Current Multi-Tenant Version | 3.67

Checkmarx One now keeps the repository URL for Code Repository Integration Projects consistently synchronized across project-related APIs. When a project is created or updated, whether through the UI or via API, the repository URL is automatically reflected in both the Project and Project Settings API responses, so no manual synchronization is needed afterward.

This ensures accurate, up-to-date repository information is always available to any service or integration that relies on project data.

Risk Orchestration now supports bulk triage, letting you apply severity, state, and change log updates to multiple risks at once instead of triaging them one by one. Select the risks you want to update using checkboxes in the risk table, then use the Triage action in the bulk action toolbar to apply changes across all selected risks, including risks from different scanners in the same selection.

When the selection includes SCA risks, the triage editor also lets you adjust VEX parameters for those risks as part of the same bulk update. Because each update is processed independently, successfully applied changes are preserved even if others fail, and any failures can be reviewed and retried without re-applying risks that already succeeded.

This significantly reduces the time needed to clear large triage backlogs and lets you act on entire risk clusters in a single step.

Project deletion (projects.delete) is now logged in the Audit Trail API.

Scheduled scans now support all Code Repository Integration projects.

With this update, teams can rely on consistent, automated scan coverage across their full project portfolio, regardless of how the project was imported.

Checkmarx One now provides improved reflow support in the Presets and side navigation areas, ensuring content adapts properly to different screen sizes and zoom levels without loss of information or functionality.

These enhancements make navigation clearer and more reliable for users relying on assistive technologies or working with enlarged text and layouts.

Checkmarx One now extends Exemption Rules support to scans triggered via the CLI in Azure DevOps pipelines. Break-build policy evaluation for CLI-triggered scans honors the same exempt-state configuration defined in Policy Management, so previously dispositioned findings no longer trip the build gate regardless of how the scan was triggered.

This gives teams using Azure DevOps CLI pipelines consistent, reliable break-build behavior across UI, API, and CLI workflows.

Checkmarx One can now automatically trigger AI Remediation for risks that match your configured criteria, removing the need to request fixes manually. Auto Remediation is configured in Account Settings, under AI Assist, where you define which projects and branches are automatically remediated. You also specify the scanners (currently supported for SAST and SCA) and set the severity thresholds. You can allow or deny project-level overrides for these settings. Once enabled, the system generates AI fix suggestions for matching risks after a scan completes (or after AI Auto Triage completes, if triage is also enabled), and for supported Code Repository Integration projects (GitHub), opens a pull request with the suggested fix automatically. By closing the gap between risk identification and remediation, this feature reduces manual effort and increases the consistency and speed of your remediation workflow.

Risk Orchestration now displays an Internet-Facing badge next to a project's name in the unified project table when that project is identified as publicly accessible. This badge is sourced from data provided by Cloud Insights, and is therefore only available for accounts with a configured Cloud Insights integration. By surfacing internet exposure directly in the table, teams can quickly identify and prioritize publicly accessible projects when assessing risk.

The imports table in Bring Your Own Results now supports asynchronous CSV export, allowing large export requests to be processed in the background instead of blocking the user while the file is generated. Once ready, the exported file can be downloaded from the imports table.

This improves reliability for large data sets and lets users continue working while the export completes.

Break-build Exemption Rules now apply consistently to scans evaluated via the CLI, in addition to the existing pull request decoration flow.

With this update, exempted findings are correctly excluded from the break-build result regardless of which SCM platform or evaluation flow is used, ensuring consistent pipeline behavior across all integration methods.

The Checkmarx MCP Server now supports API Security, allowing AI coding assistants and chat clients to query and act on API risks directly from tools like Claude Code, Cursor, Windsurf, and Copilot CLI. Developers can ask about exposed APIs, drill into specific risks, and identify undocumented, shadow, or zombie APIs without leaving their coding environment, while security teams can query org-wide API risk posture through any MCP-connected chat client.

In addition, support for IaC Security and Secrets scanners was expanded to include triage tools, bringing these scanners to parity with existing support for SCA and SAST.

For additional information about the Checkmarx MCP server, see documentation

A previous limitation prevented SCA from showing the full dependency path for transitive dependencies introduced through a Private Package - the segment linking the transitive dependency back to the Private Package was missing, both in the package path view and in the CycloneDX SBOM export.

This limitation has now been resolved: the package path view in SCA Scan Results and the exported CycloneDX SBOM both display the complete path. Users can now fully trace how a transitive dependency entered their project, and exported SBOMs accurately represent all dependency relationships.

DAST scans no longer send browser update requests to Mozilla domains, so this traffic won't appear in scan reports. The change applies to both Firefox and Chrome-based scans.