This week’s roundup covers public Corgea releases from September 14 through September 23, 2026. Teams can now include previously skipped code in scans, set up pentest targets with more complete login details, and download a CycloneDX SBOM from a completed scan.

Top 3 features

1. File include rules for code that should always be scanned

Project settings now include File Include Rules. Use a glob pattern to scan code Corgea would normally skip because of its folder, such as a migration directory or a fork under vendor/. Rules can be enabled, disabled, or deleted from the project settings.

An ignore rule still takes precedence, and Corgea rejects patterns that match an entire repository. After adding a rule for code that was skipped in an earlier scan, run a full scan once so that code is analyzed. Teams using the CLI can also add one-off patterns with --include.

2. Guided setup for pentest targets

The new target setup wizard supports multiple login accounts and optional TOTP credentials. When email support is enabled, dedicated inboxes let agents complete email verification, password resets, and sign-in flows that send a code by email.

That gives the pentest agent the access details it needs to test authenticated application paths instead of being limited to the public surface.

3. Download CycloneDX SBOMs from completed scans

Completed scans can now provide an on-demand CycloneDX software bill of materials (SBOM) from their dependency inventory. The download gives teams a portable inventory they can use in their own software supply chain workflows.

The release also adds GitHub team membership sync for teams that are already linked to Corgea. Membership updates happen automatically when users join, and administrators can use Sync membership when they need to refresh a team without changing its project links.

More features and improvements

  • Added a searchable team filter to the Vulnerabilities Workbench. The filter also applies to exports and bulk selections.
  • Made grouped Workbench findings and status counts faster, and kept Previous and Next navigation available when triage clears the current page.
  • Added API support for storing and retrieving scan file manifests and selecting an incremental baseline by scan ID for compatible clients working from shallow clones or directories without Git history.
  • Improved Harness integrations with permission errors, expired-token status, integration owners, and an attention-first ordering.
  • Updated the live pentest agent tree with clearer activity summaries, accurate agent statuses, and findings assigned to the reporting agent.
  • Reduced GitHub API use during pull request scans, check updates, and fix comments. Check updates and fix comments retry after rate limits reset.
  • Reduced memory-related failures while processing dependency inventories from large scans.
  • Sped up processing for findings, discovered endpoints, call paths, and project policy lookups.
  • Made the Scans list faster to load, added in-place updates for active scans, and added a control for newly available scans.
  • Improved feedback and failure recovery for project access control and GitHub team sync toggles.
  • Improved scan processing when saving findings and scan logs, retrieving earlier false-positive explanations, and carrying triage decisions forward.
  • Reduced first-login delays during SAML sign-in and memory-related failures in scheduled scans, reports, and background tasks.
  • Improved cancellation for scans superseded by a newer push to the same pull request, without marking cancelled scans as failed or sending scan-failed webhooks.
  • Let company administrators send email notifications to company admins, selected teams, or everyone, including SLA and scheduled-scan failure notifications.
  • Improved contrast, control sizing, and mobile access to account and logout controls. Command palette search now starts at two characters and returns up to 20 matching projects.
  • Sped up vulnerability and aging reports, SCA summaries, dependency finding lists, project scan results, and endpoint-grouped findings for large accounts.
  • Processed SCA and IaC findings faster, reduced delays when changing a finding’s status during AI review, and fixed IaC status-change webhooks.
  • Updated the Corgea Agent sidebar group and moved Feedback History into Agent settings. The feedback modal now has a close button.
  • Improved project details with searchable member selection, clearer scan statuses, and accurate scan counts. Advanced Vulnerability Search now avoids clipped dropdowns, overflowing labels, and dialogs.
  • Fixed issue sidebar controls that remained in Processing after a fix was ready, and added missing-branch guidance when Corgea cannot create a pull request.
  • Made incomplete BLAST scan file logs show available paths and explain when logs were not recorded.
  • Restored SCA and container finding history, including earlier assignment and status changes, across rescans.
  • Avoided unnecessary rescanning when README, text, or configuration files change during an incremental scan while continuing to scan changed files.
  • Fixed the pentest Runs tab to show findings for active, failed, and cancelled runs, and preserved finding counts in failure notifications.
  • Corrected scheduled scan report titles so weekly reports are labeled weekly.
  • Fixed issue pages for scans with no recorded branch and improved scan-status API performance.