from host migrations with a git history probe for each match.
    • Extends the dashboard to cover a full year at a glance with a quarterly period option.
    • Secrets scanning now reports coverage achieved and names any file too large to read within the scan's time budget.

    22 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it or ticket creation will be blocked.
    • !Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires the Create Repositories permission.
47. docs update Sep 1, 2026 · issue 061

    ZeroPath adds GET /api/v1/orgs/list endpoint to enumerate organizations via API.

    └──▷ TRY IT
    List all organizations your API token has access to, to enumerate available org IDs for downstream API calls.
    copy

    $ curl --request POST \
      --url https://zeropath.com/api/v1/orgs/list \
      --header 'Content-Type: application/json' \
      --header 'X-ZeroPath-API-Token-Id: <api-key>' \
      --header 'X-ZeroPath-API-Token-Secret: <api-key>'

48. 2026-09 Sep 2026 · release notes

    ZeroPath 2026-09 adds on-prem Kubernetes support, Gerrit/CVS repos, saved filters/API keys, and Inventory tab.

    • Adds on-premises deployment support for ZeroPath in Kubernetes clusters
    • Adds Gerrit and CVS repository connections via Add Repository on-prem
    • Adds Dashboard profiles feature allowing saved layouts with 13 widgets
    • Adds Saved issue filters to preserve triage criteria using CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0 and other metrics
    • Adds Inventory tab for exploring packages, licenses, and AI components by branch

    +3 more show less

    • Adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. export capabilities from the Inventory tab
    • Adds Scanner workspace for managing scan locations, rules, sources, and sinks
    • Adds personal API keys creation with scoped permissions for user or organization use

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. exports for scans marked with inventoryRetiredAt now return 412 PRECONDITION_FAILED.
    • !When scaPackage.dependencyPathsRetiredAt is set, dependencyPaths is omitted and transitiveDependencies may be empty in API responses.
    • !Deprecated trends[].meanRemediationTime replaced with trends[].meanRemediationTimeInPeriod; trends[].resolvedIssues provides the sample size.
    • !On-premises deployments must omit allowDeepSeekModels from scanner-setting updates; model selection belongs to deployment configuration.
49. announced Aug 20, 2026 · issue 064

    ZeroPath adds reachability-aware SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., and AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. exports in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema., SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format., and standalone VEX formats

    └──▷ HOW TO FIND IT
    Generate a reachability-aware SBOM or standalone VEX document after running an SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scan on a repository.
    📍In ZeroPath, open the repository, select Generate SBOM, then choose CycloneDX, SPDX, standalone VEX, or AI-BOM.
    • Adds SBOM export supporting CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3, standalone CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. documents, and AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. formats, all generated from the same stored scan inventory.
    • VEX statements are driven by reachability analysis and emit one of three machine-readable states: not_affected (with justification code_not_reachable), exploitable, or in_triage — rather than manually authored verdicts.
    • Introduces AI-BOM export: a CycloneDX ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. covering seventeen AI component kinds including LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. SDKs, agent frameworks, vector databasesvector databasesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems., model weightsmodel weightsThe numerical values a model learns during training. Loading them into the model's architecture restores its learned behavior for inference or further training., prompt templates, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers — aligned to EU AI Act and NIST AI Risk Management Framework inventory expectations.
    • License obligations are classified into five buckets — permissive, weak copyleft, strong copyleft, network copyleft (AGPL/Affero), and unknown — with network copyleft split from strong copyleft explicitly to surface AGPL's hosted-service trigger.
    • Packages with unknown licenses are marked license-unknown rather than silently listed as unlicensed; fields with no data are omitted rather than filled with placeholder values.

    5 details in Everything

50. announced Aug 13, 2026 · issue 064

    ZeroPath adds continuous CVE alerting that matches live OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. feed advisories against your existing SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. inventory within minutes.

    └──▷ HOW TO FIND IT
    Enable continuous CVE alerting for a specific repository so your team is notified within minutes of a new advisory matching a shipped dependency — rather than waiting for the next scheduled scan.
    📍In the ZeroPath console, navigate to your repository settings, find the Continuous CVE Alerting section, and toggle it on. Optionally apply the setting at the tag or organization level to cover multiple repos at once.
    Route continuous CVE alerts to a Slack channel or webhook endpoint so triage findings land directly in your team's workflow without polling the ZeroPath UI.
    📍In the ZeroPath console, go to Alert Destinations and add a Slack integration or webhook URL. New CVE alerts — already triaged with reachability and exploitability verdicts — will be posted there within minutes of an advisory hitting the OSV feed.
    • When a fresh CVE lands on a direct dependency, automatically re-runs reachability and exploitability analysis — cloning the repo, checking whether the vulnerable function is actually called, and producing a triaged alert with reachability verdict, exploitability rating, confidence, severity, and a pointer to the relevant line.
    • Suppresses noise by hashing only the version-relevant portion of each OSV advisory, so cosmetic republications (new reference links, re-scored CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., reviewer timestamps) do not generate duplicate alerts.
    • Folds multiple hits from one CVE across many locations into a single notification, then enriches alerts with CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. data and FIRST EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores to surface reachable-and-actively-exploited findings first.
    • Deep transitive dependency matches are recorded as uninvestigated rather than assigned a confidence score, keeping reachability claims honest.
    • When a finding is exploitable and a safe upgrade exists, delivers the alert with a pull request already attached.

    +2 more show less

    • Continuous CVE alerting is opt-in per repository and can also be configured at the tag or organization level.
    • Alerts can be routed to Slack, a webhook, or an agent playbook for automation.

    7 details in Everything

51. 2026-08 Aug 2026 · release notes

    ZeroPath 2026-08 adds remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support, CVS/Gerrit integrations, continuous scanning, and access sync.

    • Adds remote MCP server integration allowing AI clients to connect via https://zeropath.com/mcp
    • Adds support for Gerrit projects with automatic scan on new patch sets
    • Adds support for CVS modules over SSH or pserver for full scans and secrets scanning
    • Adds continuous scanning capability for GitHub, GitLab, Bitbucket Cloud and Bitbucket Server via scanner settings
    • Adds repository permissions mapping for GitHub and Bitbucket access sync in Teams configuration

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !On a repository, lastScanError is replaced by lastScanFailure, which carries the message and the outcome.
52. 2026-07 Jul 2026 · release notes

    ZeroPath 2026-07 adds Security Compass mapping, private registry connections, runtime validation without deployment, and Code Governance tracking.

    • Adds Security Compass integration to map projects in SD Elements and write back countermeasure status and verification notes after every scan.
    • Adds Private registry connections for container images (Docker Hub, GitHub Container Registry, Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., Google Artifact Registry, Azure Container Registry, JFrog Artifactory, Harbor, Quay, GitLab) and packages (npm, Maven on Artifactory, Nexus), verifying credentials before storage and using short-lived tokens for AWS/Google.
    • Adds Runtime Validation from source in Early Access, allowing ZeroPath to build and run the application locally with Postgres, Redis, or SQLite instances instead of requiring a deployed target.
    • Adds Wiz runtime context where findings carry Wiz workload state (running, sensitive data access, internet reachability) as input for severity scoring, with incomplete workload handling.
    • Adds Code Governance page in Early Access to report AI authorship share across eight coding agents (Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Devin, Aider, Jules, Gemini CLI) and open findings in AI-authored code.

    +10 more show less

    • Adds Exploit Chains presentation for Runtime Validation with attacker steps in order and copyable proof of concept scripts.
    • Adds Scan on First Commit functionality to run an initial scan on a newly connected repository upon its first substantive commit, available on GitHub, GitLab, Bitbucket Cloud and Bitbucket Server.
    • Adds SBOM export formats: CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., standalone VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., and ML-BOMML-BOMA machine-learning Bill of Materials: a structured manifest listing a model's datasets, weights, training code, and dependencies so cyber tools can audit provenance and detect supply-chain tampering. for AI components, with AI component details inline in primary CycloneDX exports and per-repository access via the AI Inventory tab.
    • Adds Jira Data Center and Server 8.14+ integration support, authenticated with personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., including support for private CAs and context paths.
    • Adds Archiving a GitHub repository functionality that moves code, dependency, and container findings to accepted risk and closes linked Jira/Linear tickets, with restoration on unarchiving.
    • Adds Deleting a repository functionality that closes synced Jira/Linear tickets and stops scheduled scanning of linked container images.
    • Adds dedicated regional deployments capability, including an EU region, keeping scan data in the selected region.
    • Adds Assistant tasks stop functionality from chat and configurable conversation retention.
    • Adds Documentation in Portuguese alongside English for guides, CLI, and webhook references.
    • Adds Cross-Repository Discovery for .NET and Python services, resolving multi-module/package repositories and reporting cross-service boundary vulnerabilities.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !POST /api/v1/sca/vulnerabilities/search returns hasMore instead of a total; paginate using hasMore and retrieve counts from POST /api/v1/sca/vulnerabilities/count.
    • !deletedCount is renamed to resetCount on POST /api/v1/repositories/reset-scanner-settings.
    • !defaultBranch and gitlabInstallationId are now nullable; clients assuming a string value will fail.
    • !On secret findings, redactedSecret is masked for all callers, and the generated description, attack steps, and preconditions are withheld.
53. 2026-06 Jun 2026 · release notes

    ZeroPath 2026-06 adds container scanning, AI inventory, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. policies, ObjectScript SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and new API endpoints.

    • Adds Container Scanning via the new Containers section, CLI, API, or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with layer-attributed findings and Dockerfile patch PRs
    • Adds AI Inventory exportable as an AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. for governance and compliance
    • Adds Application Threat Modeling to edit trust boundaries and auth models affecting subsequent scan triage
    • Adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. badges, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores, and license classification in the redesigned Supply Chain view
    • Adds per-ecosystem coverage reporting with warnings for failed manifests or missing transitive dependencies

    +8 more show less

    • Adds SLA policies with Slack/webhook escalation, compliance burn-rate dashboards, and due date sync to Jira/Linear
    • Adds integration with GitHub Enterprise Server (guided App setup) and Azure DevOps Services (Entra OAuth/PAT)
    • Adds coding-agent integrations for Claude Code, OpenAI Codex, and Cursor via a single installer with blocking or monitoring hooks
    • Adds ObjectScript language support in Code Analysis recognizing .cls and .mac files
    • Adds Custom natural-language rules that apply on pull request scans and incremental rescans
    • Adds opt-in Cross-Repository Discovery to build relationship graphs across repositories
    • Adds scanner settings including High Performance Mode, draft PR handling, and removal of bypass button from failing checks
    • Adds new API endpoints for container scanning, supply chain posture, licensing, and issue management (notes, severity, patch regeneration)

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Runtime validation responses no longer include the deprecated agentGroupKey field
54. 2026-05 May 2026 · release notes

    ZeroPath 2026-05 adds Runtime Validation, On-Demand Code Scans, Azure DevOps PR scanning, and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. reachability filtering.

    • Adds Runtime Validation (early access) to dynamically confirm SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings against the running application with Confirmed/Disconfirmed verdicts.
    • Introduces On-Demand Code Scans (beta) for submitting diffs or snippets for asynchronous review without full repo scans.
    • Adds Azure DevOps as a supported platform for PR scanning.
    • Adds severity-level checkboxes and PR grouping for scan filtering in the UI.
    • Enables SCA vulnerability filtering by Wiz Exposure to focus on internet-facing dependencies.

    +5 more show less

    • Adds SCA_NEW_ISSUE event trigger for AI AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Assistant integration.
    • Introduces Real-time notifications for SCA issues via Slack and webhooks.
    • Exposes V2 API endpoints for querying Wiz CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. settings, projects, assets, and exposures.
    • Adds support for boolean, number, and select dropdown parameter types in Playbook templates.
    • Enables Linear auto-ticketing with automatic assignee resolution modes.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The functionSummary field has been removed from vulnerability API response schemas.
55. 2026-04 Apr 2026 · release notes

    ZeroPath 2026-04 adds Agent Playbooks, new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself./Secrets detections, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server metadata, and expanded AI Assistant API.

    • Agent Playbooks with new event trigger types (e.g., PR Merged with Issues) enable automated, parameterized security workflows without manual configuration.
    • SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. now generates CVSS 3.1 scores alongside CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0 and displays Security impact labels in issue headers.
    • SCA alerts can be routed to per-org webhook endpoints for direct integration with Microsoft Teams and Slack.
    • AI Assistant API provides full management of conversations, jobs, schedules, triggers, and memory via new REST endpoints and SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. streaming.
    • Issue export dialog adds format selection including CASA CSV and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., with live preview count and filter overrides.

    +1 more show less

    • Secrets detection engines now support AI-powered validation states: Confirmed, Disconfirmed, and Unknown.

    6 details in Everything

56. 2026-03 Mar 2026 · release notes

    ZeroPath 2026-03 adds AI AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Assistant dashboard, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. compiled scanning, fix verification via PR comments, V2 APIs, and custom reports.

    └──▷ HOW TO FIND IT
    Trigger a deeper AI re-investigation of findings on a Pull Request using the new bot command syntax.
    📍@bot retriage
    • Adds new AI AppSec Assistant dashboard with Overview, Activity, Chat, Schedules, Triggers, Memory, and Settings tabs.
    • Adds custom MCP server installation for the AI AppSec Assistant.
    • Enables Slack thread control (cancel, replace, amend) within the AI AppSec Assistant.
    • Adds on-demand investigation for findings in issue detail view, bulk, via API, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.
    • Adds mandatory data flow path and step-by-step exploitation steps to confirmed findings.

    +42 more show less

    • Surfaces exploitability preconditions with expandable evidence in the issue detail view.
    • Adds new Informational status for findings where exploitability cannot be determined.
    • Enables deep codebase analysis following extended call chains and complex cross-file data flows.
    • Smart rescans match issues to changed line ranges per file.
    • Enables fix verification by referencing ZeroPath issues in PR descriptions using ZP-ID: syntax or dashboard URLs.
    • Adds @bot retriage command on PRs to trigger fix verification instead of standard investigation.
    • Adds AL (Business Central) to supported SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. languages.
    • Links SCA findings to the manifest file and line number where the dependency is declared.
    • Detects packages embedded in JARs, WARs, Python wheels, and other binary artifacts via compiled asset scanning.
    • Walks up to 5 hops for multi-hop transitive dependency resolution.
    • Provides remediation instructions for unpatchable findings when no safe version exists.
    • Adds SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development. (Scala) transitive dependency support with lockfile parsing and automatic sandbox fallback.
    • Adds Haskell (Hackage) and R (CRAN) ecosystems to SCA support.
    • Adds new filters for ecosystem, package reachability, source type, and info severity level in SCA.
    • Adds Gradle version catalog support with line-level tracking; parses PEP 621 pyproject.toml and Poetry 1.2+ group dependencies.
    • Includes exploitability preconditions in SCA findings.
    • Enables SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation directly without first running an SCA scan.
    • Adds multi-engine secrets detection with automatic cross-engine deduplication.
    • Adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow security scanning for CI/CD pipeline misconfigurations.
    • Adds Custom Reports dashboard with interactive charts, 14 filterable fields, six preset templates, and save/share capabilities.
    • Adds new Assets tab in Reports alongside Views, Generate, and History tabs.
    • Adds Custom Report permissions (View, Create, Delete) to team settings.
    • Allows separate PR summary comment controls for scans that find issues and clean scans, both enabled by default.
    • Limits inline display in PR summary comments to the top 10 findings with a link to the full dashboard.
    • Adds detailed vulnerability info toggle to PR scan settings.
    • Adds @bot rescan command for triggering PR rescans and @bot retriage for deeper AI investigation.
    • Accepts @ZeroPath as a universal bot alias in PR comments, in addition to the configured bot username and @zeropath-ai.
    • Redesigns Integrations settings page with a master-detail sidebar layout.
    • Adds History cutoff setting to ignore scan history before a configured date during dependency analysis and deduplication.
    • Adds custom rules only mode at the repository level.
    • Supports bulk export of multiple findings in Jira and Linear integrations.
    • Adds Linear custom templates with title, description, labels, and priority fields for auto-ticketing.
    • Allows Linear integration to be connected at the organization level.
    • Supports GitLab pipeline webhooks for pipelines outside of merge requests.
    • Adds scans.rescanPR tool to the MCP server for triggering PR rescans.
    • Adds new V2 API endpoints for semantic searchsemantic searchSearching by meaning rather than requiring the same words. It commonly compares vector representations to find related content, even when the wording differs. across vulnerabilities and detected endpoints.
    • Adds new V2 Agent API with endpoints for patch management, PR creation, repository access, event triggers, and global agent instructions.
    • Adds custom report statistics endpoint returning aggregated metrics.
    • Adds Code Inspection API endpoints for searching, reading, and listing files in connected repositories.
    • Adds POST /api/v2/issues/requestInvestigation with issueIds and optional context for on-demand investigations.
    • Adds POST /scans/rescanPR endpoint to trigger a rescan of a previously scanned PR.
    • Adds new INFORMATIONAL issue status and CICD detection type across v1 and v2 APIs.

    47 details in Everything