Nuevo 2025.2.8

Plexicus 2025.2.8: Optimized Workflows, Features and Security Fixes

Added support for BlackDuck and fixed import-related issues.

🚀 New Features

  • Added support for BlackDuck and fixed import-related issues.
  • Prioritized mandatory policies over best practices in findings management.
  • Introduced multiple tokens for the Plexalyzer connector.
  • Superadmin can now manage clients directly.
  • Integrated Azure Insights instrumentation for better monitoring.
  • CVSS score now displayed using a radar view.
  • Separated container & dependency scanner into 4 distinct categories for better organization.

🛠 Enhancements

  • Improved handling of findings creation of status not enriched
  • Applied enriched filters to all findings in downloads.
  • Enhanced UI elements for better clarity in finding details.
  • Improved the formatting of subscription start and end dates.
  • Updated login background image for a refreshed look.
  • Optimized the dashboard by ensuring only one date filter is used.

📋 Compliance & Customization

  • Enforced subscription restrictions in the upload scan workflow.
  • Adjusted worker permissions and cronjob configurations.
  • Updated pricing information for better transparency.

🔧 Integrations

  • Fixed issues with the BlackDuck importer and updated client data.
  • Resolved token parameter issues for Gitea repositories.
  • Improved SCM pipeline status tracking.
  • Added BlackDuck upload scan support.
Calificación

Comprueba si el AI Swarm Pentest encaja en tu entorno.

Déjanos el contexto mínimo. Revisaremos el alcance y te indicaremos el siguiente paso comercial.

Antes de enviar — verifica que encajas

0 / 280

Sin compromiso. Si no encajas, te lo decimos.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)
Ronda privada Para inversores