Neu v1.2.25

Plexicus v1.2.25: Multiple SCM Accounts & Smarter CVSS Scoring

Connect multiple SCM accounts per provider for flexible repository onboarding, and benefit from more accurate, NVD-backed CVSS scoring across your findings.

🚀 What’s New

  • Multiple SCM Accounts: You can now connect multiple SCM accounts per provider — including GitHub, GitHub Enterprise Server, GitLab self-hosted, and Bitbucket — all within a single client. This replaces the previous one-connection-per-client limit, giving you the flexibility to manage repositories across distinct organizational accounts without needing separate clients. Revoked connections are cleanly removed, and webhooks route automatically to the correct account.
  • CVSS Quality Improvements: CVSS scores on your findings are now version-agnostic and enriched with NVD integration, giving you more consistent and trustworthy severity assessments across your entire vulnerability backlog.

🔧 Fixes

  • GitHub OAuth Login: GitHub-based sign-in is fully restored — the post-callback lookup now correctly resolves your account and no longer fails on username/email mismatches.
Qualifizierung

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Teilen Sie den wichtigsten Kontext. Wir prüfen den Umfang und nennen den nächsten kommerziellen Schritt.

Vor dem Absenden — prüfen Sie, ob Sie passen

0 / 280

Keine Verpflichtung. Wenn Sie nicht passen, sagen wir es Ihnen.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)
Private Runde Für Investoren