Changelog

Cybe Analysis runs six times faster, a new organization-wide findings API, and a round of fixes across notifications, container scans, and AutoFix.

🚀 New Features

I. Organization-wide findings API

New endpoint GET /organization/{organizationId}/findings lists security findings across an entire organization in a single call, instead of querying project by project. Built for GRC and SIEM exports, so your findings can feed your existing compliance and monitoring pipelines.

Note that a restrictive rate limit of 10 requests per minute is in place on this endpoint.

✨ Improvements

Cybe Analysis is now 6x faster at analysing vulnerabilities, cutting the time between a scan finishing and an audited, prioritised result.

Cybe Analysis is also more stable on large codebases, which now go through without degradation. This work lays the groundwork for the new parsing engine coming next: endpoints will be identifiable directly in the graph, and you will be able to see which execution paths a given vulnerability actually reaches.

🛠️ Bug Fixes

• Fixed notification preferences in /profile that were ignored for zero-day and scan-complete emails, which kept being sent after being turned off.

• Fixed a rare infinite loading state on the dashboard when a user had many tabs open in parallel.

• Fixed false positives in VibeDefend's Action Guard, which was blocking some harmless actions.

• Fixed GitHub project renames not being propagated to CybeDefend; a renamed repository now stays in sync.

• Fixed container scans failing on ARM images.

• Fixed SCA AutoFix that did not run on some projects.

• Fixed code parsing that failed to trigger when a scan was queued immediately before it.

Malware detection in your dependencies, branch context in report emails, and a series of fixes across container scans, GitLab, and reporting.

🚀 New Features

I. Malware detection in packages and libraries

Dependency analysis no longer stops at known CVEs. CybeDefend now detects packages and libraries that carry malware, so compromised releases, backdoored versions, and typosquatted packages are surfaced alongside your other SCA findings.

II. Git branch in report emails

Daily, weekly, and monthly report emails now indicate the Git branch on which each vulnerability was detected. No more guessing whether a finding comes from your main branch or from a feature branch.

III. Smarter Cybe Analysis for More Accurate Audits

Cybe Analysis has been upgraded with enhanced AI model intelligence, enabling deeper and more thorough vulnerability audits. Detection accuracy has improved as a result.

🛠️ Bug Fixes

• Fixed container scans that systematically failed with "Image not found" when the image tag contained uppercase characters (:PROD, :v1.2.3-RC1).

• Fixed some GitLab connections returning a 500 error at the end of the installation, even though the integration and its projects had been created correctly.

• Fixed the severity badges (CRITICAL/HIGH/MEDIUM/LOW) rendering white on white, and therefore invisible, in weekly and monthly emails.

• Fixed the "Manifest File" column in the grouped SCA view, which displayed the dependency path instead of the manifest file (package.json and others).

Adaptive onboarding, a tighter link between VibeDefend and the dashboard, and automatic Git project detection.

🚀 New Features

I. Adaptive onboarding by role

Onboarding now adapts to who you are. The flow adjusts based on the user, so each person is guided toward what matters for them from the very first session, without wading through steps that don't apply.

II. VibeDefend onboarding

VibeDefend now ships with its own guided onboarding, walking you through setup and first use so you get to your first protected session faster.

III. Link a project to VibeDefend from the dashboard

The connection between VibeDefend and the CybeDefend dashboard is stronger. You can now link a project to VibeDefend directly from the dashboard, in a couple of clicks.

IV. Automatic Git project detection

VibeDefend now detects a GitHub or GitLab project automatically through Git. A project ID is no longer required in the config files for these repositories. Manual projects still require the project ID as before.

🛠️ Bug Fixes

• Fixed an SCA scan bug that resurfaced findings as "new" even though they had been marked as ignored and should no longer appear.

• Fixed a reporting bug where statistics and vulnerability lists included findings in the "ignored" status, which are already excluded from the email reports.

📌 Note

Please update VibeDefend to v1.4.0 to benefit from the new links between VibeDefend and CybeDefend.

npx -y @cybedefend/vibedefend@latest install