Neu 2025.2.8

Plexicus 2025.2.8: Optimized Workflows, Features and Security Fixes

Added support for BlackDuck and fixed import-related issues.

🚀 New Features

  • Added support for BlackDuck and fixed import-related issues.
  • Prioritized mandatory policies over best practices in findings management.
  • Introduced multiple tokens for the Plexalyzer connector.
  • Superadmin can now manage clients directly.
  • Integrated Azure Insights instrumentation for better monitoring.
  • CVSS score now displayed using a radar view.
  • Separated container & dependency scanner into 4 distinct categories for better organization.

🛠 Enhancements

  • Improved handling of findings creation of status not enriched
  • Applied enriched filters to all findings in downloads.
  • Enhanced UI elements for better clarity in finding details.
  • Improved the formatting of subscription start and end dates.
  • Updated login background image for a refreshed look.
  • Optimized the dashboard by ensuring only one date filter is used.

📋 Compliance & Customization

  • Enforced subscription restrictions in the upload scan workflow.
  • Adjusted worker permissions and cronjob configurations.
  • Updated pricing information for better transparency.

🔧 Integrations

  • Fixed issues with the BlackDuck importer and updated client data.
  • Resolved token parameter issues for Gitea repositories.
  • Improved SCM pipeline status tracking.
  • Added BlackDuck upload scan support.
Qualifizierung

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Teilen Sie den wichtigsten Kontext. Wir prüfen den Umfang und nennen den nächsten kommerziellen Schritt.

Vor dem Absenden — prüfen Sie, ob Sie passen

0 / 280

Keine Verpflichtung. Wenn Sie nicht passen, sagen wir es Ihnen.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)
Private Runde Für Investoren