Upcoming Multi-Tenant Version | 3.70

The Scan Results page now reflows into a single column at 400% zoom without horizontal scrolling. This release also improves contrast, adds visible focus indicators, and adds non-color cues wherever information relied on color alone. These changes improve consistency and usability for users relying on assistive technologies or visual accommodations.

Manually triaging a risk while AI Triage is still running now resolves cleanly for both SAST and SCA. The manual triage panel shows a message when AI Triage is in progress, and saving a changed state prompts a confirmation explaining the consequences before cancelling the AI Triage and applying the manual change. Credits are only charged for vulnerabilities already processed at the time of cancellation; reserved credits for unprocessed vulnerabilities are returned.

The Fusion toggle and LLM selector are now available in project creation, project editing, the Import Project wizard, Project Migration, and Project Settings (Code Repository tab), in addition to the existing Account-level setting.

This lets teams make a Fusion decision for a specific project at the moment it’s created, imported, or migrated, consistent with the existing Account → Project → Scan configuration hierarchy.

You can now document extended attributes for each open-source package, including Criticality, Usage Restrictions, Archive Property, Structured Property, and Comments. The attributes are included in CycloneDX and SPDX SBOMs and in SCA scan reports, which helps you meet compliance requirements such as the CERT-In SBOM guidelines.

DAST authentication now has a configurable timeout, so a slow authentication process no longer gets killed before ZAP can report what went wrong.

The ZAP-side timer defaults to 12 minutes and is adjustable in environment setup and settings; Checkmarx One’s own default timeout for ZAP is 15 minutes and this can be configured by each environment.

You can enable OWASP Penetration Testing Kit (PTK) scanning to improve coverage of client-side vulnerabilities, available as a toggle under Scan Configurations.

PTK requires the Client Spider, so the toggle is disabled if Ajax Spider is selected. Turning PTK on significantly improves client-side coverage; turning it on also excludes DOM XSS alerts to avoid duplicate findings, since PTK already reports them.

PTK results appear alongside other DAST results everywhere, including exported reports, and this option is also available via the CLI.

When you upload a Zest recording for authentication, you can now confirm or adjust the username and password fields that Checkmarx detected from the recording, instead of relying on fields Zest may have misread.

A pop-up shows the detected values for username and password as editable dropdowns, and a field where the on-screen name doesn’t match the username.

If TOTP is enabled, the same confirmation step applies to the detected TOTP string.

For security, these fields are only editable during the upload session; once saved, they appear disabled until the recording is re-uploaded. This is available in the environment setup wizard, environment settings, and the CLI.