Releases

v4.6

Products ranked by risk with a page each, remediation deadlines, triage with a reason, a finding's history, a page for every scan, schedules on one page, and LLM spend in money.

v4.6 is about working the findings. Products are ranked by risk and each has a page of its own; a finding carries a due date, a triage decision with its reason, and its history; every scan has a page that says what it spent and what it changed; and LLM spend is shown in money.

Area	What changed
Products ranked by risk	The Products page ranks products by a severity-weighted score of their open findings, says what needs attention first, and filters, sorts and exports the list as CSV.
A page per product	Every repository, web app and host a product's scans covered, with the latest report of each and its scan history; the product's findings, scans, assets and secrets; and every latest report in one ZIP.
Remediation deadlines	A new finding gets a due date from its severity — by default 7, 30, 90 and 180 days — and overdue findings are counted on the Products pages. In ScanSuite Teams each team sets its own deadlines.
Triage with a reason	A Triage menu replaces the status list. Ruling a finding out, accepting its risk or resolving it asks why, and a false positive can stop its class being reported in that file, folder or repository again.
A finding's history	Each finding shows when it was detected, which scans confirmed it, how it was closed or reopened, and who changed its status and why.
Links to the line	A repository finding names its file and line and links to them at the commit that was scanned, following the Git settings — GitHub, GitLab or Bitbucket Server.
A page per scan	Every scan shows its status, the AI SAST stages, what it added, confirmed, reopened and closed, its tokens and cost, and a log that filters by level and scanner.
Scan History	Rerun repeats the scan it reruns — scope, findings and mode; an interrupted AI scan can resume from its last checkpoint; a stopped scan ends Cancelled; and reports download in bulk.
Schedules in one place	The Schedules page lists every schedule and monitor with its next run and last scan, and runs, pauses, renames and deletes them. A change applies within a minute.
A clearer scan form	The static analysis form says in a line what each mode and AI option does, repeats at a time you choose, and shows what the last scan of a repository spent.
LLM spend in money	Once models are priced, Scan History, the scan page, the Products pages and the dashboard show cost beside tokens. The dashboard ranks targets by LLM spend.
Top 10 by risk	The Top 10 targets and classes rank by the severity-weighted score and show how many findings each has. Risk Accepted findings do not count.
Deleting findings	An administrator can delete the findings ticked in the list, or clear one repository's findings instead of the whole product's.
Verify Fixes stays in scope	A Verify Fixes run reassesses only the findings it was asked about: it adds none and leaves the others as they are.
Faster AI SAST	Files, candidates and mitigation advice are analyzed several at once, under a cap per scan and a cap per provider, and a provider's rate limit is waited out instead of failing the scan. In the classic edition two settings set the caps.
Classes that name the control	AI SAST names a class after the control that is missing, so one defect is not filed under two classes; older class names are relabelled. Classic edition.
Ratings from the code	Impact and likelihood are rated from what the code shows; facts static analysis cannot see no longer move a rating.
Database roles left alone	The installer no longer changes database roles; doctor checks that the database accepts the application account.
A web server that keeps answering	The web server no longer hangs under concurrent requests, and services starting together wait for each other's schema work instead of stopping.

See Products, Vulnerability Management and The scan page.

Last reviewed 2026-09-25