This week’s roundup covers public Corgea releases from September 4 through September 9, 2026. The updates make it easier to review findings through the API, retrieve generated fixes in an API response, and keep triage decisions properly explained.
Top 3 features
1. Group findings in the API
The API can now group code findings by file path and dependency findings by package. Each group includes a summary count and exact filters, so clients can show the group and then retrieve the findings that belong to it.
This mirrors how Corgea organizes findings in the product. Code findings can be reviewed by their location, while dependency findings are organized around the packages that introduce them. It gives teams building their own reports or workflows a cleaner starting point than a long flat list of results.
2. Wait for a generated fix in one API request
API clients can now pass wait_for_the_fix=true when requesting an issue. Corgea waits up to 120 seconds for a Generate Fix result, so the completed suggestion can return in the same response.
Without the option, clients can start generation and check again while auto_fix_suggestion.status is generating. The web app follows that second pattern: it shows generation progress and displays the completed fix when it is ready. As always, teams should review a suggested change before applying it.
3. Require a useful reason for triage decisions
False-positive and accepted-risk decisions now require an explanation of why the finding is not a real vulnerability. The requirement applies to individual decisions, bulk actions, and comments sent to the Corgea Agent.
For example, a reason can explain that the code is unreachable, input is sanitized, or the code appears only in tests. A comment that repeats the decision without context does not change the finding. This gives reviewers the information they need to understand the decision later.
More features and improvements
- Kept SCA triage decisions across rescans instead of resetting them when a newer finding has no triage activity.
- Added lifecycle emails through Loops.so for signup and trial milestones.
- Improved issue-detail layouts on different screen sizes and made the collapsed-sidebar pilot countdown clearer.
- Preserved valid false-positive and accepted-risk decisions, assignments, and due dates when duplicate findings are merged.
- Restored missing CWE information, including weakness names in pentest findings.
- Fixed paid accounts being downgraded after an earlier trial expires.
- Redesigned permission-change emails with the person who made the change, counts of added and removed permissions, and an access-review link.
- Added feature overviews and demo booking for Security Review, Pentests, and Agent Learnings when they are not part of a plan.
- Return unsupported MCP streaming requests promptly instead of leaving connections open.
- Improved handling of compressed pentest reports so Corgea stores them correctly.