https://cybertoolchain.io/tools/zeropath New releases and features in ZeroPath, tracked by The Cyber Toolchain. en Sun, 25 Oct 2026 07:51:49 GMT https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Sun, 25 Oct 2026 07:51:49 GMT ZeroPath adds configurable SD Elements task-status mapping and new Security Compass API/MCP methods for verification push workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `securityCompass.listTaskStatuses`, `updateProjectMapping`, and `pushLatestScan` API and MCP methods for Security Compass integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds per-integration and per-project `Task status mapping` configuration to control which SD Elements task status each ZeroPath verification outcome (Pass, Partial, Fail) sets. • Adds `Push latest scan` action to re-push a repository's latest finished full scan to SD Elements on demand. • Adds `lastPushStats` object with fields `countermeasuresMarkedDone`, `statusChangesRequested`, `passCount`, `partialCount`, `failCount`, and `notApplicableSkipped` to track Security Compass push results. • Writes one verification note per countermeasure (Pass, Partial, or Fail) with finding list and links back to ZeroPath on every full scan push to SD Elements. • Restricts `securityCompass.listTaskStatuses` to users with the admin role, matching the mapping mutation permissions. Breaking changes: • Integrations created before this change were given a default task status mapping of Pass→Complete, Partial→Incomplete, Fail→Incomplete; new integrations start with verification notes only and no task status changes by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Sat, 17 Oct 2026 07:52:36 GMT ZeroPath: Issue search now accepts `presentation: true` and `knownVulnerableVersion` fields, and can filter by lane and sort by priority. • Adds `scans.list` returning issue counts that include dependency findings. • `listTags` now returns tag ids and names; tag create/update requests take explicit include, exclude, and release changes. Breaking changes: • Re-investigation from the app, API, MCP, or Assistant now requires `Close Issues` permission on the finding's repository; members who previously could re-investigate without it will receive a 403 until the permission is granted. • Creating, editing, and deleting repository tags now requires `Manage Teams` or `Edit SAST Configuration`; members who previously had tag management access without these permissions will lose it. • API key create, list, and delete operations now return 403 for requests authenticated with an API key or `Authorization` header; callers that managed keys programmatically must switch to a signed-in browser session. • Tag create/update requests that include the (unspecified) previously accepted field are now refused; callers must use the explicit include, exclude, and release change fields instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-10 https://zeropath.com/docs/changelog#2026-10 Fri, 16 Oct 2026 07:47:29 GMT ZeroPath adds exploit-evidence priority lanes, a lifecycle board with expiring accepted risk, an Audit log, and expanded Issue search API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Priority lanes` on the Issues page, grouping open findings into `Fix now`, `Needs decision`, and `Lower priority` lanes (with `Fix now` requiring High/Critical CVSS severity plus at least one exploit-evidence chip: Runtime Validation verdict, known exploited advisory, reachable dependency, Wiz internet exposure, or verified live secret), and an `Issues scan source` menu offering `All`, `Full Scans`, and `Latest PR Scans` for code scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Board view` (lifecycle board) where findings move through `Needs review`, `Backlog`, `Reviewing`, and `Patching` stages by drag-and-drop, with a required close-reason dialog, an Undo window of 6 seconds, and `Accepted risk` expiry that automatically reopens a finding once its accepted-until date passes unless it was closed by other evidence. • Adds the `Audit log` page under `Reporting` for organization admins, filterable by actor, source, and level up to 90 days, with per-event endpoint and argument detail and `Export CSV` up to 100,000 events. • Adds a `History` tab on every finding showing status changes and detections in one timeline (naming the job, e.g. `ZeroPath risk acceptance expiry`, or ticket, e.g. `Jira · SEC-12`, behind each change) and a `Dependencies` tab on the issue panel grouping advisories by package with an exploit probability chart and quick filters including `Known exploited` and `EPSS over 10%`. • Adds a `Repository risk overview` on the Repositories page, listing repositories riskiest first with columns for open findings, `Fix now` findings, exploit evidence, and `Protection` status (scheduled scans, PR scanning, PR comments). • Adds `issue search` API support for returning and filtering by `lane` and `evidence`, sorting by `priority`, and returning linked tickets on issue list and search results. • Adds `issues.vulnerabilityReport` API/MCP field returning the per-finding report, and `presentation.evidence` to issue search when called with `presentation: true`, where `evidence.validated` covers agent-, Runtime Validation-, and person-confirmed findings (with `validationProvenance: "legacy"` for findings confirmed before tracking) and `knownVulnerableVersion: true` marks version-match-only dependency findings without asserting `reachability: "reachable"`. • Adds `Create`, `list`, and `delete` API key management endpoints accessible only from a signed-in browser session; requests authenticated with an API key or `Authorization` header receive `403` for these operations. • Adds `Organization SBOM` export that bundles the latest SBOM for every viewable repository into one ZIP in `CycloneDX 1.6` or `SPDX 2.3` JSON, with a manifest of included and skipped repositories. • Adds Export report (.docx) under `More actions` on the full issue page for a per-finding downloadable report. Breaking changes: • Requesting a re-investigation from the app, API, MCP, or Assistant now requires the `Close Issues` permission on the finding's repository; organizations using access control must explicitly grant it to members who re-investigate findings, or those requests will receive `403`. • Creating, editing, and deleting repository tags now requires `Manage Teams` or `Edit SAST Configuration`; members who are not admins need a team that grants `Manage Teams`. • Tag create and update API requests that pass the `repositoryIds` field are now refused; callers must switch to explicit `include`, `exclude`, and `release` fields. • API key management (`create`, `list`, `delete`) now returns `403` for requests authenticated with an API key or an `Authorization` header; these operations require a signed-in browser session. • A dependency finding confirmed only by a version match now carries `knownVulnerableVersion: true` and no longer reports `reachability: "reachable"` on that basis; callers relying on reachability for version-match findings will see a changed response. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Mon, 05 Oct 2026 07:56:57 GMT Breaking changes: • `trends[].meanRemediationTime` is deprecated and replaced by `trends[].meanRemediationTimeInPeriod`; integrations reading the old field must migrate to the new one. • For scans marked with `inventoryRetiredAt`, requests for CycloneDX, SPDX, and VEX exports now return `412 PRECONDITION_FAILED` instead of results; callers must select a current scan. • When `scaPackage.dependencyPathsRetiredAt` is set, `dependencyPaths` is omitted and `transitiveDependencies` may be empty; callers must treat dependency-path data as unavailable. • On-premises scanner-setting updates must omit `allowDeepSeekModels`; payloads that include it will be rejected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Sun, 04 Oct 2026 07:50:25 GMT ZeroPath: Issue `severity` `score` may now be `null`, meaning unavailable rather than zero. Breaking changes: • For scans marked with `inventoryRetiredAt`, `CycloneDX`, `SPDX`, and `VEX` exports now return `412 PRECONDITION_FAILED`; callers must select a current scan. • When `scaPackage.dependencyPathsRetiredAt` is set, `dependencyPaths` is omitted and `transitiveDependencies` may be empty; clients must treat this as unavailable data rather than an empty result. • On-premises scanner-setting updates must omit `allowDeepSeekModels`; any existing configuration passing this field will be rejected. • `trends[].meanRemediationTime` is deprecated and replaced by `trends[].meanRemediationTimeInPeriod`; integrations reading the old field must migrate. • Issue `severity` `score` may now be `null`; clients that treat a zero score as 'unavailable' must now handle `null` explicitly. • Changes to shared rules, context, and scan locations now require access to both their current and destination scopes; operations that previously succeeded with narrower permissions may now fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-09 https://zeropath.com/docs/changelog#2026-09 Sat, 03 Oct 2026 07:36:10 GMT ZeroPath gains on-premises Kubernetes deployment, self-updating threat models, dashboard profiles, repository inventory, and personal/service API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `detectionTypes` parameter to `issues.list`, `issues.search`, and MCP `issues_list` to control whether results include SCA findings; omitting it now includes SCA by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Returns HTTP `412 PRECONDITION_FAILED` from CycloneDX, SPDX, and VEX exports when a scan is marked `inventoryRetiredAt`, signalling that a current scan must be selected. • Exposes `scaPackage.dependencyPathsRetiredAt` field; when set, `dependencyPaths` is omitted and `transitiveDependencies` may be empty, marking dependency-path data as unavailable. • Adds on-premises deployment support in Kubernetes clusters, including scanning, patching, security reports, OIDC or administrator-enrolled local accounts, AI gateway, local security rules and vulnerability databases, internal package mirrors, S3-compatible storage, and webhook delivery to private receivers. • Adds Gerrit and CVS repository connections via Add Repository, available on-premises only; Gerrit bulk imports include progress tracking and retry controls. • Adds personal API keys scoped to your own permissions and administrator-created service API keys for unattended integrations, with a separate key per organization. • Adds Container Scanning for private registries (Early Access) on-premises. • Adds Runtime Validation with a private sandbox and callback service (Early Access) on-premises. • Adds AI AppSec Assistant (Early Access) on-premises. • Adds the Inventory tab for exploring packages, licenses, dependency risk, and AI components by branch, with SBOM and ML-BOM export from the selected scan. • Adds the Scanner workspace for managing settings, scan locations, context, rules, and sources and sinks in one place, with consistent categories across organization, tag, and repository scope. • Adds dashboard profiles to save layouts and filters across 13 widgets, kept personal or shared as organization templates, synchronized across devices. • Adds saved issue filters using CVSS 4.0 metrics, Runtime Validation results, dates, and priority scores; Fix Now rules select code or dependency findings by exploitability and CVSS criteria within a chosen scope. • Adds AI-authorship evidence from GitLab, Bitbucket, and Azure DevOps commit metadata (Early Access) in Code Governance. • Adds support for multiple Bitbucket installations with bulk import progress tracking and retry; Bitbucket Data Center adds PR scanning and instance-level tokens. • Adds administrator download of service and scan diagnostic logs on-premises. • Automatically updates threat models during full scans when architecture changes are detected, preserving user edits and recording section authorship and last-update timestamps. • Adds PR scan timeout configuration starting from five minutes. • Enables directory uploads from Windows via the CLI. • Adds SLA policy summaries configurable to show selected events, sent daily, weekly, or as detected with hourly checks, with mute and independent pause controls. • Adds repository search and current-or-earlier scan selection for reports, plus remediation-time comparison by period with sample sizes beside averages. • Adds organization membership counts, member and repository search within a team, and rule, context, scan schedule, scan location, and confidence-filter permission assignment from the team editor or default team template. • Includes dependency findings in the Issues All tab, repository counts, and exports. Breaking changes: • `issues.list`, `issues.search`, and MCP `issues_list` now include SCA findings when `detectionTypes` is omitted; callers that previously received code-only results must add `detectionTypes` to retain that behavior. • Issue severity and score may now be `null`, meaning unavailable rather than zero; consumers that treat `null` as zero will misinterpret results. • CycloneDX, SPDX, and VEX exports return `412 PRECONDITION_FAILED` for scans marked `inventoryRetiredAt`; integrations must select a current scan. • When `scaPackage.dependencyPathsRetiredAt` is set, `dependencyPaths` is omitted and `transitiveDependencies` may be empty; consumers must treat this as unavailable data rather than an empty result. • When `agent.getRepoCloneUrl` returns `gitConfig` for Bitbucket Data Center, that config must be applied when cloning. • On-premises scanner-setting updates must omit `allowDeepSeekModels`; model selection now belongs to deployment configuration. • Changes to shared rules, context, and scan locations now require access to both their current and destination scopes. • The `trends[].meanRemediationTime` field is deprecated and replaced by `trends[].meanRemediationTimeInPeriod`; `trends[].resolvedIssues` provides the sample size — callers must migrate before the field is removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Sat, 26 Sep 2026 07:48:57 GMT ZeroPath Issues API now includes dependency findings by default; Issues page 'All' tab unified with dashboard totals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The `issues.list`, `issues.search`, and MCP `issues_list` tool now include dependency findings when `detectionTypes` is omitted, aligning API defaults with the full open-findings set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The Issues page 'All' tab now counts and lists dependency findings alongside code findings, matching the dashboard's 'Total Open' card and repositories list. Breaking changes: • The `issues.list` and `issues.search` APIs now return dependency findings in addition to code findings when `detectionTypes` is omitted. Integrations that relied on the previous code-only default must pass `detectionTypes` explicitly to preserve their prior behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Mon, 14 Sep 2026 07:43:45 GMT ZeroPath: Adds access sync and repository permissions import from GitHub (five roles, including direct collaborators) and Bitbucket (Cloud workspace groups and Server project groups), mapping provider roles onto 39 permissions across 10 groups. Breaking changes: • On repository objects, `lastScanError` is replaced by `lastScanFailure`; any API consumer reading `lastScanError` will receive no value. • Eleven measurements on the security posture endpoint now return no value where there is nothing to measure — consumers must treat these fields as optional. • On secret findings, the dismissal explanation generated by ZeroPath is withheld from the API response; only a reviewer's own note is returned. • Connecting an integration now requires the `Create Integrations` or `Create Installations` permission; adding a repository by URL requires `Create Repositories`. • Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Sun, 13 Sep 2026 07:42:49 GMT ZeroPath: Adds a remote MCP server at `https://zeropath.com/mcp` supporting Streamable HTTP clients (Claude, Cursor, Codex); connections are read-only until approved, and administrators can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Teams channel notifications via Adaptive Cards; a channel owner pastes an incoming webhook URL into ZeroPath — no Azure AD app registration required — and notification rules control which events reach which channels. • Adds Continuous Scanning mode: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), re-examines what changed on follow-up scans, and closes findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository. • Adds Assistant skills: administrators author reusable methodology (triage approach, patch-review criteria, report structure, codebase conventions) from the Skills tab; four built-in skills ship for triage, dependency reachability, report writing, and patch review, each forkable into an editable copy. • Adds 'Plan first' mode for the Assistant: proposes an editable plan before anything runs, with the option to save the approved plan as a schedule, trigger, or playbook. • Adds a Scanner workspace consolidating all scan-configuration pages (Configuration: scanner settings and scan locations; Detection: repository context, rules, sources and sinks) under a single sidebar entry. • Adds scoped scanner permissions: rules, repository context, and scan location pages reflect the actions a member holds; Teams permission editor lists every grantable permission. • Raises final validation coverage to up to 1,000 findings per scan (up from 50). • Adds Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero to repository size measurement, enabling analysis-depth scaling for those codebases. • Adds pull request address to pull request scan webhooks. • Adds Jira and Linear ticket creation as a per-repository permission (must be granted explicitly when access control is enabled). Breaking changes: • On repository objects, `lastScanError` is replaced by `lastScanFailure`; any API consumer or integration reading `lastScanError` will receive no value and must update to `lastScanFailure`. • Eleven measurements on the security posture endpoint now return no value where there is nothing to measure — consumers must treat these fields as optional. • On secret findings, the dismissal explanation generated by ZeroPath is withheld from API responses; only a reviewer's own note is returned. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Sat, 12 Sep 2026 07:43:27 GMT ZeroPath adds a remote MCP server, Microsoft Teams alerts, Gerrit/CVS support, Continuous Scanning, and Assistant skills in this release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a remote MCP server at `https://zeropath.com/mcp` — connect Claude, Cursor, Codex, or any Streamable HTTP client to your findings with no install and no API key; connections are read-only until you approve changes, and an administrator can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `lastScanFailure` field on repository objects, replacing `lastScanError`, carrying both the error message and the outcome. • Adds Continuous Scanning mode — triggers a full scan on every meaningful commit to a default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; configurable per organization, tag, or repository on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server. • Adds Gerrit integration: imports projects for full scans and scans each open change as new patch sets arrive, posting findings as a review message on the patch set. • Adds CVS integration: imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning. • Adds GitHub Enterprise Cloud with data residency as a supported version control host. • Adds Microsoft Teams channel notifications — scan notifications and vulnerability alerts delivered as Adaptive Cards via an incoming webhook, with no Azure AD app registration required; notification rules control which events reach which channels. • Adds Assistant skills: reusable methodology definitions (triage, dependency reachability, report writing, patch review) that the Assistant applies while working, authorable from the Skills tab with four built-in forkable skills. • Adds pull request submission status tracking on approved patches — showing queued, in-progress step, retry state, or stop reason — with Cancel and Retry actions and up to five automatic submission attempts. • Adds Jira and Linear ticket links to CSV exports and the export endpoint. • Adds a dependency findings tab on the Issues page with CVE, advisory, and package search. • Adds scoped tag and repository filtering to monthly, organization summary, SLA compliance, and SOC 2 reports, stated on the report cover. • Adds on-demand Jira ticket sync preview showing each linked ticket's pending action before you apply it. • Adds a 'What's new' panel in the top bar surfacing the three most recent releases, with unread indicators. • Adds CVSS v4.0 vector support, assessing subsequent-system impact on its own evidence. • Adds severity labels following CVSS rating bands: Critical ≥ 9.0, High ≥ 7.0, Medium ≥ 4.0, Low ≥ 0.1. • Adds a scope control at the top of Supply Chain to narrow all tabs to a selected set of repositories, teams, and tags. • Adds Wiz export behavior: first export marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records. • Secrets scanning now reports the coverage it achieved, naming any file too large to read within the scan's time budget. • Adds Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero to repository size calculations, qualifying those repositories for deeper analysis. • Ticket creation for Jira and Linear is now a per-repository permission requiring an explicit grant when access control is enabled. • MCP tool calls are recorded in the audit log by parameter name, ensuring credentials passed to a tool never appear in audit rows or a connected SIEM. • A completed pull request scan links to the findings list it produced, with a separate dependency findings link. • The dashboard now covers a full year at a glance, with a quarterly period option. Breaking changes: • On repository objects, `lastScanError` is replaced by `lastScanFailure`; any integration or script reading `lastScanError` will receive no value after upgrade. • On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned. • Connecting an integration now requires the `Create Integrations` or `Create Installations` permission; adding a repository by URL requires `Create Repositories`. • A finding ZeroPath has not assessed now appears in the queue as 'Needs Review' (ranked on severity alone), widening the previous rule that only verified findings appeared — open counts will rise after upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Fri, 11 Sep 2026 07:39:01 GMT ZeroPath: Adds Microsoft Teams channel notifications via Adaptive Cards; a channel owner pastes an incoming webhook URL into ZeroPath — no Azure AD app registration or tenant-admin required. • Adds Gerrit project scanning: full scans and per-patch-set scanning of open changes, with findings posted as review messages on the patch set. • Adds Assistant Skills: reusable, administrator-authored methodology files (triage, dependency reachability, report writing, patch review) that guide the Assistant's behavior; four built-in skills ship forkable; changes apply to the next run. • Adds access sync for GitHub and Bitbucket teams (including Bitbucket Cloud workspace groups and Bitbucket Server project groups), mapping provider roles to 39 ZeroPath permissions across 10 groups. • Adds Jira and Linear ticket creation as a per-repository permission; organizations using access control must grant it explicitly. • Hardcoded-credential findings are redacted on every surface and classified by CWE. • Final validation now covers up to 1,000 findings per scan, twenty times the previous limit. • Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero now count toward repository size for analysis-depth decisions. • Select-all across pages now acts on the full filtered findings set, so bulk triage applies to exactly the displayed results. • Eleven measurements on the security posture endpoint return no value (instead of a placeholder) where there is nothing to measure. Breaking changes: • On repository objects, `lastScanError` is replaced by `lastScanFailure`; any integration reading `lastScanError` will receive no data after upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Thu, 10 Sep 2026 07:41:02 GMT ZeroPath: Adds a remote MCP server at `https://zeropath.com/mcp` — point Claude, Cursor, Codex, or any Streamable HTTP client at it, authenticate via browser, and work with findings with no install and no API key required; connections are read-only until changes are approved, and administrators can revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Teams channel notifications — paste an incoming webhook from Teams into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive Cards, with no Azure AD app registration required. • Adds Assistant skills — author reusable methodology (triage, dependency reachability, report writing, patch review) from the Skills tab; four built-in skills ship and are forkable into editable copies. • Adds a quarterly period option to the dashboard, which now covers a full year at a glance. • Adds Slack reconnection in place, with missing-permission scopes named explicitly. • Adds a duplicate-detection surface when adding repositories, surfacing likely duplicates from host migrations with a git history probe per match. • Adds a unified Scanner workspace in the main sidebar, grouping Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks) with permission-scoped actions. • Adds grouped Settings navigation with Workspace, Security, and Connections sidebars, and consistent five-category scanner settings (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope. • Raises final validation coverage to up to 1,000 findings per scan, up from 50. • Adds Ticket creation as a per-repository permission for Jira and Linear, required for organizations using access control. • Adds integration connection permissions: connecting an integration requires 'Create Integrations' or 'Create Installations'; adding a repository by URL requires 'Create Repositories'. Breaking changes: • On repository objects, `lastScanError` is replaced by `lastScanFailure`; any API client or integration reading `lastScanError` will receive no value and must be updated to read `lastScanFailure`. • On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned. • Eleven measurements on the security posture endpoint now return no value where there is nothing to measure; clients that expected a numeric zero must treat these fields as optional. • Connecting an integration now requires the 'Create Integrations' or 'Create Installations' permission; adding a repository by URL requires 'Create Repositories' — existing automations without these grants will be refused. • Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it or ticket creation will be refused. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog https://zeropath.com/docs/changelog Wed, 09 Sep 2026 07:39:54 GMT ZeroPath adds a remote MCP server, Microsoft Teams alerts, Gerrit/CVS support, Continuous Scanning, and Assistant skills in this release. • Adds a remote MCP server at `https://zeropath.com/mcp` supporting Streamable HTTP clients (Claude, Cursor, Codex); connections are read-only until changes are approved, and administrators can revoke all org connections at once. • Adds `lastScanFailure` to the repository object in the API, carrying both the message and the outcome of a failed scan. • Adds Microsoft Teams channel notifications via incoming webhook — paste the webhook URL into ZeroPath to deliver scan notifications and vulnerability alerts as Adaptive Cards, with no Azure AD app registration required. • Adds Gerrit project support: imports projects for full scans and scans each open change on new patch sets, posting findings as a review message on the patch set. • Adds CVS module support: imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning. • Adds GitHub Enterprise Cloud with data residency as a supported version control connection. • Adds Continuous Scanning: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository. • Adds Assistant skills: reusable methodology definitions authored from the Skills tab, with four built-in skills for triage, dependency reachability, report writing, and patch review — each forkable into an editable copy. • Adds a 'Plan first' mode to the Assistant: proposes an editable plan before execution and offers to save the approved plan as a schedule, trigger, or playbook. • Adds team import from GitHub and Bitbucket (covering Bitbucket Cloud workspace groups and Bitbucket Server project groups) to sync repository permissions and access control. • Adds CVSS v4.0 vector support, assessing subsequent-system impact on its own evidence. • Adds pull request submission status to approved patches: queued, in progress, waiting on retry, or stopped — with Cancel and Retry actions on the issue itself and up to five automatic submission attempts. • Adds a 'What's new' panel in the top bar showing the three most recent releases, marking unread ones. • Adds severity labels following CVSS rating bands: Critical (9.0+), High (7.0+), Medium (4.0+), Low (0.1+), applied to existing findings without a rescan. • Adds an optional tag and repository scope parameter to monthly, organization summary, SLA compliance, and SOC 2 reports, stated on the report cover. • Adds on-demand Jira ticket sync preview — shows what each linked ticket will do before you apply it. • Adds Jira and Linear ticket links to CSV exports and the export endpoint. • Adds a dependency findings tab to the Issues page with CVE, advisory, and package search. • Adds a scope control at the top of Supply Chain to narrow every tab to a selected set of repositories, teams, and tags. • Adds Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero to repository size calculations, ensuring those repositories receive the analysis depth their size warrants. • Adds Wiz export support: marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records. • Adds a per-repository permission for creating Jira and Linear tickets; organizations using access control must grant it explicitly. • Adds secrets scanning coverage reporting: states the coverage achieved and names any file too large to read within the scan's time budget. • Adds MCP tool call recording to the audit log by parameter name, ensuring credentials passed to a tool are never stored in audit rows or forwarded to a SIEM. • Adds pull request address to pull request scan webhooks. • Adds grouped Settings navigation with Workspace, Security, and Connections sidebar sections; scanner settings expose the same five categories (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope. • The dashboard now covers a full year at a glance with a quarterly period option. • Adds a 'Needs Review' queue state for findings ZeroPath has not yet assessed, ranking on severity alone. Breaking changes: • On the repository object, `lastScanError` is replaced by `lastScanFailure`; any API client or integration reading `lastScanError` will receive no value. • Connecting an integration now requires the `Create Integrations` or `Create Installations` permission; adding a repository by URL requires `Create Repositories` — existing automations lacking these grants will be refused. • Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it or ticket creation will be unavailable. • On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-09 https://zeropath.com/docs/changelog#2026-09 Tue, 08 Sep 2026 12:18:48 GMT ZeroPath adds a unified Scanner workspace, purpose-grouped Settings navigation, and scope-aware scanner permissions. • Adds a dedicated Scanner workspace in the main sidebar that consolidates all scanning configuration under Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks). • Groups Settings sidebar pages by purpose: Workspace (general, members, teams, billing), Security (scanner settings, repository tags, service levels), and Connections (integrations, notifications, API keys). • Surfaces scanner settings across five consistent categories — General, Full scans, Pull requests, Dependencies, and Remediation — at organization, tag, and repository scope so overrides appear in the same location at every level. • Scope-aware scanner permissions now control Rules, repository context, and scan locations, surfacing only the actions a member or team is authorized to perform and explaining unavailable Add, Save, and Delete actions inline. • Teams permission editor lists every grantable permission, and an organization-wide repository permission grant carries its named actions across all repositories — including saving repository context or scan location sets. • Members with per-repository scanner permission access a searchable repository list under Scanner to select which repositories they can configure. • Definitions linked to a repository removed from the version control host remain deletable. Breaking changes: • Editing or deleting a rule, repository context, or scan location set is now authorized against the scope the definition already holds as well as the scope being assigned — members and automation moving a definition outside their granted repositories will be refused. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-08 https://zeropath.com/docs/changelog#2026-08 Thu, 03 Sep 2026 07:33:20 GMT ZeroPath adds a remote MCP server, Microsoft Teams alerts, Gerrit/CVS support, continuous scanning, and access sync in this release. • Adds a hosted remote MCP server at `https://zeropath.com/mcp` — point Claude, Cursor, Codex, or any Streamable HTTP client at it, authenticate via browser (no install, no API key), and interact with findings; connections are read-only until changes are approved. • Adds Microsoft Teams integration: paste an incoming webhook URL into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive Cards in Teams channels — no Azure AD app registration or tenant administrator required. • Adds Gerrit repository support: import projects for full scans and scan each open change as new patch sets arrive, posting findings as a review message on the patch set. • Adds CVS repository support: import modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning. • Adds GitHub Enterprise Cloud with data residency support, connecting on its own host. • Adds Continuous Scanning: triggers a full scan every time a meaningful commit lands on a repository's default branch (including merged pull requests), with follow-up scans closing findings resolved by those commits; configurable per organization, tag, or repository in scanner settings; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server. • Adds Assistant Skills (Early Access): author reusable methodology instructions from the `Skills` tab that the AI AppSec Assistant applies during triage, patch review, and report writing; four built-in skills ship for triage, dependency reachability, report writing, and patch review, each forkable into an editable copy. • Improves AI AppSec Assistant (Early Access) with a 'Plan first' mode: the Assistant proposes a plan you can edit, add steps to, and approve before execution, with an option to save the approved plan as a schedule, trigger, or playbook. • Adds access sync and repository permissions: import teams from GitHub and Bitbucket (including Bitbucket Cloud workspace groups and Bitbucket Server project groups), map GitHub's five roles and Bitbucket's three onto thirty-nine permissions across ten groups, and restrict member visibility to only repositories they hold a grant on. • Adds pull request submission status tracking for approved patches: shows state as queued, in progress, waiting on retry, or stopped with reason; `Cancel` and `Retry` actions appear on the issue itself, with up to five automatic submission attempts. • Adds Jira and Linear ticket links to CSV exports and the export endpoint. • Adds an on-demand Jira ticket sync preview showing what each linked ticket will do before applying it. • Adds a 'What's new' panel in the top bar showing the three most recent releases with unread indicators. • Adds optional tag and repository scope filters to monthly, organization summary, SLA compliance, and SOC 2 reports, reflected on the report cover. • Adds a Supply Chain scope control that narrows all tabs to a selected set of repositories, teams, and tags. • Adds a dependency findings tab in the Issues page with CVE, advisory, and package search; completed pull request scans link to their findings list with a separate dependency link. • Adds CVSS v4.0 vector support for assessing subsequent-system impact, with severity labels following CVSS rating bands: Critical ≥ 9.0, High ≥ 7.0, Medium ≥ 4.0, Low ≥ 0.1. • Extends final validation to cover up to 1,000 findings per scan (twenty times more than before). • Adds repository-size counting for Terraform, Svelte, Vue, Solidity, Elixir, Dart, protobuf, and Genero, ensuring those repositories receive analysis depth matched to their size. • Adds duplicate detection when adding repositories, surfacing likely duplicates from host migrations with a git history probe for each match. • Extends the dashboard to cover a full year at a glance with a quarterly period option. • Secrets scanning now reports coverage achieved and names any file too large to read within the scan's time budget. Breaking changes: • Creating Jira and Linear tickets is now a per-repository permission; organizations using access control must explicitly grant it or ticket creation will be blocked. • Connecting an integration now requires the `Create Integrations` or `Create Installations` permission; adding a repository by URL requires the `Create Repositories` permission. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-06 https://zeropath.com/docs/changelog#2026-06 Mon, 01 Jun 2026 00:00:00 GMT ZeroPath 2026-06 adds container scanning, AI inventory, SLA policies, ObjectScript SAST, and new API endpoints. • Adds Container Scanning via the new `Containers` section, CLI, API, or MCP server with layer-attributed findings and Dockerfile patch PRs • Adds `AI Inventory` exportable as an AI-BOM for governance and compliance • Adds `Application Threat Modeling` to edit trust boundaries and auth models affecting subsequent scan triage • Adds KEV badges, EPSS scores, and license classification in the redesigned `Supply Chain view` • Adds per-ecosystem `coverage reporting` with warnings for failed manifests or missing transitive dependencies • Adds `SLA policies` with Slack/webhook escalation, compliance burn-rate dashboards, and due date sync to Jira/Linear • Adds integration with GitHub Enterprise Server (guided App setup) and Azure DevOps Services (Entra OAuth/PAT) • Adds coding-agent integrations for Claude Code, OpenAI Codex, and Cursor via a single installer with blocking or monitoring hooks • Adds ObjectScript language support in `Code Analysis` recognizing `.cls` and `.mac` files • Adds `Custom natural-language rules` that apply on pull request scans and incremental rescans • Adds opt-in `Cross-Repository Discovery` to build relationship graphs across repositories • Adds `scanner settings` including High Performance Mode, draft PR handling, and removal of bypass button from failing checks • Adds new API endpoints for container scanning, supply chain posture, licensing, and issue management (notes, severity, patch regeneration) Breaking changes: • Runtime validation responses no longer include the deprecated `agentGroupKey` field Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-05 https://zeropath.com/docs/changelog#2026-05 Fri, 01 May 2026 00:00:00 GMT ZeroPath 2026-05 adds Runtime Validation, On-Demand Code Scans, Azure DevOps PR scanning, and SCA reachability filtering. • Adds `Runtime Validation` (early access) to dynamically confirm SAST findings against the running application with Confirmed/Disconfirmed verdicts. • Introduces `On-Demand Code Scans` (beta) for submitting diffs or snippets for asynchronous review without full repo scans. • Adds Azure DevOps as a supported platform for PR scanning. • Adds severity-level checkboxes and PR grouping for scan filtering in the UI. • Enables SCA vulnerability filtering by Wiz Exposure to focus on internet-facing dependencies. • Adds `SCA_NEW_ISSUE` event trigger for AI AppSec Assistant integration. • Introduces Real-time notifications for SCA issues via Slack and webhooks. • Exposes V2 API endpoints for querying Wiz CSPM settings, projects, assets, and exposures. • Adds support for boolean, number, and select dropdown parameter types in Playbook templates. • Enables Linear auto-ticketing with automatic assignee resolution modes. Breaking changes: • The `functionSummary` field has been removed from vulnerability API response schemas. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-04 https://zeropath.com/docs/changelog#2026-04 Wed, 01 Apr 2026 00:00:00 GMT ZeroPath 2026-04 adds Agent Playbooks, new SCA/Secrets detections, MCP server metadata, and expanded AI Assistant API. • `Agent Playbooks` with new event trigger types (e.g., `PR Merged with Issues`) enable automated, parameterized security workflows without manual configuration. • SAST now generates `CVSS 3.1` scores alongside CVSS 4.0 and displays Security impact labels in issue headers. • SCA alerts can be routed to per-org webhook endpoints for direct integration with Microsoft Teams and Slack. • `AI Assistant API` provides full management of conversations, jobs, schedules, triggers, and memory via new REST endpoints and SSE streaming. • `Issue export dialog` adds format selection including `CASA CSV` and `SARIF`, with live preview count and filter overrides. • Secrets detection engines now support AI-powered validation states: `Confirmed`, `Disconfirmed`, and `Unknown`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath https://zeropath.com/docs/changelog#2026-03 https://zeropath.com/docs/changelog#2026-03 Sun, 01 Mar 2026 00:00:00 GMT ZeroPath 2026-03 adds AI AppSec Assistant dashboard, SCA compiled scanning, fix verification via PR comments, V2 APIs, and custom reports. • Adds new `AI AppSec Assistant` dashboard with Overview, Activity, Chat, Schedules, Triggers, Memory, and Settings tabs. • Adds `custom MCP server installation` for the AI AppSec Assistant. • Enables Slack thread control (cancel, replace, amend) within the AI AppSec Assistant. • Adds on-demand investigation for findings in issue detail view, bulk, via API, and MCP server. • Adds mandatory data flow path and step-by-step exploitation steps to confirmed findings. • Surfaces exploitability preconditions with expandable evidence in the issue detail view. • Adds new `Informational` status for findings where exploitability cannot be determined. • Enables deep codebase analysis following extended call chains and complex cross-file data flows. • Smart rescans match issues to changed line ranges per file. • Enables fix verification by referencing ZeroPath issues in PR descriptions using `ZP-ID:` syntax or dashboard URLs. • Adds `@bot retriage` command on PRs to trigger fix verification instead of standard investigation. • Adds AL (Business Central) to supported SAST languages. • Links SCA findings to the manifest file and line number where the dependency is declared. • Detects packages embedded in JARs, WARs, Python wheels, and other binary artifacts via compiled asset scanning. • Walks up to 5 hops for multi-hop transitive dependency resolution. • Provides remediation instructions for unpatchable findings when no safe version exists. • Adds SBT (Scala) transitive dependency support with lockfile parsing and automatic sandbox fallback. • Adds Haskell (Hackage) and R (CRAN) ecosystems to SCA support. • Adds new filters for ecosystem, package reachability, source type, and info severity level in SCA. • Adds Gradle version catalog support with line-level tracking; parses PEP 621 `pyproject.toml` and Poetry 1.2+ group dependencies. • Includes exploitability preconditions in SCA findings. • Enables SBOM generation directly without first running an SCA scan. • Adds multi-engine secrets detection with automatic cross-engine deduplication. • Adds GitHub Actions workflow security scanning for CI/CD pipeline misconfigurations. • Adds Custom Reports dashboard with interactive charts, 14 filterable fields, six preset templates, and save/share capabilities. • Adds new Assets tab in Reports alongside Views, Generate, and History tabs. • Adds Custom Report permissions (View, Create, Delete) to team settings. • Allows separate PR summary comment controls for scans that find issues and clean scans, both enabled by default. • Limits inline display in PR summary comments to the top 10 findings with a link to the full dashboard. • Adds detailed vulnerability info toggle to PR scan settings. • Adds `@bot rescan` command for triggering PR rescans and `@bot retriage` for deeper AI investigation. • Accepts `@ZeroPath` as a universal bot alias in PR comments, in addition to the configured bot username and `@zeropath-ai`. • Redesigns Integrations settings page with a master-detail sidebar layout. • Adds History cutoff setting to ignore scan history before a configured date during dependency analysis and deduplication. • Adds `custom rules only` mode at the repository level. • Supports bulk export of multiple findings in Jira and Linear integrations. • Adds Linear custom templates with title, description, labels, and priority fields for auto-ticketing. • Allows Linear integration to be connected at the organization level. • Supports GitLab pipeline webhooks for pipelines outside of merge requests. • Adds `scans.rescanPR` tool to the MCP server for triggering PR rescans. • Adds new V2 API endpoints for semantic search across vulnerabilities and detected endpoints. • Adds new V2 Agent API with endpoints for patch management, PR creation, repository access, event triggers, and global agent instructions. • Adds custom report statistics endpoint returning aggregated metrics. • Adds Code Inspection API endpoints for searching, reading, and listing files in connected repositories. • Adds `POST /api/v2/issues/requestInvestigation` with `issueIds` and optional `context` for on-demand investigations. • Adds `POST /scans/rescanPR` endpoint to trigger a rescan of a previously scanned PR. • Adds new `INFORMATIONAL` issue status and `CICD` detection type across v1 and v2 APIs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeropath