Enhancements

Workflows: Automated, Incremental Security Testing

Bright Workflows provides a new way to orchestrate and manage security testing across the application lifecycle.

Instead of managing Discovery and Scans as separate tasks, you can connect them into a reusable workflow that automatically discovers the application surface and launches targeted security testing based on the results.

Workflows can run manually or on a recurring schedule. After each successful Discovery, Bright compares the latest application surface with the previous baseline, identifies new and changed entry points, and passes them directly to the Scan.

This keeps testing focused on what changed, reducing unnecessary rescanning and manual effort.

Key Capabilities

• Connect a trigger, Discovery, and Scan in a visual workflow
• Run workflows manually or on a recurring schedule
• Automatically identify and scan new and changed entry points
• Maintain a Discovery baseline between workflow runs
• Track workflow and step-level status and progress
• Review execution history, timelines, logs, and errors
• Navigate directly from failed steps to the relevant Discovery or Scan
• Stop, retry, duplicate, edit, or delete workflows
• Maintain traceability through execution records and audit logs

Workflows turn disconnected testing activities into a structured, repeatable process. By automatically connecting Discovery with targeted scanning, teams can respond faster to application changes, reduce manual work, and continuously test the most relevant parts of their attack surface.

For full configuration details, visit the Workflows user guide.

OWASP Top 10 Risk Overview

The new OWASP Top 10 Risk Overview provides a clear view of how your open security issues are distributed across the OWASP Top 10:2025 categories.

Available on both Organization and Project dashboards, the widget automatically maps open issues to the relevant OWASP categories. At the organization level, results are aggregated across selected projects, helping security teams identify broader risk patterns across their application portfolio.

Current coverage limitation: Bright does not currently provide security tests mapped to Security Logging and Alerting Failures or Mishandling of Exceptional Conditions. These categories will therefore display 0 open issues. This reflects current test coverage and should not be interpreted as confirmation that the application is not exposed to these risks. Support for additional relevant test types is planned for a future release.

Note: This widget is an informational view based on detected open issues and is not a compliance assessment or certification.

More Precise Scanning with Connectivity Status Filtering

Scan by Status now gives you greater control over scan scope by allowing entry points to be filtered by their current Connectivity Status.

By default, Bright selects only entry points with an OK status, keeping scans focused on entry points that are reachable and ready for security testing. This helps reduce avoidable failures, noise, and unnecessary use of scan resources.

When needed, you can also include entry points with Unauthorized, Problem, or Unreachable statuses. Connectivity Status works alongside the existing Entry Point Status filter, giving you more precise control over which entry points are tested.

This is especially useful for troubleshooting. For example, after fixing an authentication issue, you can run a focused scan against entry points previously marked as Unauthorized to verify that the issue has been resolved.

Security Testing Improvements

This release delivers accuracy and reliability improvements across multiple security tests, reducing noise and expanding detection coverage.

CORS Misconfiguration - Now detects origin reflection with credentials, the most critical CORS bypass scenario. Previously, Bright flagged missing headers on well-configured servers; this has been corrected.

JWT Authentication - No longer flags CORS preflight (OPTIONS) endpoints as broken authentication. These endpoints are unauthenticated by design and do not indicate a bypass.

Secret Tokens - Improved accuracy for Bing Maps and LinkedIn key detection. Tightened patterns eliminate matches on bundled content and unrelated marketing data.

HTTP Method Fuzzing - More reliable detection of insecure PUT/PATCH methods across a wider range of endpoint configurations.

EXIF Metadata - Broader image path coverage for API responses that return site-root paths without a leading slash.

CSS Injection - More reliable out-of-band confirmation by maintaining browser context during callback verification.

Header Security - Removed the deprecated X-XSS-Protection misconfiguration check. The XSS auditor has been removed from all major browsers, and modern guidance recommends not setting the header.

Deprecation Notice

entrypointsStatuses in Scan Configuration

The entrypointsStatuses property in the Scan Configuration API will be deprecated starting: 22 September 2026.

To select entry points for a scan, use the entryPointFilter property instead. This provides more flexible filtering based on both Security Status and Connectivity Status.

"entryPointFilter": {
  "securityStatus": [
    "new"
  ],
  "connectivityStatus": [
    "ok"
  ]
}

The existing entrypointsStatuses property will remain supported during the deprecation period to allow customers time to migrate their integrations.

We recommend updating API integrations to use entryPointFilter for all new implementations.