Skip to main content

2026

June​

Highlights: AI-enhanced IDOR detection, CLI SBOM export, Applications page performance, GitHub onboarding enhancements, Findings CSV export, Reporting dependencies, API enhancements, MCP support, Agent Skills, End-of-Life for OS packages

  • AI-enhanced IDOR detection: Harness SAST and SCA has improved the detection of Insecure Direct Object Reference (IDOR) vulnerabilities using AI-powered analysis. Enable AI Findings in the AI Features section of Organization or Application Settings. See the AI SAST documentation page for details.
  • CLI enhancements: A new sl sbom export command exports an SBOM for an application scan in CycloneDX, SPDX, or VEX formats. Read the documentation for additional details.
  • Applications page performance: The Applications page now uses server-side pagination and a streamlined API, improving load times for organizations with large numbers of applications.
  • GitHub onboarding enhancements: When onboarding applications from GitHub, all accessible repositories are now fetched. Users can paginate and search across all repositories they have access to. Previously, only the first 100 repositories were returned.
  • Findings CSV export: You can now export application findings to CSV directly from the Application Findings page.
  • Reporting dependencies: On the Dependencies report, the Total CVEs and Total Apps columns are now clickable and link to filtered findings and application views.
  • API enhancements: The teams and groups endpoints now support pagination for organizations with large numbers of teams or groups. See the API documentation for details.
  • MCP support: Harness SAST and SCA now offers an MCP server that provides 15 tools for AI agents to list applications, analyze code, review findings and suggested fixes, and more. The MCP server is available as an npm package. See the documentation for your preferred MCP client to learn how to enable this feature.
  • Agent Skills: To better leverage the MCP tools, Harness SAST and SCA provides a number of skills that help the AI agent analyze code, triage, and fix vulnerabilities. The Skills are available on our GitHub repository.
  • End-of-Life for OS packages: OSS Risks now include findings for End-of-Life for OS packages. This helps customers keep container images up to date and avoid vulnerabilities that remain unfixed for packages that are no longer maintained. Read the OSS Risks documentation for additional details.

May​

Highlights: OWASP 2025, AI Confidence & Analysis, AI Features settings, Findings search, Pending user invitations, Python SBOM support, API enhancements, Subscription warning banner

  • OWASP 2025: OWASP 2025 Top 10 categorization is now available throughout the platform. See the Compliance documentation page for details.
  • AI Confidence & Analysis: When enabled, AI analyzes vulnerability findings to provide confidence assessments, attack scenarios, and suggested mitigations. This feature currently requires a subscription. Please reach out to your Customer Success representative if you would like to enable it and provide feedback.
  • AI Features settings: A new AI Features section on the Organization Settings page lets you enable or disable AI Findings, AI Confidence & Analysis, and AI AutoFix. The AI Findings toggle is now available to all customers. See the AI SAST documentation page for details.
  • Findings search: A new search bar on the Application Findings table allows you to search findings by Finding ID or Title.
  • Pending user invitations: You can now filter the Users page to show only outstanding (unaccepted) invitations, making it easier to track onboarding progress and follow up with pending users.
  • Python SBOM support: SBOM generation for Python applications now supports pyproject.toml files, in addition to requirements.txt and uv.lock.
  • API enhancements: The audit log download endpoint now supports an auditDay parameter, allowing you to download audit logs for a specific day within a month. See the API documentation.
  • Subscription warning banner: A new banner appears when your subscription is within 90 days of expiring or application usage reaches at least 95% of the limit. Closing the banner suppresses it for 2 weeks (31–90 days remaining, or 95–100% usage), 1 week (7–30 days remaining), or 1 day (fewer than 7 days remaining).

April​

Highlights: API enhancements, CLI enhancements, Go OSS dependencies, New Scans page

  • API enhancements: A dedicated PATCH endpoint is now available to configure an application's Default Branch. A companion RBAC scope is also available for use in Custom Roles. PATCH endpoints are also available to configure the Organization, Teams, and Applications. Finally, a new API endpoint allows Super Admins to reset Personal Access Tokens of SAML users.
  • CLI enhancements: A new finding status command is now available. This command allows users to view and set a finding status from within the comfort of their terminal. Read the documentation for additional details.
  • Go OSS dependencies: A new application setting now allows you to enable the analysis of all Go OSS dependencies, instead of only the dependencies that are part of the build (the default behavior).
  • New Scans page: A new Scans page and experience is now available. This page allows users to paginate and select scans far beyond the traditional 10-scan limit. It also offers the option to select and view IDE scans. A bar chart shows the number of findings for each scan, and when hovering, users can see a breakdown by severity.

March​

Highlights: AutoFix GitHub app, OSS Risks, CLI improvements, Secure AI Coding (beta), Refreshed UI look & feel

  • AutoFix GitHub app: This new GitHub application creates AutoFix Pull Requests. It also allows users to interact with the AI Agents in the Pull Request comments.
  • OSS Risks: In addition to identifying open source vulnerabilities, Harness SAST and SCA can now detect OSS dependency risks such as Malicious Package, Abandoned Package, Hijackable Repository, and Typosquatting. Additionally, a new Application setting allows you to enable the analysis of JavaScript development dependencies.
  • CLI improvements: The CLI now automatically removes older CPG frontends and other dependencies, in order to save on disk space. When using option --container-sca-only-upload, a target directory is no longer required.
  • Secure AI Coding (beta): Instead of relying solely on pull requests or CI/CD pipelines to detect issues later, Secure AI Coding shifts security to the point where code is created. As soon as code is generated or updated in Cursor, Windsurf, and Claude Code, hooks trigger local and fast analysis that focuses on the changes introduced by the agent.
  • Refreshed UI look & feel: We’ve updated the look and feel of Harness SAST and SCA (Qwiet AI) to match the core Harness platform, making your workflow transitions smoother and more intuitive.

February​

Highlights: VS Code extension improvements, Enhancements to Wiz integration

  • VS Code extension improvements: Added setting to enable/disable the analysis of development dependencies for JavaScript. Improved finding descriptions to include better mitigation steps and line numbering, particularly for OSS findings. Enhanced highlighting consistency for findings across the Terminal and Findings tab.
  • Enhancements to Wiz integration: Added the ability to toggle the upload of SAST findings, SCA findings, or both within Organization Settings. Learn more on the Wiz integration documentation page.

January​

Highlights: Hard delete setting for SCIM Users, Container SCA only option, Support for Groovy, New CVE webhook notifications, VS Code extension improvements, Harness SAST and SCA

  • Hard delete setting for SCIM Users: New Hard Delete Users setting for SCIM, under Organization Settings. When enabled, instead of deactivating a user it will be permanently deleted. The identity provider will have to create the user and all its associated data and relationships again.
  • Container SCA only option: New option --container-sca-only-upload for sl analyze allows to run a container SCA only and skip SAST and other processing steps. For more information, see the container documentation page.
  • Support for Groovy: Harness SAST and SCA can now analyze applications written in the Groovy programming language. For more information, see the Groovy documentation page.
  • New CVE webhook notifications: You can now receive webhook notifications when new CVEs have been published for an application that's been previously analyzed. This option can be enabled in the Organization Settings page.
  • VS Code extension improvements: The Harness SAST and SCA extension for VS Code can now detect dependency vulnerabilities as soon as a manifest file (e.g. requirements.txt) is saved. You can now also find the extension in the Open VSX Registry, and it can be installed in Cursor, Windsurf, and other IDEs that support Open VSX.
  • Harness SAST and SCA: Qwiet AI by Harness is now Harness SAST and SCA. The CLI, plugins, extensions, integrations, and other product offerings have been updated to reflect the new branding. Additionally, Harness SAST and SCA is now available natively within the Harness Security Testing Orchestration (STO) solution.