This week’s changelog post covers the public Corgea releases published between August 17 and August 19, 2026. The biggest updates add private package registry support for Maven, PyPI, and NuGet, expand Corgea scanning to Rust projects, and introduce controlled bulk-triage write actions for agent workflows, alongside reachability-aware CI dependency blocking, better filtering in the Vulnerability Workbench, cleaner scan-list organization, and a set of scanning and integration fixes.

Top 3 features

1. Private package registry support for Maven, PyPI, and NuGet

Corgea can now connect directly to private Maven, PyPI, and NuGet registries, which closes a common blind spot in dependency scanning. For teams that publish shared libraries internally, that means scans can now inspect those packages and the dependencies behind them instead of stopping at the first private package boundary.

The docs add useful detail here. Registry connections can be configured once for the whole company or limited to selected projects, and Corgea supports multiple registries at the same time when teams need different package sources. The setup also works with either the structured form or an existing package-manager config file, and new scans can surface sub-dependencies and vulnerabilities that were previously hidden behind internal packages.

2. Rust support across code, secret, and dependency scanning

This week’s release also brings Rust support across Corgea’s code, secret, and dependency scanning flows. That matters for teams adopting Rust to tighten reliability and safety without giving up security coverage in the rest of their stack.

The product docs spell out where that support goes deeper than a simple language checkbox. Corgea’s AI-native SAST coverage for Rust looks at ownership and borrowing patterns, unsafe blocks, FFI boundaries, and common framework usage in Axum, Actix Web, Rocket, and warp. The release also pairs that with the rest of Corgea’s scanning surface, so Rust projects can stay inside the same review and triage workflows as other languages instead of needing a separate toolchain.

3. Controlled bulk-triage write actions for agent workflows

Corgea now supports controlled bulk-triage write actions for agent workflows, which makes it easier to automate large-scale finding updates without giving up governance. That is especially useful for teams using agents or scripted workflows to keep finding status in sync across recurring scans.

The API docs show the guardrails behind the feature. The bulk triage endpoint can preview or apply rule-based changes across as many as 5,000 accessible SAST or SCA findings, and accepted-risk actions that cross a company’s approval threshold remain pending until a different admin approves them. Each action also records counts for matched, unmatched, ambiguous, conflicting, and applied findings, which gives security teams a clearer audit trail when automation is operating at scale.

More features and improvements

  • Added reachability filtering to CI dependency Blocking Rules so pipelines can focus enforcement on vulnerabilities based on whether affected code is reachable.
  • Added tag filtering to the Vulnerability Workbench so teams can narrow findings to selected project tags.
  • Added downloadable PDF scan reports through the API, including reports for completed scans with no code findings.
  • Added the acting user to issue status change webhook payloads for better auditability in automated workflows.
  • Fixed SCA findings so bulk-triage decisions carry forward correctly across rescans.
  • Simplified the Scans list by removing metadata-specific filters and organizing scan metadata into expandable tags with clearer project and repository details.
  • Improved Harness repository identification by unifying clone and web URLs, which helps avoid duplicate projects and wrong integration matches on vanity domains or across multiple Harness accounts.
  • Fixed scan detail loading indicators so they refresh correctly when a scan completes.
  • Improved project search performance and responsiveness for workspaces with many projects.
  • Refined team badges on project pages with more consistent, less dominant colors.
  • Removed the focus shadow from vulnerability accordions for a cleaner browsing experience.
  • Improved SCA and container finding identifiers so issues stay consistently tracked across scans.
  • Fixed scan summaries so findings with image: identifiers are counted as container findings.
  • Prevented oversized IaC classification values from interrupting finding ingestion.
  • Fixed Free plan usage enforcement so unlimited scanning works as intended.
  • Fixed Harness integration selection and repository identification for projects created through the CLI.
  • Made SSO and JWT authentication availability independent of Enterprise plan checks.
  • Improved API handling of malformed or non-UTF-8 JSON requests so they return a clear validation error.