chris (.

@here Yesterday, vulnerabilities in eMudhra and PHP2Shell dropped on the same day, and our team immediately merged a fix. Out of that work, we built Early Light, a free, open source detection tool that works with Community Edition and alongside Sensei (available with DefectDojo Pro) to create fixes. The open source community is going to get the fastest detection tool we can ship, and we’d love your feedback and contributions as we continue to scale the project. Early Light Github- github.com/DefectDojo/earlylight

Hey folks today's webinar is now up on youtube. DefectDojo's new Triage Engine is a substantial improvement compared to the old rules engine so be sure to check out the recording or try it out for yourself in DefectDojo Pro

Hey all we're live right now for today's introduction to Triage Engine. Join us live here! zoom.us/webinar/register/…

DefectDojo Weekly Changelog 🚀 — v3.4.200 (October 19, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: ✨ (UI) The Pro UI has in-app walkthroughs. A lightbulb in the lower right of every page lists the walkthroughs for that page: the App Tour, plus task walkthroughs for importing, triage, access, reports, admin setup, the Jira connector, and the Triage Engine. First-time users are offered the App Tour on Home. Requires the In-App Walkthroughs feature flag, on by default. See In-App Walkthroughs. 📋 (Tables) The Findings list has a grid view, a filter bar, and a Match Any mode. The Assets, Organizations, Engagements, and Tests lists get the same grid view and filter bar. 📏 (Triage Engine) A new On Dedupe Match trigger decides what deduplication does with a match in another Asset: mark it a duplicate as before, or keep both Findings active with their own SLAs and link them. Two new actions, Copy Status from Matched Finding and Apply Status to Linked Findings, carry false positive, out of scope, and risk accepted decisions between linked Findings. 🔌 (Connectors) StackHawk and Qualys TotalAppSec connectors are available. 🔌 (Connectors) Connectors set an Asset's type from the vendor's data when a record is mapped and on every sync, and Triage Engine rules can set it too. A type chosen by a person or a rule is never overwritten. 📋 (Tables) Text column filters gain In List and Not in List modes, every multi-select column filter has an Include / Exclude switch, and the Asset and Organization pick-list filters accept a pasted list. Pressing Enter applies a column filter or the filter bar editor. 🎯 (Findings) A Finding's risk is shown as a meter that marks its band, instead of a written level. The Findings list has an Owner (Team) column and filter, and the API can filter Findings by owner and assignee. 📏 (Triage Engine) Rules can use Asset metadata, custom fields, and contacts in notifications, and select fields support partial matching. 🔌 (Connectors) Wiz reports network exposure as asset exposure evidence, FOSSA syncs can be limited by issue category and by project label or title, and Qualys imports host tags and can group Assets by tag. Push to Connector is offered only when a connector covers the Finding, and says what each push sent. 📦 (Assets) The reachability probe checks the addresses held in Locations, and superusers configure it under Settings > Reachability Probe. See Asset Exposure. ♻️ (Deduplication) A rehash keeps going when a worker stops, and shows its progress. 🎛️ (Settings) Every flag on the Feature Flags page links to its documentation. ⚡ (Performance) The Pro UI loads its application state once and fetches only what changed as you navigate. The daily SLA run batches its notifications and loads its data up front, the asset page, Findings list, and Command Center no longer recount large Finding sets, list filters stay fast at scale, and saving a Finding no longer runs one query per vulnerability id. ✨ (UI) Form checks show their messages in the app language, and errors the server returns appear under the field they name. Tags have readable contrast in light and dark themes, with corrected Medium and High colors, table column headers use the monospace label font, the asset hierarchy and Location map editors stack on phones, and a failed table preference save shows one toast. 🎯 (Findings) Merging Findings deletes each merged Finding on its own, so duplicates and Jira stay in sync, and the merge counts bulk-selected Findings. Users mentioned in a review request are notified, and review notes are cleared. 🔌 (Jira) Findings closed because a threat model superseded them are closed in Jira too. 📥 (Importers) Imports and reimports no longer fail when Findings are deleted while they run, and vulnerability ids that are not strings are accepted. ♻️ (Deduplication) Excess duplicate deletion runs one at a time, so overlapping runs no longer deadlock, and it only waits for imports in the same database. 🛠️ (Parsers) SARIF tags and OSV aliases supply CVE and GHSA ids. 🕵️ (Threat Intelligence) A matched Finding gets KEV and EPSS data when a reimport adds its CVE. 🔔 (Notifications) The daily SLA run continues when one Finding fails. 🤖 (Sensei) Sensei no longer offers fixes for Findings with no file, and a GitHub 404 from a deleted App or a missing installation is explained. 🔌 (Connectors) An un-ignored mapped record returns to Good and syncs again, and a mapping save with duplicate values no longer fails. Snyk follows every results page, Cyberwatch reads live server data, and Cycode accepts one language or a list. The Jira sign-in flow for Downstream connectors says why it failed. 🤖 (MCP) Toolset selection works, and MCP server upgrades no longer interrupt /mcp. 📜 (Compliance) Hand-entered POA&M items stay open across syncs and can carry a scheduled completion date, the POA&M artifacts API honors its snapshot and kind filters, and DAST connector scan types count as web application assessments. 📦 (Assets) Every user who can view an Asset sees its Organization and contact names. 📍 (Locations) Old Endpoint list links keep their filters, New Location and Add Existing show only for users who can edit the Asset (and work for member Writers), the Location Map is translated, and the endpoint status API identifies endpoints by the id the endpoints API lists. 📋 (Tables) A page's pinned filter stays locked outside an OR group, child pages pin only the parent, and multi-select options apply on click without a search. 🔐 (Permissions) Group Owners and Maintainers can list and open the groups they belong to, and member errors are complete, translated sentences. 🎛️ (Settings) The Pro UI loads on databases migrated from open source whose settings record is not the first row, and the Pro settings record is created only once. ⚙️ (API) API v3 file uploads accept a title that another file already uses, and a title over 100 characters returns 400. The custom field values API filters by Asset. The admin error email for an unexpected API error includes the traceback. ✨ (UI) In the classic UI, multi-select filter fields render as searchable dropdowns. 🔐 (Authorization) Changing or removing an Owner on an Asset, Organization, or group requires permission to grant the Owner role. Downstream connector errors and ticket links show only Findings the user can view, deleting a mapping or connector requires edit access to the Assets it targets, and the Jira sign-in flow re-checks the user's permission. Legacy Endpoint detail views check access through the Asset or Finding. 🧭 (Navigation) The classic sidebar and the Menu 2.0 toggle are removed, and every user gets the current sidebar. 🎯 (Findings) The Findings list opens with nine columns: Severity, Risk, Finding, Asset, Status, Age, SLA, Found By, and Tags. The rest are in the Columns picker. Saved table preferences keep their columns, and columns added after a preference was saved start hidden. 🚢 (Deployment) The initializer refuses to migrate without a valid license in DD_LICENSE, the mounted license file, or the database. An expired license still passes. Please see the upgrade guide before upgrading. 🚢 (Deployment) A fresh install loads a schema built for its release instead of running every migration, so the first start is much faster. Upgrades are unchanged. DD_SCHEMA_DUMP_PATH overrides the schema file's path, and an empty value turns this off. 🚢 (Helm) The Orchestrator TLS private key is kept only in its Secret and no longer copied into the ConfigMap. mcp-server rolls out with no downtime, with a preStop wait set by lifecycle.preStop.waitSeconds.mcpServer, and nginx forwards the query string on /mcp. Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…

DefectDojo Weekly Changelog 🚀 — v3.4.100 (October 12, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: 🔍 (Search) Global Search (Cmd/Ctrl+K) is rebuilt as a palette with two modes: Search finds records by type (Findings, Assets, Organizations, Engagements, Tests, Locations), and Navigate jumps to any page in the sidebar. 🤖 (Sensei) 1,000 free Sensei fixes for every Pro instance from October 14 through November 13. Free fixes are used before your license quota and do not count toward pay-as-you-go spend. 📜 (Compliance) Posture scans count as configuration evidence, with PCI DSS Requirement 2. Security Hub and Wiz findings are tagged with the compliance requirements they map to, and Prowler compliance mappings are kept on cloud scan results. 📜 (Compliance) For findings that cite no security control, DefectDojo suggests control mappings for a person to confirm. 🕵️ (Threat Intelligence) Findings and the Vulnerability Explorer show source ratings from the signed threat-intel bundle, and the finding’s evidence chip shows the date a CVE was added to CISA KEV. 📍 (Locations) Cloud resources are listed under Attack Surface. 🎫 (Licensing) View and delete the legacy endpoints that still count toward your license after the move to Locations. 📴 (Air-Gapped) The Airgapped instance flag, or the new DD_AIRGAPPED setting, now stops every default outbound call: the version check, external tools, announcements, threat intel, and diagnostics. 🌅 (Deprecations) Each deprecation is declared once, with its release calendar, and shown on every surface where it applies. 📋 (Tables) Tables show when their columns or filters have unsaved changes. 🧭 (Navigation) Pinned sidebar entries are prefixed with their parent group. ✨ (UI) DefectDojo asks before copying, duplicating, or moving a record. 🔌 (Connectors) Security Hub ECR repository tags become asset tags for resource grouping. 🤖 (MCP) The MCP server can render DefectDojo results as MCP Apps views. ⚙️ (API) locations is advertised as a prefetch option on findings and products. ✨ (UI) Pages work better on narrow screens and phones: detail page headers wrap, dialogs stay inside the viewport, the Permissions dialog fits, and Home and the connection tiles no longer scroll sideways. ✨ (UI) Labels and copy are reworded and title-cased consistently in all 27 languages, and forms, tables, and dialogs across the UI (including the Command Center, Report Builder, and Sensei pages) share one style. 🔐 (SSO) When an identity provider’s certificate cannot be verified, sign-in shows an actionable message, and Validate Config names the CA bundle it checked against. ⚡ (Performance) Removed per-row queries from the tests, endpoints, locations, assets, engagements, and findings lists and from findings exports. Reimport closes old findings in bulk and looks up only the endpoints a report can match, the endpoint meta import is batched, notification cost stays flat as recipients grow, and prioritization rescores a product in a worker after import. 🔐 (Login) A failed SSO sign-in no longer loops on the auto-redirect, and the login page reports a login service that returns an unexpected response. 🔌 (Connectors) Finding tags sent by connectors are saved, nb_occurrences maps onto the finding, a corrupt gzip chunk returns 400 instead of 500, and moved assets’ records are no longer marked stale when their original organization is deleted. Discover and Sync say why a run was refused and refresh the records when it ends, and Push to Connector says whether anything was sent. Downstream connector controls follow Integration permissions instead of requiring a superuser. 🔌 (Connectors) Cyberwatch authenticates with HTTP basic auth, Cycode streams violation pages, and Snyk treats a missing links object as the end of pagination. ♻️ (Deduplication) Security Hub connector findings match on their finding ARN, and the same CVE in two container images stays two findings. 📤 (VEX) The asset VEX export never applies one host’s not_affected to another host. 🤖 (Sensei) Sensei targets refresh after a status sync, and Scan History is back. 📥 (Importers) Import no longer overwrites a report’s scan date, and misleading import and reimport fields are corrected. A scan with a missing request or response in a request/response pair imports, and an orphaned location reference returns 400 instead of 500. 🛠️ (Parsers) SonarQube REST API imports store the issue key as unique_id_from_tool, and Qualys WAS honors the QUALYS_WAS_WEAKNESS_IS_VULN and QUALYS_WAS_UNIQUE_ID settings. ⚖️ (Risk Acceptance) The default expiration date applies to every new risk acceptance, the forms offer the engagement’s findings, and accepting risk stays fast on tables without statistics. 🎯 (Findings) The SLA of a finding due today is shown, and creating a finding group no longer returns 500 for non-superusers. 📊 (Reporting) Organization users can open Generated Reports, report toasts link to the report, and a failed report shows why. 📏 (Triage Engine) New rules start disabled and Run Now runs them, and a rule with a disabled schedule says so instead of showing a next run. 📍 (Locations) Old Endpoint links redirect instead of returning 404. 🔔 (Notifications) Notification and Quick Action links point at pages that exist. 🔐 (Permissions) A refused member add shows the server’s reason, and the Owner role is offered only to users who can grant it. 🎛️ (Settings) The default group can be cleared, and Tool Configurations keep stored credentials when they are left blank on edit. ⚙️ (API) The SonarQube issue and transition endpoints are served from the right viewsets, and the API v2 Token page shows a refusal once and has a corrected Python sample. 🕵️ (Threat Intelligence) EPSS and receipt links refresh on records whose score did not change. 🎫 (Licensing) A license date without a timezone is read as UTC instead of failing. ✨ (UI) Actions the server would refuse are hidden, a failure shows one toast, PSIRT toasts no longer show error codes, the Regulatory Scope severity counts show in every language, and the Command Center respects reduced motion. 🔐 (Authentication) API token settings apply to API v3 token auth, HTTP Basic auth on the API follows the token endpoint’s account rules, the login rate limiter and account lockout are adjusted, account-recovery emails are limited per address, the report cover page requires a login, and changing a JIRA instance URL requires its password. 🔐 (Authorization) Object permissions are enforced on the questionnaire answer view, the API v3 import permission check, delete_preview on configuration viewsets, notification recipients, Issue Tracker Assignments, and report selectors and endpoint counts for shared locations. 🔐 (Hardening) The upload file type check covers parser-supplied attachments, three parser regular expressions are bounded, new system checks flag settings left at their shipped values, and the FIPS images apply Debian security updates. 🚢 (Deployment) uWSGI now uses harakiri to recycle wedged workers, configurable with DD_UWSGI_HARAKIRI (Compose) or per uWSGI pool (Helm). 🚢 (Deployment) A forward proxy and a private CA are honored by every container, NO_PROXY has built-in defaults, and /api/v2/health_check/light/ answers 503 instead of 400 when it fails. Self-hosted defaults for diagnostics, the portal secret, and initializer exit codes are corrected. 🚢 (Helm) New values: an opt-in dojo.migrationCheck gate that holds pods until migrations finish, license.existingSecretKey, ddorch.tls.existingSecret for GitOps and cert-manager, and GKE django.service.loadBalancerSourceRanges, SSL policy, and Cloud Armor settings. The values templates ship inside the chart, and the OCI chart is the documented install source. 🚢 (Helm) The ddorch TLS private key is stored in a Secret instead of a ConfigMap, the webhook gateway has its own trust anchor, the mirror, proxy, and CA settings reach every workload, django pods roll without load-balancer errors, and helm upgrade --reuse-values from 3.3.x renders. Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…

DefectDojo Weekly Changelog 🚀 — v3.4.0 (October 5, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release: 📏 (Triage Engine) Webhook receivers let Jira and other tools send changes back to DefectDojo, and the Jira Downstream Connector gains two-way sync and Push Notes as Comments. 📏 (Triage Engine) AI steps: three new nodes in an AI section of the palette (Check for False Positive, Assess Exploitability, and Group by Fix) ask Sensei one fixed question about the findings that reach them and route each finding out of a named exit, so the AI proposes and a person decides. 📏 (Triage Engine) Asset actions gain computed destinations (set the organization, parent, or SLA configuration from a tag, attribute, or connector field with a mapping), connector record attributes are available in the asset envelope, and a new Add Membership node replaces the admin-only membership rules. 🧪 (Sandbox) Sandbox Mode: a practice copy of DefectDojo Pro under /sandbox/, on its own database and preloaded with sample data, with Reset and Wipe for superusers. Nothing done in the sandbox reaches production. Self-hosted instances turn it on with DD_SANDBOX_ENABLED. 🛟 (Support) The new Support section in Settings searches the docs first, then lets you file feature, connector, bug, and feedback requests and vote on a public community board. It replaces the Contact Support menu entries and pages; old bookmarks redirect. 🩹 (Remediation Center) A new beta module (feature flag remediation_center, off by default) that makes the remediation action the unit of work: open findings are grouped by the change that resolves them, one action per change per place, each with a due date, risk, owner, workflow status, and the findings it will close. 🤖 (AI Inventory) A beta AI inventory (feature flag ai_inventory, off by default, requires Locations): every scanned repository gets an inventory of its coding assistants, MCP servers, models, AI packages, AI service endpoints, agent skills, and provider keys. Governance policies mark each as authorized, unauthorized, or needs review, unauthorized components become findings, and each Asset exports a CycloneDX 1.6 AIBOM. The DefectDojo scanner detects the AI in a repository and uploads it as a CycloneDX inventory. 📦 (Assets) A Needs Attention inbox under Assets lists assets still sitting in a connector's default organization or missing the fields that priority and SLA run on, a What Drives Priority and SLA card appears on the asset page, and onboarding is complete when the inbox reads zero. 📦 (Assets) Hierarchy change plans: bulk or AI-made reorganizations become a server-side plan with a dry-run diff that you review, apply as one change, and undo if needed. Plans can be built from JSON or a CSV upload. 🔌 (Connectors) New Microsoft Azure and Google Cloud asset connectors, and a new Kenna Security (Cisco Vulnerability Management) connector. 🔌 (Connectors) AWS Security Hub gains configurable asset grouping (by resource type or resource) with hierarchy parents, account parent records, OU and account-tag placement, AWS tags, and re-placing of existing assets. The same grouping and placement ladder comes to Microsoft Defender for Cloud, Prowler, Google Cloud SCC, and Lacework. 🔌 (Connectors) Re-mapping an already-mapped record to a different asset now moves its findings to the new asset by default, or closes them, instead of leaving them open and importing a duplicate set. 🎯 (Findings) Move or copy findings to another test, singly or in bulk. 🎯 (Findings) The finding tables gain an Exception Requested column and filter for findings sitting in a risk acceptance nobody has decided yet. 🧩 (Correlation) Fix with Sensei on Root Causes: the Root Cause dialog's member table carries the Sensei column, so you can launch a fix for each finding in the cluster. 📍 (Locations) The Location page returns, with the asset-scoped Metadata box, a Custom Fields card, and a Referenced By table of the assets that use the location. Cloud resource identifiers (AWS ARNs, GCP self-links, Azure resource ids) are decomposed into provider, account, region, service, and resource fields. 📜 (Compliance) Supporting files can be attached to regulatory obligations as evidence. 📊 (Reporting) Report Builder gains Location per Asset blocks and Asset and Organization name columns. 🚨 (PSIRT) PSIRT is out of beta, the PSIRT API is available on /api/v2/psirt/* with token authentication, and the MCP server gains a PSIRT toolset. 🌐 (i18n) Ten more languages: Polish, Ukrainian, Turkish, Indonesian, Filipino, Vietnamese, Thai, Korean, and Chinese (Simplified and Traditional). ⚙️ (API) Findings can be ordered by priority. 🚢 (Deployment) Self-hosted Docker Compose deployments, and Helm deployments with webhookGateway.enabled, run a new webhook gateway service in front of webhook receivers, with its own schema and database role inside DefectDojo's database. Please see additional instructions for more details. 🚢 (Helm) New chart values: connectors.debug (default off), connectors.vendorEgress (private-network blocking and allowed or denied CIDRs, default off), dojo.obligationAttachmentMaxBytes (default 10 MB), and a sandbox values block for Sandbox Mode. The Go service's internal routes are kept off nginx and its rate-limit toggles are split. The dd-orch workers and integrators mount only the dd-orch root CA, and the django readiness probe now has to reach a uwsgi worker. 🚢 (Deployment) The pro.0001 migration streams and bulk-creates its enhanced finding rows, so the first upgrade on a large instance completes in bounded memory. Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…

Hey folks happy Monday! If you haven't already be sure to fill out the survey above to let us know what date/time you would prefer for our live trainings and office hours!

Hey folks thanks to everyone who joined us for today's intro to reporting webinar! Recording will be shared out on youtube so be sure to subscribe to the channel for that recording. In addition we've been running the webinars for a while and want to get your vote on what date/time works best for you! We'll always share the recording to these sessions but want to make sure that the live webinar works best for those that want to ask their questions live

DefectDojo Weekly Changelog 🚀 — v3.3.300 (September 28, 2026) Hey everyone! A new update of DefectDojo Pro and Community Edition is out. Here's what's in this week's release:

Check out the full changelog here: docs.defectdojo.com/releases/pro/changelog#…