What's New with Mobb

Discover recently released features, news and product announcements!

Sign up to our mailing list to receive updates!

By clicking Subscribe, you agree to the processing of your email address in accordance with our privacy policy.

August 14, 2026

• New fixes released:

  • Semgrep/Opengrep

    • String Termination Error (allocation missing terminator byte) (CPP)

    • String Termination Error (strncpy bounded by full sizeof) (CPP)

    • String Termination Error (strncpy bounded by strlen) (CPP)

    • Unchecked Return Value (discarded stdio result) (CPP)

    • Unchecked Return Value (stored but unchecked stdio result) (CPP)

    • Trust Boundary Violation (Java)

• New FP rules released:

  • Semgrep/Opengrep

    • String Termination Error (allocation missing terminator byte) (CPP)

    • String Termination Error (strncpy bounded by full sizeof) (CPP)

    • String Termination Error (strncpy bounded by strlen) (CPP)

    • Unchecked Return Value (discarded stdio result) (CPP)

    • Unchecked Return Value (stored but unchecked stdio result) (CPP)

July 21, 2026

• New Repo Dashboard REST API endpoints: Added a suite of organization-level endpoints for contributor and repository insights — retrieve a live summary of unique contributors and repository sync health, drill down into the repositories and contributors behind each number, and access historical monthly snapshots. Available to organization owners. View API Documentation

July 10, 2026

• New fixes released:

  • Fortify

    • Buffer Overflow: Off-by-One (CPP)

    • Out-of-Bounds Read (CPP)

    • Out-of-Bounds Read: Off-by-One (CPP)

  • Semgrep/Opengrep

    • Cookie "HttpOnly" attribute is not set to true (C#)

    • Cookie "Secure" attribute is not set to true (C#)

    • Cross-site Scripting (C#)

    • Deserialization of untrusted data (C#)

    • Improper Resource Shutdown or Release (C#)

    • Information Exposure via Headers (C#)

    • Missing HSTS Header (C#)

    • Missing cross-site request forgery token validation (C#)

    • Open Redirect (C#)

    • Path Traversal (C#)

    • Regex Missing Timeout (C#)

    • SSRF (C#)

    • System Information Leak (C#)

    • XXE (C#)

    • Zip Slip (C#)

    • Denial of Service: StringBuilder (Java)

    • Improper Resource Shutdown or Release (Java)

    • Often Misused: Boolean.getBoolean() (Java)

    • Poor Logging Practice: Use of a System Output Stream (Java)

    • Race Condition Format Flaw (Java)

    • Use of Hard coded Cryptographic Key (Java)

    • Zip Slip (Java)

    • Clear text transmission of sensitive cookie (JavaScript / TypeScript)

    • Sensitive server cookie exposed to the client (JavaScript / TypeScript)

    • Request without certificate validation (Python)

• New FP rules released:

  • Fortify

    • Buffer Overflow: Off-by-One (CPP)

    • Out-of-Bounds Read (CPP)

    • Out-of-Bounds Read: Off-by-One (CPP)

  • Semgrep/Opengrep

    • Cross-site Scripting (C#)

    • Open Redirect (C#)

    • Path Traversal (C#)

    • Often Misused: Boolean.getBoolean() (Java)

    • Zip Slip (Java)

    • Sensitive server cookie exposed to the client (JavaScript / TypeScript)

June 26, 2026

• New fixes released:

  • Checkmarx

    • JWT No Signature Verification (Java)

  • Fortify

    • Path Manipulation (CPP)

  • Semgrep/Opengrep

    • Frameable Login Page (Clickjacking) (Java)

    • HTTP Parameter Pollution (query-string concatenation audit) (Java)

    • HTTP Parameter Pollution (tainted value into URL / query string) (Java)

    • Client DOM Stored Code Injection (JavaScript / TypeScript)

    • Incomplete Hostname Regex (JavaScript / TypeScript)

    • Incomplete URL scheme check (JavaScript / TypeScript)

• New FP rules released:

  • Checkmarx

    • JWT No Signature Verification (Java)

  • Fortify

    • Path Manipulation (CPP)

    • Insider Threat: Redundant Condition (Java)

  • Polaris

    • Identical Branches (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • HTTP Parameter Pollution (query-string concatenation audit) (Java)

    • HTTP Parameter Pollution (tainted value into URL / query string) (Java)

    • Useless ternary (constant condition) (JavaScript / TypeScript)

    • typescript.lang.correctness.useless-ternary.useless-ternary (JavaScript / TypeScript)

June 19, 2026

• New fixes released:

  • Fortify

    • Dangerous Function (CPP)

    • Unchecked Return Value (CPP)

  • Semgrep/Opengrep

    • Log Forging (Java)

    • Missing Check Against Null (Java)

    • System information leak via printStackTrace (Mobb) (Java)

    • GraphQL Depth Limit (JavaScript / TypeScript)

    • Iframe Without Sandbox (JavaScript / TypeScript)

    • Incomplete URL Substring Sanitization (JavaScript / TypeScript)

    • Type Confusion Through Parameter Tampering (JavaScript / TypeScript)

    • Unsafe Use of target=_blank (JavaScript / TypeScript)

    • Improper Resource Shutdown or Release (Python)

    • Incomplete URL Substring Sanitization (Python)

    • Insecure Temporary File (Python)

    • Log Forging (Python)

    • Modified Default Parameter (Python)

    • Regex Injection (Python)

    • System Information Leak (Python)

• New FP rules released:

  • Fortify

    • Unchecked Return Value (CPP)

  • Semgrep/Opengrep

    • Log Forging (Java)

    • System information leak via printStackTrace (Mobb) (Java)

    • Incomplete URL Substring Sanitization (Python)

    • Insecure Temporary File (Python)

    • Log Forging (Python)

    • Modified Default Parameter (Python)

June 12, 2026

• New fixes released:

  • Fortify

    • Dangerous Function: strcpy() (CPP)

• New FP rules released:

  • Checkmarx

    • Information Exposure Through an Error Message (JavaScript / TypeScript)

  • CodeQL

    • Information exposure through a stack trace (JavaScript / TypeScript)

  • Fortify

    • Dangerous Function: strcpy() (CPP)

    • System Information Leak: Internal (JavaScript / TypeScript)

June 9, 2026

• New fixes released:

  • Fortify

    • Buffer Overflow: Format String (CPP)

    • Command Injection (CPP)

  • Polaris

    • Server-Side Request Forgery (Java)

  • Semgrep/Opengrep

    • Cookie missing Secure attribute (Java)

    • Formatted SQL string passed to PreparedStatement (Java)

    • HTTP (non-TLS) GET request (Java)

    • HTTP Response Splitting (Java)

    • HTTP Response Splitting (Java)

    • Insecure HostnameVerifier — accepts any certificate (Java)

    • Insecure Transport: old TLS versions allowed (Java)

    • Insecure X509TrustManager — accepts any certificate (Java)

    • Insecure random (Math.random / java.util.Random) (Java)

    • JDBC SQL Injection (Java)

    • Open Redirect (Servlet / JAX-RS) (Java)

    • Path Traversal via environment / system property (Java)

    • Reflected XSS (Servlet / JAX-RS) (Java)

    • Regular Expression Injection (Java)

    • Stored SQL Injection (DB-tainted) (Java)

    • TLS verification bypass (Java)

    • Unencrypted Socket — use SSLSocket / TLS (Java)

    • Unsafe Deserialization (DB-tainted) (Java)

    • Unsafe object deserialization (ObjectInputStream.readObject) (Java)

    • Unsafe reflection from DB-tainted value (Java)

    • Weak SSL/TLS context (TLS 1.0/1.1 / SSLv3) (Java)

    • Incomplete sanitization (replace first vs all) (JavaScript / TypeScript)

    • Missing template-string indicator ($) (JavaScript / TypeScript)

    • Open redirect via function call (location/href) (JavaScript / TypeScript)

    • Path traversal via path.join / path.resolve (JavaScript / TypeScript)

    • Prototype pollution loop (JavaScript / TypeScript)

    • Prototype pollution loop (Mobb variant) (JavaScript / TypeScript)

    • React dangerouslySetInnerHTML with untrusted input (JavaScript / TypeScript)

    • RegExp constructor with non-literal pattern (JavaScript / TypeScript)

    • Useless ternary (constant condition) (JavaScript / TypeScript)

    • Dangerous subprocess usage (shell=True / untrusted argv) (Python)

    • Dangerous subprocess with tainted environment / argv (Python)

    • OS Command Injection (shell exec or code eval) (Python)

    • Code Injection via exec/eval with dynamic string (Python)

    • Code Injection via exec/eval with non-literal argument (Python)

    • OS Command Injection via os.system / os.popen (Python)

    • OS Command Injection via subprocess (non-literal command) (Python)

    • OS Command Injection via subprocess (shell=True) (Python)

    • open() without explicit encoding (Python)

    • urllib.urlopen with dynamic URL (SSRF) (Python)

    • K8s allowPrivilegeEscalation: true (YAML)

    • K8s container with writable root filesystem (YAML)

    • K8s container without securityContext (privilege escalation) (YAML)

• New FP rules released:

  • Checkmarx

    • Client Hardcoded Domain (JavaScript / TypeScript)

  • CodeQL

    • Inclusion of functionality from an untrusted source (JavaScript / TypeScript)

  • Fortify

    • Buffer Overflow: Format String (CPP)

    • Command Injection (CPP)

    • Hardcoded Domain in HTML (JavaScript / TypeScript)

  • Polaris

    • Server-Side Request Forgery (Java)

  • Semgrep/Opengrep

    • AWS access token detected (gitleaks) (DEFAULT)

    • Google Cloud service account credential detected (DEFAULT)

    • JWT detected (gitleaks) (DEFAULT)

    • JWT token detected (DEFAULT)

    • PGP private key block detected (DEFAULT)

    • CBC padding oracle (AES/CBC/PKCS5Padding) (Java)

    • Cookie missing Secure attribute (Java)

    • Formatted SQL string passed to PreparedStatement (Java)

    • JDBC SQL Injection (Java)

    • Open Redirect (Servlet / JAX-RS) (Java)

    • Path Traversal via environment / system property (Java)

    • Reflected XSS (Servlet / JAX-RS) (Java)

    • Stored SQL Injection (DB-tainted) (Java)

    • Unsafe reflection from DB-tainted value (Java)

    • Use of broken hash (MD5 / SHA-1) (Java)

    • Use of broken hash (MD5) (Java)

    • Use of broken hash (SHA-1) (Java)

    • Weak RSA key size (< 2048 bits) (Java)

    • Incomplete sanitization (replace first vs all) (JavaScript / TypeScript)

    • Missing template-string indicator ($) (JavaScript / TypeScript)

    • Open redirect via function call (location/href) (JavaScript / TypeScript)

    • Path traversal via path.join / path.resolve (JavaScript / TypeScript)

    • Prototype pollution loop (JavaScript / TypeScript)

    • Prototype pollution loop (Mobb variant) (JavaScript / TypeScript)

    • React dangerouslySetInnerHTML with untrusted input (JavaScript / TypeScript)

    • RegExp constructor with non-literal pattern (JavaScript / TypeScript)

    • html.security.audit.missing-integrity.missing-integrity (JavaScript / TypeScript)

    • Dangerous subprocess usage (shell=True / untrusted argv) (Python)

    • Dangerous subprocess with tainted environment / argv (Python)

    • OS Command Injection (shell exec or code eval) (Python)

    • Code Injection via exec/eval with dynamic string (Python)

    • Code Injection via exec/eval with non-literal argument (Python)

    • OS Command Injection via os.system / os.popen (Python)

    • OS Command Injection via subprocess (non-literal command) (Python)

    • OS Command Injection via subprocess (shell=True) (Python)

    • open() without explicit encoding (Python)

    • urllib.urlopen with dynamic URL (SSRF) (Python)

    • K8s allowPrivilegeEscalation: true (YAML)

    • K8s container with writable root filesystem (YAML)

    • K8s container without securityContext (privilege escalation) (YAML)

  • SonarQube

    • Using remote artifacts without integrity checks is security-sensitive (JavaScript / TypeScript)

May 28, 2026

• Opengrep engine upgraded to v1.22.0. Mobb's bundled Opengrep scanner has been updated to v1.22.0, and we've added 19 new Java detection rules to broaden our native Java coverage.

• New fixes released:

  • CodeQL

    • Sensitive cookies without the HttpOnly response header set (Java)

  • Semgrep/Opengrep

    • AWS DynamoDB Point-in-Time Recovery Disabled (HCL)

    • Default RESTEasy Provider Abuse (Java Deserialization) (Java)

    • JWT Decoded Without Signature Verification (Java)

    • Unsafe Reflection (Java)

    • java.lang.security.audit.http-response-splitting.http-response-splitting (Java)

    • java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing (Java)

• New FP rules released:

  • CodeQL

    • Failure to use secure cookies (Java)

  • Fortify

    • Cookie Security: Cookie not Sent Over SSL (Java)

  • Polaris

    • Missing SameSite Attribute (Java)

    • Missing Secure Attribute (Java)

  • Semgrep/Opengrep

    • JWT Decoded Without Signature Verification (Java)

    • Unsafe Reflection (Java)

    • find_sec_bugs.HTTPONLY_COOKIE-1 (Java)

    • find_sec_bugs.INSECURE_COOKIE-1 (Java)

    • java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag (Java)

    • java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing (Java)

    • java.servlets.security.cookie-issecure-false.cookie-issecure-false (Java)

  • Snyk

    • Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (Java)

  • SonarQube

    • Creating cookies without the "secure" flag is security-sensitive (Java)

May 25, 2026

• New feature in Mobb CLI: Scan and Fix mode. Mobb CLI can now scan your repository natively using its built-in Opengrep engine and generate fixes in a single command, with no external SAST tool or pre-generated report required. The same command also supports a diff-aware mode (via --baseline-commit) that only reports findings introduced since a given commit, making it ideal for pull request workflows. Learn more

May 22, 2026

• New fixes released:

  • Semgrep/Opengrep

    • AWS SQS Queue Unencrypted (HCL)

    • Insecure Transport: old TLS versions allowed (Java)

    • java.lang.correctness.no-string-eqeq.no-string-eqeq (Java)

    • java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false (Java)

    • javascript.lang.security.audit.detect-redos.detect-redos (JavaScript / TypeScript)

• New FP rules released:

  • Semgrep/Opengrep

    • generic.secrets.gitleaks.hashicorp-tf-password.hashicorp-tf-password (DEFAULT)

    • generic.secrets.gitleaks.private-key.private-key (DEFAULT)

    • java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false (Java)

May 15, 2026

• New fixes released:

  • Datadog

    • XSS Protection (Java)

  • Fortify

    • Often Misused: Boolean.getBoolean() (Java)

  • Polaris

    • Regular Expression Injection (Java)

    • XSS (Java)

  • Semgrep/Opengrep

    • find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER-1 (Java)

    • find_sec_bugs.XSS_SERVLET-2.XSS_SERVLET_PARAMETER-1 (Java)

    • lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer (Java)

    • browser.security.open-redirect-from-function.js-open-redirect-from-function (JavaScript / TypeScript)

• New FP rules released:

  • Datadog

    • XSS Protection (Java)

  • Fortify

    • Often Misused: Boolean.getBoolean() (Java)

  • Polaris

    • XSS (Java)

  • Semgrep/Opengrep

    • find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER-1 (Java)

    • find_sec_bugs.XSS_SERVLET-2.XSS_SERVLET_PARAMETER-1 (Java)

    • lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer (Java)

    • browser.security.open-redirect-from-function.js-open-redirect-from-function (JavaScript / TypeScript)

May 8, 2026

• New fixes released:

  • Polaris

    • CSRF — database update (Java)

    • Cross-site Scripting (Java)

    • Missing SameSite Attribute (Java)

    • Cross-site Scripting (JavaScript / TypeScript)

    • DOM XSS (JavaScript / TypeScript)

    • Hardcoded Credentials (JavaScript / TypeScript)

    • Hardcoded Secret (JavaScript / TypeScript)

    • Identical Branches (JavaScript / TypeScript)

    • Missing iframe sandbox (JavaScript / TypeScript)

    • No Depth Limit (JavaScript / TypeScript)

    • Open Redirect (JavaScript / TypeScript)

    • Regex Injection (JavaScript / TypeScript)

    • Sqli (JavaScript / TypeScript)

    • Unchecked Origin of Message Event (JavaScript / TypeScript)

    • Unrestricted PostMessage Target (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • javascript.lang.security.html-in-template-string.html-in-template-string (JavaScript / TypeScript)

• New FP rules released:

  • Polaris

    • CSRF — database update (Java)

    • Cross-site Scripting (Java)

    • Cross-site Scripting (JavaScript / TypeScript)

    • DOM XSS (JavaScript / TypeScript)

    • Hardcoded Credentials (JavaScript / TypeScript)

    • Hardcoded Secret (JavaScript / TypeScript)

    • Open Redirect (JavaScript / TypeScript)

    • Regex Injection (JavaScript / TypeScript)

    • Sqli (JavaScript / TypeScript)

    • Unchecked Origin of Message Event (JavaScript / TypeScript)

    • Unrestricted PostMessage Target (JavaScript / TypeScript)

    • Weak Hash (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • javascript.lang.security.html-in-template-string.html-in-template-string (JavaScript / TypeScript)

May 7, 2026

• REST API enhancements — fix lifecycle tracking fields: The GET /api/rest/fix-reports/{fixReportId} endpoint now returns four additional fields to support reporting and issue lifecycle tracking:

  • Vendor / Source (fixReport[].vulnerabilityReport.vendor) — the SAST scanner that identified the issue

  • First Observed Date (fixReport[].fixes[].vulnerabilityReportIssues[].sharedState.createdAt) — when the issue was first detected

  • Downloaded Date (fixReport[].fixes[].sharedState.downloadedBy[].downloadedAt) — when a fix was downloaded and by whom

  • Committed Date (fixReport[].fixes[].scmSubmitFixRequests[].createdAt) — when a fix was submitted as a PR or commit

  See Tracking Fix Lifecycle Metrics for full details and example responses.

May 1, 2026

• New fixes released:

  • CodeQL

    • Clear-text logging of sensitive information (Python)

    • Request without certificate validation (Python)

  • Fortify

    • J2EE Bad Practices: getConnection() (Java)

  • Polaris

    • Command Injection (Java)

    • XML External Entity (Java)

  • SonarQube

    • Bad practice - Method may fail to close database resource (Java)

• New FP rules released:

  • Polaris

    • XML External Entity (Java)

April 28, 2026

• Mobb now supports Polaris by Black Duck! Mobb can now automatically fix SAST vulnerabilities detected by Polaris. To get started, check out our new guides:

  • Integrating Polaris with Mobb - how to upload a Polaris SARIF report to Mobb

  • Generating a Polaris SAST Report - how to use the Bridge CLI to generate a .sarif.json report

  • GitHub Fixer for Polaris - how to automate Polaris scanning and Mobb fixes in GitHub Actions

• New fixes released:

  • CodeQL

    • Incorrect conversion between integer types (GO)

    • Improper validation of user-provided array index (Java)

    • Missing X-Frame-Options HTTP header (JavaScript / TypeScript)

  • Polaris

    • Cross-Site Request Forgery (Java)

    • Missing HttpOnly Attribute (Java)

    • Missing Secure Attribute (Java)

    • Null Pointer Dereference Exception (Java)

    • Open Redirect (Java)

    • Path Manipulation (Java)

    • Resource Leak (Java)

    • SQL Injection (Java)

    • SQL Injection (JavaScript / TypeScript)

  • SonarQube

    • Security - Nonconstant string passed to execute or addBatch method on an SQL statement (Java)

• New FP rules released:

  • CodeQL

    • Incorrect conversion between integer types (GO)

    • Hard-coded credential in sensitive call (Java)

    • Improper validation of user-provided array index (Java)

  • Polaris

    • Cross-Site Request Forgery (Java)

    • Open Redirect (Java)

    • Path Manipulation (Java)

    • SQL Injection (Java)

    • SQL Injection (JavaScript / TypeScript)

  • SonarQube

    • Security - Nonconstant string passed to execute or addBatch method on an SQL statement (Java)

April 17, 2026

• New fixes released:

  • CodeQL

    • User-controlled data in numeric cast (Java)

    • Full server-side request forgery (Python)

• New FP rules released:

  • Checkmarx

    • Prototype Pollution (JavaScript / TypeScript)

  • CodeQL

    • Executing a command with a relative path (Java)

    • User-controlled data in numeric cast (Java)

    • Prototype-polluting assignment (JavaScript / TypeScript)

    • Prototype-polluting function (JavaScript / TypeScript)

    • Full server-side request forgery (Python)

    • Incomplete URL substring sanitization (Python)

  • Semgrep/Opengrep

    • eslint.detect-object-injection (JavaScript / TypeScript)

    • gitlab.eslint.detect-object-injection (JavaScript / TypeScript)

    • javascript.lang.security.audit.prototype-pollution-loop-mobb.prototype-pollution-loop-mobb (JavaScript / TypeScript)

    • javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop (JavaScript / TypeScript)

  • Snyk

    • Prototype Pollution (JavaScript / TypeScript)

    • Incomplete URL sanitization (Python)

April 16, 2026

• New REST API endpoint: Added organization-scoped GET /api/rest/organizations/{organizationId}/active-reports endpoint — similar to the existing /api/rest/active-reports but filtered by organization and enriched with project ID and name in the response. View API Documentation

• REST API update: GET /api/rest/active-reports now returns project ID and name in its response. View API Documentation

April 15, 2026

• New fixes released:

  • CodeQL

    • Bad redirect check (GO)

    • Bad HTML filtering regexp (JavaScript / TypeScript)

    • Clear-text logging of sensitive information (JavaScript / TypeScript)

• New FP rules released:

  • CodeQL

    • Bad redirect check (GO)

    • Bad HTML filtering regexp (JavaScript / TypeScript)

April 7, 2026

• New fixes released:

  • CodeQL

    • Cookie "HttpOnly" attribute is not set to true (C#)

    • Cookie "Secure" attribute is not set to true (C#)

    • Cross-site scripting (C#)

    • Exposure of private information (C#)

    • Missing cross-site request forgery token validation (C#)

    • URL redirection from remote source (C#)

    • Open URL redirect (GO)

    • Reflected cross-site scripting (GO)

    • Stored cross-site scripting (GO)

    • Use of insufficient randomness as the key of a cryptographic algorithm (GO)

    • Building a command line with string concatenation (Java)

    • Cross-Site Request Forgery (Java)

    • Insecure randomness (Java)

    • Insertion of sensitive information into log files (Java)

    • Partial path traversal vulnerability (Java)

    • Regular expression injection (Java)

    • Cross-window communication with unrestricted target origin (JavaScript / TypeScript)

    • Incomplete string escaping or encoding (JavaScript / TypeScript)

    • Indirect uncontrolled command line (JavaScript / TypeScript)

    • Loop bound injection (JavaScript / TypeScript)

    • Sensitive server cookie exposed to the client (JavaScript / TypeScript)

    • Shell command built from environment values (JavaScript / TypeScript)

    • Unsafe HTML constructed from library input (JavaScript / TypeScript)

    • Unsafe jQuery plugin (JavaScript / TypeScript)

    • Unsafe shell command constructed from library input (JavaScript / TypeScript)

    • Uncontrolled command line (Python)

    • Unsafe shell command constructed from library input (Python)

• New FP rules released:

  • CodeQL

    • Cross-site scripting (C#)

    • URL redirection from remote source (C#)

    • Open URL redirect (GO)

    • Reflected cross-site scripting (GO)

    • Stored cross-site scripting (GO)

    • Use of a broken or weak cryptographic algorithm (GO)

    • Use of a broken or weak cryptographic hashing algorithm on sensitive data (GO)

    • Cross-Site Request Forgery (Java)

    • Hardcoded Credential Comparison (Java)

    • Insertion of sensitive information into log files (Java)

    • Partial path traversal vulnerability (Java)

    • Cross-window communication with unrestricted target origin (JavaScript / TypeScript)

    • Incomplete string escaping or encoding (JavaScript / TypeScript)

    • Indirect uncontrolled command line (JavaScript / TypeScript)

    • Sensitive server cookie exposed to the client (JavaScript / TypeScript)

    • Shell command built from environment values (JavaScript / TypeScript)

    • Unsafe HTML constructed from library input (JavaScript / TypeScript)

    • Unsafe jQuery plugin (JavaScript / TypeScript)

    • Unsafe shell command constructed from library input (JavaScript / TypeScript)

    • Uncontrolled command line (Python)

    • Unsafe shell command constructed from library input (Python)

March 23, 2026

• New guide: Added a step-by-step integration guide for Jenkins + Bitbucket + Checkmarx One, covering how to set up Checkmarx One and Mobb auto-remediation for your Bitbucket repositories through Jenkins pipeline.

March 4, 2026

• New REST API guide: Added a deployment scenario guide explaining how to use the /api/rest/fp-summary endpoint to retrieve concise false positive summaries (up to 280 characters) — ideal for embedding in suppression comments, ticketing systems, and CI/CD pipelines. Learn more

February 27, 2026

• New guide: Added a step-by-step integration guide for GitHub Fixer for GitHub Advanced Security (GHAS), covering how to set up CodeQL monitoring and automate Mobb fixes directly in your Pull Requests using the codeql-mobb-fixer-action.

• New fixes released:

  • CodeQL

    • Excessive Secrets Exposure (YAML)

    • Workflow does not contain permissions (YAML)

• New FP rules released:

  • CodeQL

    • Excessive Secrets Exposure (YAML)

    • Workflow does not contain permissions (YAML)

February 17, 2026

• New feature in Mobb CLI: Added scan-skill command to provide security scanning for agentic coding skills before installation and after deployment. Protects against malicious skills that could perform credential theft, persistence, or remote payload execution. Learn more

• New REST API endpoint: Added /api/rest/fp-summary endpoint to retrieve concise false positive descriptions (up to 280 characters) for issues. View API Documentation

February 13, 2026

• New REST API endpoint: Added /api/rest/active-reports endpoint to retrieve all active fix reports with finished state. View API Documentation

• Age of Fixable Issue: Added age tracking for fixable issues to help with SLA tracking and prioritization. Learn more

February 9, 2026

• New fixes released:

  • CodeQL

    • Code Injection (YAML)

    • Code Injection (YAML)

    • Unpinned tag for a non-immutable Action in workflow (YAML)

• New FP rules released:

  • Checkmarx

    • Log Forging (Java)

    • Stored Log Forging (Java)

    • Command Injection (JavaScript / TypeScript)

  • CodeQL

    • Log Injection (Java)

    • Uncontrolled command line (JavaScript / TypeScript)

    • Code Injection (YAML)

    • Code Injection (YAML)

  • Datadog

    • Command Injection (JavaScript / TypeScript)

  • Fortify

    • Log Forging (Java)

    • Log Forging (debug) (Java)

    • Command Injection (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • eslint.detect-child-process (JavaScript / TypeScript)

    • eslint.detect-eval-with-expression (JavaScript / TypeScript)

    • javascript.lang.security.detect-child-process.detect-child-process (JavaScript / TypeScript)

    • OS Command Injection (Express request to shell exec) (JavaScript / TypeScript)

    • njsscan.eval.eval_node.eval_nodejs (JavaScript / TypeScript)

    • nodejs_scan.javascript-eval-rule-eval_nodejs (JavaScript / TypeScript)

    • nodejs_scan.javascript-exec-rule-shelljs_os_command_exec (JavaScript / TypeScript)

    • nodejs_scan.javascript-exec-rule-shelljs_os_command_exec (JavaScript / TypeScript)

    • yaml.github-actions.security.run-shell-injection.run-shell-injection (YAML)

  • Snyk

    • Command Injection (JavaScript / TypeScript)

    • Indirect Command Injection via User Controlled Environment (JavaScript / TypeScript)

  • SonarQube

    • Logging should not be vulnerable to injection attacks (Java)

    • Dynamic code execution should not be vulnerable to injection attacks (JavaScript / TypeScript)

    • OS commands should not be vulnerable to command injection attacks (JavaScript / TypeScript)

    • Using shell interpreter when executing OS commands is security-sensitive (JavaScript / TypeScript)

January 7, 2025

• Tracy Time Machine: Tracy Time Machine is a feature of the Mobb Tracy extension (for VS Code and Cursor) that allows you to travel back in time to review the AI conversation history for specific lines of code, and continue the conversation while preserving the previous context. Click here to learn more.

• New FP rules released:

  • Checkmarx

    • Use Of Broken Or Risky Cryptographic Algorithm (C#)

    • Client DOM Open Redirect (JavaScript / TypeScript)

    • Open Redirect (JavaScript / TypeScript)

  • CodeQL

    • Client-side URL redirect (JavaScript / TypeScript)

    • Server-side URL redirect (JavaScript / TypeScript)

  • Fortify

    • Open Redirect (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • express.security.audit.express-open-redirect.express-open-redirect (JavaScript / TypeScript)

    • express.security.audit.possible-user-input-redirect.unknown-value-in-redirect (JavaScript / TypeScript)

    • javascript-redirect-rule-express_open_redirect (JavaScript / TypeScript)

    • javascript-redirect-rule-express_open_redirect (JavaScript / TypeScript)

    • javascript-redirect-rule-express_open_redirect2 (JavaScript / TypeScript)

    • nodejs_scan.javascript-redirect-rule-express_open_redirect (JavaScript / TypeScript)

    • nodejs_scan.javascript-redirect-rule-express_open_redirect2 (JavaScript / TypeScript)

  • Snyk

    • Open Redirect (JavaScript / TypeScript)

  • SonarQube

    • DOM updates should not lead to open redirect vulnerabilities (JavaScript / TypeScript)

    • HTTP request redirections should not be open to forging attacks (JavaScript / TypeScript)

December 19, 2025

• Fix Side Panel: We have added a new side panel to significantly enhance usability when reviewing fixes. This feature is especially helpful for bulk commits. Click here to learn more.

• New fixes released:

  • Checkmarx

    • Dynamic SQL Queries (C#)

    • Command Injection (GO)

    • SQL Injection (GO)

    • Second Order SQL Injection (GO)

    • Client DOM Code Injection (JavaScript / TypeScript)

    • Information Exposure Through an Error Message (JavaScript / TypeScript)

    • Command Argument Injection (Python)

  • CodeQL

    • SQL Injection (C#)

    • Command Injection (GO)

    • SQL Injection (GO)

    • Information exposure through a stack trace (JavaScript / TypeScript)

    • Reflected cross-site scripting (JavaScript / TypeScript)

    • Uncontrolled command line (JavaScript / TypeScript)

    • Untrusted data passed to external API (JavaScript / TypeScript)

  • Datadog

    • SQL Injection (GO)

    • Command Injection (JavaScript / TypeScript)

    • Path traversal (JavaScript / TypeScript)

    • SQL Injection (JavaScript / TypeScript)

    • Path Traversal (Python)

  • Semgrep/Opengrep

    • lang.security.audit.database.string-formatted-query (GO)

    • lang.security.injection.tainted-sql-string (GO)

    • lang.security.audit.command-injection-process-builder (Java)

    • lang.security.audit.command-injection-process-builder.command-injection-process-builder (Java)

    • SSRF (JavaScript / TypeScript)

    • eslint.detect-eval-with-expression (JavaScript / TypeScript)

    • express.security.audit.xss.direct-response-write (JavaScript / TypeScript)

    • express.security.audit.xss.direct-response-write.direct-response-write (JavaScript / TypeScript)

    • express.security.injection.tainted-sql-string (JavaScript / TypeScript)

    • express.security.injection.tainted-sql-string.tainted-sql-string (JavaScript / TypeScript)

    • generic.secrets.gitleaks.generic-api-key (JavaScript / TypeScript)

    • generic.secrets.gitleaks.generic-api-key.generic-api-key (JavaScript / TypeScript)

    • njsscan.eval.eval_node.eval_nodejs (JavaScript / TypeScript)

    • njsscan.traversal.path_traversal.generic_path_traversal (JavaScript / TypeScript)

    • njsscan.xss.xss_node.express_xss (JavaScript / TypeScript)

    • nodejs_scan.javascript-eval-rule-eval_nodejs (JavaScript / TypeScript)

    • secrets.gitleaks.generic-api-key (JavaScript / TypeScript)

    • secrets.gitleaks.generic-api-key.generic-api-key (JavaScript / TypeScript)

    • django.security.injection.path-traversal.path-traversal-open (Python)

    • django.security.injection.path-traversal.path-traversal-open.path-traversal-open (Python)

    • flask.security.injection.path-traversal-open (Python)

    • flask.security.injection.path-traversal-open.path-traversal-open (Python)

    • flask.security.injection.subprocess-injection (Python)

    • lang.security.dangerous-subprocess-use (Python)

  • Snyk

    • Command Injection (GO)

    • Cross-site Scripting (XSS) (GO)

    • SQL Injection (GO)

  • SonarQube

    • Formatting SQL queries is security-sensitive (C#)

    • Constructing arguments of system commands from user input is security-sensitive (GO)

    • Database queries should not be vulnerable to injection attacks (GO)

    • Formatting SQL queries is security-sensitive (GO)

    • Dynamic code execution should not be vulnerable to injection attacks (JavaScript / TypeScript)

    • Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks (JavaScript / TypeScript)

    • OS commands should not be vulnerable to command injection attacks (JavaScript / TypeScript)

    • Server-side requests should not be vulnerable to forging attacks (JavaScript / TypeScript)

    • Using shell interpreter when executing OS commands is security-sensitive (JavaScript / TypeScript)

    • Constructing arguments of system commands from user input is security-sensitive (Python)

    • Disabling CSRF protections is security-sensitive (Python)

    • Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks (Python)

    • I/O function calls should not be vulnerable to path injection attacks (Python)

• New FP rules released:

  • Checkmarx

    • Dynamic SQL Queries (C#)

    • Command Injection (GO)

    • SQL Injection (GO)

    • Second Order SQL Injection (GO)

    • Client DOM Code Injection (JavaScript / TypeScript)

    • Command Argument Injection (Python)

  • CodeQL

    • Hard-coded Connection String Credentials (C#)

    • Hard-coded credentials (C#)

    • SQL Injection (C#)

    • Command Injection (GO)

    • SQL Injection (GO)

    • Reflected cross-site scripting (JavaScript / TypeScript)

    • Untrusted data passed to external API (JavaScript / TypeScript)

  • Datadog

    • SQL Injection (GO)

    • Path traversal (JavaScript / TypeScript)

    • SQL Injection (JavaScript / TypeScript)

    • Insecure hash functions (Python)

  • Fortify

    • Weak Cryptographic Hash (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • generic.secrets.gitleaks.generic-api-key.generic-api-key (C#)

    • lang.security.audit.database.string-formatted-query (GO)

    • lang.security.injection.tainted-sql-string (GO)

    • secrets.gitleaks.generic-api-key (GO)

    • find_sec_bugs.DMI_CONSTANT_DB_PASSWORD-1.HARD_CODE_PASSWORD-3 (Java)

    • find_sec_bugs.HARD_CODE_KEY-4 (Java)

    • find_sec_bugs.HARD_CODE_PASSWORD-1 (Java)

    • mobsfscan.crypto.weak_hashes.weak_hash (Java)

    • SSRF (JavaScript / TypeScript)

    • express.security.audit.xss.direct-response-write (JavaScript / TypeScript)

    • express.security.audit.xss.direct-response-write.direct-response-write (JavaScript / TypeScript)

    • express.security.injection.tainted-sql-string (JavaScript / TypeScript)

    • express.security.injection.tainted-sql-string.tainted-sql-string (JavaScript / TypeScript)

    • generic.secrets.gitleaks.generic-api-key (JavaScript / TypeScript)

    • generic.secrets.gitleaks.generic-api-key.generic-api-key (JavaScript / TypeScript)

    • njsscan.crypto.crypto_node.node_md5 (JavaScript / TypeScript)

    • njsscan.traversal.path_traversal.generic_path_traversal (JavaScript / TypeScript)

    • njsscan.xss.xss_node.express_xss (JavaScript / TypeScript)

    • secrets.gitleaks.generic-api-key (JavaScript / TypeScript)

    • secrets.gitleaks.generic-api-key.generic-api-key (JavaScript / TypeScript)

    • flask.security.injection.subprocess-injection (Python)

    • generic.secrets.gitleaks.generic-api-key (Python)

    • generic.secrets.gitleaks.generic-api-key.generic-api-key (Python)

    • lang.security.dangerous-subprocess-use (Python)

    • secrets.gitleaks.generic-api-key (Python)

    • secrets.gitleaks.generic-api-key.generic-api-key (Python)

  • Snyk

    • Command Injection (GO)

    • Cross-site Scripting (XSS) (GO)

    • SQL Injection (GO)

  • SonarQube

    • Dropbox app credentials should not be disclosed (C#)

    • Formatting SQL queries is security-sensitive (C#)

    • Hard-coded secrets are security-sensitive (C#)

    • Using weak hashing algorithms is security-sensitive (C#)

    • Constructing arguments of system commands from user input is security-sensitive (GO)

    • Database queries should not be vulnerable to injection attacks (GO)

    • Formatting SQL queries is security-sensitive (GO)

    • Using weak hashing algorithms is security-sensitive (GO)

    • Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks (JavaScript / TypeScript)

    • Server-side requests should not be vulnerable to forging attacks (JavaScript / TypeScript)

    • Constructing arguments of system commands from user input is security-sensitive (Python)

    • Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks (Python)

December 9, 2025

• Fix Confidence in REST API: You can now access the fix confidence score (Stable vs Adaptive) directly via the API. Click here to learn more. API documentation: GET fix-reports/{fixReportId}.

• Fix Ratings in REST API: Retrieve user feedback and fix ratings (Vote Score, Comments, Tags) programmatically. Click here to learn more. API documentation: GET fix-reports/{fixReportId}.

• New Fix Report Summary in REST API: A new endpoint is available to retrieve statistics for a specific fix report, including counts of fixable and irrelevant issues. API documentation: GET fix-reports/{fixReportId}/stats.

December 8, 2025

• Branch Prefix for Pull Requests: When submitting fixes as a Pull Request, you can now specify an optional branch prefix to follow your team's branch naming conventions (e.g., feature, fix, patch). The prefix will be prepended to the branch name in the format {prefix}/{branch-name}. Click here to learn more.

• New fixes released:

  • Semgrep/Opengrep

    • SSRF - node_ssrf (JavaScript / TypeScript)

    • SSRF - phantom_ssrf (JavaScript / TypeScript)

    • SSRF - playwright_ssrf (JavaScript / TypeScript)

    • SSRF - puppeteer_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltoimage_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltopdf_ssrf (JavaScript / TypeScript)

    • javascript-database-rule-node_knex_sqli_injection (JavaScript / TypeScript)

    • javascript-database-rule-node_nosqli_injection (JavaScript / TypeScript)

    • javascript-database-rule-node_nosqli_js_injection (JavaScript / TypeScript)

    • javascript-database-rule-node_sqli_injection (JavaScript / TypeScript)

    • javascript-jwt-rule-jwt_express_hardcoded (JavaScript / TypeScript)

    • javascript-redirect-rule-express_open_redirect (JavaScript / TypeScript)

    • javascript-redirect-rule-express_open_redirect2 (JavaScript / TypeScript)

    • javascript-xss-rule-express_xss (JavaScript / TypeScript)

    • nodejs_scan.javascript-crypto-rule-node_insecure_random_generator (JavaScript / TypeScript)

    • nodejs_scan.javascript-exec-rule-shelljs_os_command_exec (JavaScript / TypeScript)

    • nodejs_scan.javascript-xss-rule-express_xss (JavaScript / TypeScript)

    • pt using rendering templates (JavaScript / TypeScript)

    • pt using rendering templates (JavaScript / TypeScript)

• New FP rules released:

  • Checkmarx

    • SSRF (JavaScript / TypeScript)

  • CodeQL

    • Server-side request forgery (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • SSRF - node_ssrf (JavaScript / TypeScript)

    • SSRF - phantom_ssrf (JavaScript / TypeScript)

    • SSRF - playwright_ssrf (JavaScript / TypeScript)

    • SSRF - puppeteer_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltoimage_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltopdf_ssrf (JavaScript / TypeScript)

    • SSRF - node_ssrf (JavaScript / TypeScript)

    • SSRF - phantom_ssrf (JavaScript / TypeScript)

    • SSRF - playwright_ssrf (JavaScript / TypeScript)

    • SSRF - puppeteer_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltoimage_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltopdf_ssrf (JavaScript / TypeScript)

    • javascript-crypto-rule-node_md5 (JavaScript / TypeScript)

    • javascript-crypto-rule-node_sha1 (JavaScript / TypeScript)

    • javascript-database-rule-node_knex_sqli_injection (JavaScript / TypeScript)

    • javascript-database-rule-node_nosqli_injection (JavaScript / TypeScript)

    • javascript-database-rule-node_nosqli_js_injection (JavaScript / TypeScript)

    • javascript-database-rule-node_sqli_injection (JavaScript / TypeScript)

    • javascript-jwt-rule-jwt_express_hardcoded (JavaScript / TypeScript)

    • javascript-xss-rule-express_xss (JavaScript / TypeScript)

    • nodejs_scan.javascript-xss-rule-express_xss (JavaScript / TypeScript)

    • pt using rendering templates (JavaScript / TypeScript)

    • pt using rendering templates (JavaScript / TypeScript)

    • python.lang.security.insecure-hash-algorithm-md5 (Python)

  • Snyk

    • Server-Side Request Forgery (SSRF) (JavaScript / TypeScript)

December 2, 2025

• Explain Fix Feature Released: We've added a new "Explain Fix" button to individual fixes in the fix report that provides AI-powered explanations of how and why each security fix was implemented. This feature helps developers understand the security reasoning behind fixes, learn secure coding patterns, and make informed decisions about remediation strategies. Learn more about working with fix explanations.

• New Tracy Integration Guides: Added comprehensive guides for integrating Mobb Tracy with popular AI coding assistants. These guides provide step-by-step instructions for setting up Tracy to monitor AI-generated code in your development workflow:

  • Tracy with VS Code + GitHub Copilot - Complete setup guide for monitoring GitHub Copilot code generation

  • Tracy with Claude Code - Integration guide for tracking Claude-generated code contributions

November 14, 2025

• Mobb Tracy Released: Introducing Tracy, our AI code intelligence platform that provides line-level visibility into AI-generated code in pull requests. Tracy shows exactly which lines were written by AI, which model was used, and what prompts created them - enabling smarter code reviews and better AI development practices. Learn more about Tracy.

• New fixes released:

  • Semgrep/Opengrep

    • find_sec_bugs.FILE_UPLOAD_FILENAME-1 (Java)

    • find_sec_bugs.HTTPONLY_COOKIE-1 (Java)

    • find_sec_bugs.INSECURE_COOKIE-1 (Java)

    • find_sec_bugs.PATH_TRAVERSAL_OUT-1.PATH_TRAVERSAL_OUT-1 (Java)

    • find_sec_bugs.PREDICTABLE_RANDOM-1 (Java)

    • find_sec_bugs.PT_ABSOLUTE_PATH_TRAVERSAL-1 (Java)

    • find_sec_bugs.PT_RELATIVE_PATH_TRAVERSAL-1 (Java)

    • find_sec_bugs.UNVALIDATED_REDIRECT-1.URL_REWRITING-1 (Java)

    • find_sec_bugs.WEAK_FILENAMEUTILS-1 (Java)

    • gitlab.find_sec_bugs.CUSTOM_INJECTION-1 (Java)

    • SSRF - phantom_ssrf (JavaScript / TypeScript)

    • SSRF - playwright_ssrf (JavaScript / TypeScript)

    • SSRF - puppeteer_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltoimage_ssrf (JavaScript / TypeScript)

    • SSRF - wkhtmltopdf_ssrf (JavaScript / TypeScript)

    • eslint.detect-child-process (JavaScript / TypeScript)

    • eslint.detect-pseudoRandomBytes (JavaScript / TypeScript)

    • eslint.react-dangerouslysetinnerhtml (JavaScript / TypeScript)

    • express.security.audit.express-open-redirect.express-open-redirect (JavaScript / TypeScript)

    • express.security.audit.possible-user-input-redirect.unknown-value-in-redirect (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_knex_sqli_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_nosqli_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_nosqli_js_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_sqli_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-exec-rule-shelljs_os_command_exec (JavaScript / TypeScript)

    • nodejs_scan.javascript-jwt-rule-hardcoded_jwt_secret (JavaScript / TypeScript)

    • nodejs_scan.javascript-jwt-rule-jwt_express_hardcoded (JavaScript / TypeScript)

    • nodejs_scan.javascript-redirect-rule-express_open_redirect (JavaScript / TypeScript)

    • nodejs_scan.javascript-redirect-rule-express_open_redirect2 (JavaScript / TypeScript)

    • pt using rendering templates - express_lfr (JavaScript / TypeScript)

    • pt using rendering templates - express_lfr_warning (JavaScript / TypeScript)

    • B604: subprocess_popen_with_shell_equals_true (Python)

    • Possible cmdi attack (Python)

    • The application may be vulnerable to a path traversal if it extracts untrusted archive files. (Python)

    • The application was found calling the exec function with a non-literal variable (Python)

    • XSS (Python)

    • possible os cmdi - bandit.B605 (Python)

    • possible os cmdi - bandit.B606 (Python)

    • possible os cmdi - bandit.B607 (Python)

    • possible os cmdi - start-process-partial-path (Python)

    • possible os cmdi - start-process-path (Python)

    • possible os cmdi - subprocess-call-array (Python)

    • sqli - bandit.B608 (Python)

    • sqli - bandit.B610 (Python)

    • sqli - bandit.B611 (Python)

    • sqli - bandit.B611-2 (Python)

    • sqli - bandit.B612 (Python)

    • sqli - db-cursor-execute (Python)

  • SonarQube

    • S6471 Running containers as a privileged user is security-sensitive (DOCKERFILE)

• New FP rules released:

  • Semgrep/Opengrep

    • find_sec_bugs.DES_USAGE-1 (Java)

    • find_sec_bugs.FILE_UPLOAD_FILENAME-1 (Java)

    • find_sec_bugs.PATH_TRAVERSAL_OUT-1.PATH_TRAVERSAL_OUT-1 (Java)

    • find_sec_bugs.PT_ABSOLUTE_PATH_TRAVERSAL-1 (Java)

    • find_sec_bugs.PT_RELATIVE_PATH_TRAVERSAL-1 (Java)

    • find_sec_bugs.UNVALIDATED_REDIRECT-1.URL_REWRITING-1 (Java)

    • find_sec_bugs.WEAK_FILENAMEUTILS-1 (Java)

    • find_sec_bugs.WEAK_MESSAGE_DIGEST_MD5-1.WEAK_MESSAGE_DIGEST_SHA1-1 (Java)

    • gitlab.find_sec_bugs.CUSTOM_INJECTION-1 (Java)

    • eslint.react-dangerouslysetinnerhtml (JavaScript / TypeScript)

    • nodejs_scan.javascript-crypto-rule-node_md5 (JavaScript / TypeScript)

    • nodejs_scan.javascript-crypto-rule-node_sha1 (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_knex_sqli_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_nosqli_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_nosqli_js_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-database-rule-node_sqli_injection (JavaScript / TypeScript)

    • nodejs_scan.javascript-jwt-rule-hardcoded_jwt_secret (JavaScript / TypeScript)

    • nodejs_scan.javascript-jwt-rule-jwt_express_hardcoded (JavaScript / TypeScript)

    • pt using rendering templates - express_lfr (JavaScript / TypeScript)

    • pt using rendering templates - express_lfr_warning (JavaScript / TypeScript)

    • B604: subprocess_popen_with_shell_equals_true (Python)

    • Possible cmdi attack (Python)

    • The application may be vulnerable to a path traversal if it extracts untrusted archive files. (Python)

    • The application was found calling the exec function with a non-literal variable (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-1 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-2 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-3 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-4 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-5 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-6 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-7 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B303-8 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-1 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-10 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-11 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-12 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-2 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-3 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-4 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-5 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-6 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-7 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-8 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B304-9 (Python)

    • The application was found using an insecure or risky digest or signature algorithm - bandit.B324 (Python)

    • XSS (Python)

    • possible os cmdi - bandit.B605 (Python)

    • possible os cmdi - bandit.B606 (Python)

    • possible os cmdi - bandit.B607 (Python)

    • possible os cmdi - start-process-partial-path (Python)

    • possible os cmdi - start-process-path (Python)

    • possible os cmdi - subprocess-call-array (Python)

    • sqli - bandit.B608 (Python)

    • sqli - bandit.B610 (Python)

    • sqli - bandit.B611 (Python)

    • sqli - bandit.B611-2 (Python)

    • sqli - bandit.B612 (Python)

    • sqli - db-cursor-execute (Python)

  • SonarQube

    • S6471 Running containers as a privileged user is security-sensitive (DOCKERFILE)

November 4, 2025

• Claude Code Integration Guide Released: Published a comprehensive setup guide for integrating Mobb Vibe Shield (MVS) with Anthropic's Claude Code AI coding assistant. This integration enables developers to use Mobb's automated fixing capabilities directly within Claude Code through Model Context Protocol (MCP). View the complete setup guide.

October 28, 2025

• Gemini Code Assist Integration Now Available: Mobb Vibe Shield (MVS) now supports Google's Gemini Code Assist through Model Context Protocol (MCP) integration in VS Code. This integration brings Mobb's automated fixing capabilities directly into Gemini's agent mode, enabling developers to seamlessly incorporate security testing into their AI-assisted development workflow. View the complete setup guide.

• New fixes released:

  • CodeQL

    • Information exposure through an error message (Java)

    • DOM text reinterpreted as HTML (JavaScript / TypeScript)

• New FP rules released:

  • Checkmarx

    • Reflected XSS All Clients (Java)

    • Stored XSS (Java)

    • Absolute Path Traversal (JavaScript / TypeScript)

    • Client Password In Comment (JavaScript / TypeScript)

    • Relative Path Traversal (JavaScript / TypeScript)

    • Password in Comment (Python)

  • CodeQL

    • Cross-site scripting (Java)

    • Information exposure through an error message (Java)

    • DOM text reinterpreted as HTML (JavaScript / TypeScript)

    • Uncontrolled data used in path expression (JavaScript / TypeScript)

  • Fortify

    • Cross-Site Scripting: Reflected (Java)

    • Password Management: Password in Comment (JavaScript / TypeScript)

    • Path Manipulation (JavaScript / TypeScript)

    • Password Management: Password in Comment (Python)

    • Password Management: Password in Comment (XML)

  • Semgrep/Opengrep

    • Detected possible path traversal (JavaScript / TypeScript)

    • Detected possible path traversal (JavaScript / TypeScript)

    • Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. (JavaScript / TypeScript)

    • Possible writing outside of the destination, make sure that the target path is nested in the intended destination (JavaScript / TypeScript)

    • javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename (JavaScript / TypeScript)

  • Snyk

    • Cross-site Scripting (XSS) (Java)

    • Path Traversal (JavaScript / TypeScript)

  • SonarQube

    • Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks (Java)

    • I/O function calls should not be vulnerable to path injection attacks (JavaScript / TypeScript)

    • I/O function calls should not be vulnerable to path injection attacks (JavaScript / TypeScript)

October 22, 2025

• Enhanced Issues API v5 Released: Introduced GET Issues v5 REST API endpoint with significant enhancements over v4, including false positive support with fpDescription field and improved filtering capabilities with fixReportId parameter for more granular issue queries.

October 20, 2025

• Comprehensive Technical Brief Released: Published a complete technical overview designed as a single-source document for understanding Mobb's technology stack, architecture, and platform capabilities. Perfect for technical stakeholders, security teams, and anyone seeking a consolidated technical understanding of how Mobb works, covering everything from fix generation algorithms to deployment options. Read the full technical brief.

• New fixes released:

  • Semgrep/Opengrep

    • OS command injection (GO)

    • Path Traversal (Java)

    • Tainted File Path (Java)

    • Detected possible path traversal (JavaScript / TypeScript)

    • Detected possible path traversal (JavaScript / TypeScript)

    • SSRF (JavaScript / TypeScript)

    • ajinabraham.njsscan.crypto.crypto_node.node_insecure_random_generator (JavaScript / TypeScript)

    • eslint.detect-non-literal-regexp (JavaScript / TypeScript)

    • gitlab.nodejs_scan.javascript-crypto-rule-node_insecure_random_generator (JavaScript / TypeScript)

    • njsscan.dos.regex_dos.regex_dos (JavaScript / TypeScript)

    • njsscan.dos.regex_injection.regex_injection_dos (JavaScript / TypeScript)

    • nodejs_scan.javascript-dos-rule-regex_dos (JavaScript / TypeScript)

• New FP rules released:

  • Semgrep/Opengrep

    • OS command injection (GO)

    • Path Traversal (Java)

    • Tainted File Path (Java)

    • eslint.detect-non-literal-regexp (JavaScript / TypeScript)

    • njsscan.dos.regex_injection.regex_injection_dos (JavaScript / TypeScript)

October 10, 2025

• MVS Auto-Fix Mode: Introducing continuous automated security scanning and fixing! Enable Auto-Fix Mode in your IDE settings for silent background vulnerability detection and automatic remediation using OpenGrep + Mobb fixes. No more manual intervention needed - just code while Mobb keeps you secure! Learn more.

• New fixes released:

  • Semgrep/Opengrep

    • dgryski.semgrep-go.errnilcheck.err-nil-check (GO)

    • File Path Traversal in HttpServlet (Java)

    • Relative File Path Traversal in HttpServlet (Java)

    • SQL Injection (Java)

    • Server-Side-Request-Forgery (SSRF) (Java)

    • detect-non-literal-regexp (JavaScript / TypeScript)

    • eslint.detect-object-injection (JavaScript / TypeScript)

    • gitlab.eslint.detect-object-injection (JavaScript / TypeScript)

    • gitlab.nodejs_scan.javascript-crypto-rule-node_insecure_random_generator (JavaScript / TypeScript)

    • javascript-dos-rule-regex_dos (JavaScript / TypeScript)

    • javascript-redirect-rule-express_open_redirect (JavaScript / TypeScript)

    • javascript.browser.security.insecure-innerhtml.insecure-innerhtml (JavaScript / TypeScript)

    • njsscan.generic.hardcoded_secrets.node_password (JavaScript / TypeScript)

    • njsscan.generic.hardcoded_secrets.node_secret (JavaScript / TypeScript)

    • B113: request_without_timeout (Python)

    • B602: subprocess_popen_with_shell_equals_true (Python)

    • B603: subprocess_without_shell_equals_true (Python)

    • python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true (Python)

    • python_exec_rule-subprocess-call-array (Python)

• New FP rules released:

  • Semgrep/Opengrep

    • File Path Traversal in HttpServlet (Java)

    • Relative File Path Traversal in HttpServlet (Java)

    • SQL Injection (Java)

    • Server-Side-Request-Forgery (SSRF) (Java)

    • WEAK_MESSAGE_DIGEST_MD5-1.WEAK_MESSAGE_DIGEST_SHA1-1 (Java)

    • detect-non-literal-regexp (JavaScript / TypeScript)

    • javascript-dos-rule-regex_dos (JavaScript / TypeScript)

    • javascript.browser.security.insecure-innerhtml.insecure-innerhtml (JavaScript / TypeScript)

    • njsscan.generic.hardcoded_secrets.node_password (JavaScript / TypeScript)

    • njsscan.generic.hardcoded_secrets.node_secret (JavaScript / TypeScript)

    • B303-8 (Python)

    • B602: subprocess_popen_with_shell_equals_true (Python)

    • B603: subprocess_without_shell_equals_true (Python)

    • python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true (Python)

    • python_exec_rule-subprocess-call-array (Python)

September 26, 2025

• New fixes released:

  • Semgrep/Opengrep

    • java.mobb.custom_injection (Java)

    • lang.security.audit.dangerous-asyncio-create-exec-audit (Python)

    • An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. (YAML)

    • github-actions.security.third-party-action-not-pinned-to-commit-sha (YAML)

• New FP rules released:

  • Semgrep/Opengrep

    • java.mobb.custom_injection (Java)

    • lang.security.audit.dangerous-asyncio-create-exec-audit (Python)

September 19, 2025

• Organization-Level Activity Dashboard: Released a comprehensive organization-wide analytics dashboard providing aggregated metrics, fix coverage, and engagement statistics across all projects. Click here to learn more.

• Project-Level Activity Dashboard: Launched a dedicated project-specific dashboard offering detailed visibility into fix coverage, engagement metrics, and trends for individual projects. Click here to learn more.

• Devin.ai + Mobb Vibe Shield Integration Guide: Published a comprehensive setup guide for integrating Mobb Vibe Shield (MVS) with Devin.ai's autonomous AI coding platform. Click here to learn more.

• Tabnine + Mobb Vibe Shield Integration Guide: Released step-by-step documentation for integrating Mobb Vibe Shield (MVS) with Tabnine AI coding platform. Click here to learn more.

• New fixes released:

  • Semgrep/Opengrep

    • gitlab.find_sec_bugs.CUSTOM_INJECTION-2 (Java)

    • gitlab.find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1 (Java)

    • gitlab.find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1.SQL_INJECTION-1.SQL_INJECTION_HIBERNATE-1.SQL_INJECTION_VERTX-1.SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING-1 (Java)

    • java.lang.security.audit.formatted-sql-string.formatted-sql-string (Java)

    • java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli (Java)

    • java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request (Java)

    • javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename (JavaScript / TypeScript)

• New FP rules released:

  • Checkmarx

    • Log Forging (JavaScript / TypeScript)

  • CodeQL

    • Log injection (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • gitlab.find_sec_bugs.CUSTOM_INJECTION-2 (Java)

    • gitlab.find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1 (Java)

    • gitlab.find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1.SQL_INJECTION-1.SQL_INJECTION_HIBERNATE-1.SQL_INJECTION_VERTX-1.SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING-1 (Java)

    • java.lang.security.audit.formatted-sql-string.formatted-sql-string (Java)

    • java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli (Java)

    • java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request (Java)

    • javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring (JavaScript / TypeScript)

    • javascript.mobb.log_forging (JavaScript / TypeScript)

    • python.lang.security.insecure-hash-algorithm-md5 (Python)

September 12, 2025

• Released a new setup guide for Mobb Vibe Shield on GitLab Duo (Click here to learn more)

• Released a new REST API endpoint for GET Project Dashboard Activity

• Released enhanced GET Fix-Report v2 REST API, adding enhanced pagination features, thus allowing querying large result sets.

• New fixes released:

  • Fortify

    • Cross-Site Request Forgery (Java)

    • HTML5: Missing Content Security Policy (Java)

    • SQL Injection: Persistence (Java)

    • Spring Security Misconfiguration: Default Permit (Java)

  • Semgrep/Opengrep

    • javascript.lang.correctness.missing-template-string-indicator.missing-template-string-indicator (JavaScript / TypeScript)

    • bandit.B101 (Python)

    • lang.correctness.return-in-init.return-in-init (Python)

    • lang.maintainability.is-function-without-parentheses.is-function-without-parentheses (Python)

    • lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit (Python)

    • python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit (Python)

• New FP rules released:

  • Fortify

    • Cross-Site Request Forgery (Java)

    • HTML5: Missing Content Security Policy (Java)

    • SQL Injection: Persistence (Java)

    • Spring Security Misconfiguration: Default Permit (Java)

  • Semgrep/Opengrep

    • javascript.lang.correctness.missing-template-string-indicator.missing-template-string-indicator (JavaScript / TypeScript)

    • lang.correctness.return-in-init.return-in-init (Python)

    • lang.maintainability.is-function-without-parentheses.is-function-without-parentheses (Python)

    • lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit (Python)

    • python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit (Python)

September 2, 2025

• New fixes released:

  • Fortify

    • Mass Assignment: Request Parameters Bound via Input Formatter (C#)

    • Denial of Service (Java)

    • Dynamic Code Evaluation: Code Injection (Python)

  • Semgrep/Opengrep

    • OS command injection (C#)

    • typescript.lang.correctness.useless-ternary.useless-ternary (JavaScript / TypeScript)

    • bandit.B201 (Python)

    • bandit.B307 (Python)

    • django.security.injection.code.user-eval-format-string.user-eval-format-string (Python)

    • django.security.injection.code.user-eval.user-eval (Python)

    • flask.security.injection.user-eval.eval-injection (Python)

    • gitlab.bandit.B113 (Python)

    • lang.security.audit.eval-detected.eval-detected (Python)

    • python.lang.correctness.exit.use-sys-exit (Python)

    • python.lang.maintainability.useless-ifelse.useless-if-body (Python)

    • python.requests.best-practice.use-raise-for-status.use-raise-for-status (Python)

    • python.requests.best-practice.use-timeout.use-timeout (Python)

• New FP rules released:

  • Fortify

    • Mass Assignment: Request Parameters Bound via Input Formatter (C#)

    • Password Management: Password in Comment (C#)

    • Denial of Service (Java)

    • Dynamic Code Evaluation: Code Injection (Python)

  • Semgrep/Opengrep

    • OS command injection (C#)

    • secrets.gitleaks.jwt.jwt (DEFAULT)

    • bandit.B307 (Python)

    • django.security.injection.code.user-eval-format-string.user-eval-format-string (Python)

    • django.security.injection.code.user-eval.user-eval (Python)

    • flask.security.injection.user-eval.eval-injection (Python)

    • lang.security.audit.eval-detected.eval-detected (Python)

    • sqlalchemy.correctness.delete-where.delete-where-no-execute (Python)

    • secrets.gitleaks.generic-api-key.generic-api-key (YAML)

    • secrets.security.detected-generic-api-key.detected-generic-api-key (YAML)

August 28, 2025

• Safe Vibe Codes Security Scanner Released: Launched Safe Vibe Codes - a specialized security scanner designed to identify and address security vulnerabilities in AI-generated code applications. Currently supports Bolt.new, Lovable, Base44 and V0 by Vercel platforms.

• Ticket ID in Pull Request Title: Added support for embedding ticket IDs (e.g., Jira or Linear issue numbers) directly into pull request titles, descriptions, and commit messages, ensuring compliance with internal development workflows that require PR-ticket linkage for both single and bulk fix operations. Click here to learn more.

• Added User Last Activity Tracking: Mobb now tracks user last activity dates via the REST API endpoint GET /api/rest/users/{userId}, enabling administrators to identify inactive accounts. Click here to try it out.

• Added Enhanced Issues API v4: Introduced a new optimized GET /api/rest/v4/issues endpoint with improved pagination performance for retrieving vulnerability issues and their associated fixes across all analyses. Click here to try it out.

• Enhanced Issue State Management: GET issue details (GET /api/rest/issues/{issueId}) responses now include a new FalsePositive state in the vulnerability report issue state enumeration, providing better categorization and filtering capabilities for security findings that have been identified as false positives. Click here to try it out.

• ArmorCode Integration is now Active: Mobb is now integrated with ArmorCode's application security orchestration platform, enabling seamless vulnerability management and automated fix workflows within ArmorCode's unified security dashboard. Reach out to us to get started with this integration.

• Enhanced Mobb Vibe Shield Background Scanning: Mobb Vibe Shield now performs periodic security scans automatically in the background without interrupting developer workflow, providing continuous security monitoring and fixes directly within your IDE environment. Click here to learn more.

• Microsoft Entra ID SSO Integration Guide Published: Released documentation for configuring SAML-based SSO with Microsoft Entra ID. Click here to learn more.

• Mobb On-Premise Support: Mobb now supports on-premise deployment (private AWS cloud), enabling organizations to run Mobb within their own private cloud infrastructure.

• New fixes released:

  • Fortify

    • Mass Assignment: Request Parameters Bound via Input Formatter (C#)

    • Mass Assignment: Insecure Binder Configuration (Java)

  • Semgrep/Opengrep

    • typescript.lang.correctness.useless-ternary.useless-ternary (JavaScript / TypeScript)

    • yaml.docker-compose.security.no-new-privileges.no-new-privileges (YAML)

    • Service has a writable filesystem (YAML)

    • Service port is exposed on all interfaces (YAML)

• New FP rules released:

  • Checkmarx

    • Privacy Violation (Java)

    • SQL Injection (Java)

    • SQL Injection Evasion Attack (Java)

  • CodeQL

    • Query built by concatenation with a possibly-untrusted string (Java)

    • Query built from user-controlled sources (Java)

  • Fortify

    • Mass Assignment: Request Parameters Bound via Input Formatter (C#)

    • Header Manipulation (Java)

    • Mass Assignment: Insecure Binder Configuration (Java)

    • Privacy Violation (Java)

    • SQL Injection (Java)

  • Semgrep/Opengrep

    • lang.security.audit.sqli.jdbc-sqli.jdbc-sqli (Java)

    • lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request (Java)

    • yaml.docker-compose.security.no-new-privileges.no-new-privileges (YAML)

    • Service has a writable filesystem (YAML)

    • Service port is exposed on all interfaces (YAML)

  • Snyk

    • SQL Injection (Java)

  • SonarQube

    • Database queries should not be vulnerable to injection attacks (Java)

August 8th, 2025

• Enhanced SAST File Processing Performance in Mobb UI: The SAST file upload and processing workflow has been significantly optimized to improve user experience. Users can now proceed to the next configuration step immediately after the file upload completes, while vulnerability report processing now occurs asynchronously in the background. This enhancement eliminates the previous wait time needed for uploading large SAST report files.

• Resolved Issue Classification Bug: Resolved an issue where vulnerability findings were being incorrectly classified as "Filtered" in the Irrelevant Issues section. The system now correctly applies filtering policies, ensuring that only the user or admin defined issue types are classified as filtered. This fix prevents the misclassification of other vulnerability types, providing more accurate analysis results and better visibility into actionable security findings.

• New fixes released:

  • Semgrep/Opengrep

    • security_code_scan.SCS0001-1 (C#)

    • Use of cryptographically weak Pseudo-Random Number Generator (PRNG) (C#)

    • csharp/lang.best-practice.structured-logging.structured-logging (C#)

    • lang.security.sqli.csharp-sqli.csharp-sqli (C#)

    • security_code_scan.SCS0002-1 (C#)

    • typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml (JavaScript / TypeScript)

    • A missing encoding argument in open() can lead corrupted data (Python)

    • python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup (Python)

• New FP rules released:

  • Checkmarx

    • SQL Injection (C#)

    • Use of Insufficiently Random Values (C#)

  • CodeQL

    • Insecure randomness (C#)

  • Fortify

    • Insecure Randomness (C#)

    • Insecure Randomness: Hardcoded Seed (C#)

    • SQL Injection (C#)

  • Semgrep/Opengrep

    • security_code_scan.SCS0001-1 (C#)

    • Use of cryptographically weak Pseudo-Random Number Generator (PRNG) (C#)

    • csharp/lang.best-practice.structured-logging.structured-logging (C#)

    • lang.security.sqli.csharp-sqli.csharp-sqli (C#)

    • security_code_scan.SCS0002-1 (C#)

    • typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml (JavaScript / TypeScript)

    • A missing encoding argument in open() can lead corrupted data (Python)

    • python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup (Python)

  • Snyk

    • SQL Injection (C#)

    • Use of Insufficiently Random Values (C#)

  • SonarQube

    • Secure random number generators should not output predictable values (C#)

July 30, 2025

• Introducing Adaptive Fixes: Our AI-generated fixes have significantly matured and evolved beyond their previous "Beta" status. These fixes are now classified as "Adaptive" as they intelligently adapt to your specific coding patterns and style, providing more contextually appropriate solutions that seamlessly integrate with your existing codebase. Click here to learn more.

• New fixes released:

  • Semgrep/Opengrep

    • security.missing-user-entrypoint.missing-user-entrypoint (DOCKERFILE)

    • security.missing-user.missing-user (DOCKERFILE)

    • lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal (JavaScript / TypeScript)

    • express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal (JavaScript / TypeScript)

    • browser.security.eval-detected.eval-detected (JavaScript / TypeScript)

    • javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration (JavaScript / TypeScript)

    • javascript.lang.security.detect-child-process.detect-child-process (JavaScript / TypeScript)

    • javascript.mobb.log_forging (JavaScript / TypeScript)

    • lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure (Python)

    • python.django.security.audit.avoid-mark-safe.avoid-mark-safe (Python)

    • python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2 (Python)

    • python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled (Python)

• New FP rules released:

  • Checkmarx

    • Client DOM Stored XSS (JavaScript / TypeScript)

    • Client DOM XSS (JavaScript / TypeScript)

    • Client Potential XSS (JavaScript / TypeScript)

    • Stored XSS (JavaScript / TypeScript)

    • XSS (Python)

  • CodeQL

    • Client-side cross-site scripting (JavaScript / TypeScript)

    • Reflected cross-site scripting (JavaScript / TypeScript)

    • Jinja2 templating with autoescape=False (Python)

    • XSS (Python)

  • Fortify

    • Cross-Site Scripting: DOM (JavaScript / TypeScript)

    • Cross-Site Scripting: Self (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash (C#)

    • security.missing-user-entrypoint.missing-user-entrypoint (DOCKERFILE)

    • security.missing-user.missing-user (DOCKERFILE)

    • browser.security.eval-detected.eval-detected (JavaScript / TypeScript)

    • browser.security.insecure-document-method.insecure-document-method (JavaScript / TypeScript)

    • javascript.browser.security.raw-html-concat.raw-html-concat (JavaScript / TypeScript)

    • javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration (JavaScript / TypeScript)

    • javascript.crypto-js.cryptojs-weak-algorithm.cryptojs-weak-algorithm (JavaScript / TypeScript)

    • javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape (JavaScript / TypeScript)

    • javascript.express.security.injection.raw-html-format.raw-html-format (JavaScript / TypeScript)

    • javascript.jquery.security.audit.jquery-insecure-selector.jquery-insecure-selector (JavaScript / TypeScript)

    • javascript.jssha.jssha-sha1.jssha-sha1 (JavaScript / TypeScript)

    • javascript.node-stdlib.cryptography.crypto-weak-algorithm.crypto-weak-algorithm (JavaScript / TypeScript)

    • react.security.audit.react-unsanitized-method.react-unsanitized-method (JavaScript / TypeScript)

    • jwt.security.jwt-hardcode.jwt-python-hardcoded-secret (Python)

    • lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure (Python)

    • pyjwt.python-pyjwt-hardcoded-secret.python-pyjwt-hardcoded-secret (Python)

    • python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 (Python)

    • python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 (Python)

    • python.django.security.audit.avoid-mark-safe.avoid-mark-safe (Python)

    • python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2 (Python)

    • python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled (Python)

    • python.lang.security.audit.sha224-hash.sha224-hash (Python)

    • python.lang.security.insecure-hash-function.insecure-hash-function (Python)

    • python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 (Python)

    • python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 (Python)

    • python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 (Python)

    • python.pycryptodome.security.insecure-hash-algorithm-sha1.insecure-hash-algorithm-sha1 (Python)

  • Snyk

    • Cross-site Scripting (XSS) (JavaScript / TypeScript)

    • Cross Site Scripting (XSS) (Python)

    • Jinja auto-escape is set to false (Python)

  • SonarQube

    • DOM updates should not lead to cross-site scripting (XSS) attacks (JavaScript / TypeScript)

    • DOM updates should not lead to cross-site scripting (XSS) attacks (JavaScript / TypeScript)

    • Disabling auto-escaping in template engines is security-sensitive (Python)

July 21, 2025

• Added integrations with Linear, you can now create fixes as linear tickets directly through Mobb. Click here to learn more.

• New fixes released:

  • Checkmarx

    • Reflected XSS (C#)

    • Code Injection (Python)

    • Stored Code Injection (Python)

    • Stored Command Argument Injection (Python)

  • CodeQL

    • No space for zero terminator (CPP)

    • Code injection (Python)

  • Datadog

    • no-exec (Python)

  • Fortify

    • Cross-Site Scripting: Persistent (C#)

    • Open Redirect (C#)

    • Buffer Overflow (CPP)

    • String Termination Error (CPP)

    • HTTP Parameter Pollution (Java)

  • Semgrep/Opengrep

    • java/mobb.pt_find_transitives (Java)

    • javascript.lang.security.detect-child-process.detect-child-process (JavaScript / TypeScript)

    • browser.security.insecure-document-method.insecure-document-method (JavaScript / TypeScript)

    • https://semgrep.dev/r?q=javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization (JavaScript / TypeScript)

    • javascript.browser.security.raw-html-concat.raw-html-concat (JavaScript / TypeScript)

    • javascript.express.security.injection.raw-html-format.raw-html-format (JavaScript / TypeScript)

    • javascript.jquery.security.audit.jquery-insecure-selector.jquery-insecure-selector (JavaScript / TypeScript)

    • javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp (JavaScript / TypeScript)

    • javascript.mobb.system-information-leak-external (JavaScript / TypeScript)

    • react.security.audit.react-unsanitized-method.react-unsanitized-method (JavaScript / TypeScript)

    • django.security.injection.code.user-exec-format-string.user-exec-format-string (Python)

    • django.security.injection.code.user-exec.user-exec (Python)

    • flask.security.injection.user-exec.exec-injection (Python)

    • lang.security.audit.exec-detected.exec-detected (Python)

    • python.lang.security.audit.exec-detected.exec-detected (Python)

  • Snyk

    • Cross-site Scripting (XSS) (C#)

    • Code Injection (Python)

  • SonarQube

    • Logging templates should be constant (C#)

    • Accessing files should not lead to filesystem oracle attacks (Java)

    • Dynamic code execution should not be vulnerable to injection attacks (Python)

• New FP rules released:

  • Checkmarx

    • Reflected XSS (C#)

    • Reflected XSS All Clients (C#)

    • Stored XSS (C#)

    • Code Injection (Python)

    • Stored Code Injection (Python)

    • Stored Command Argument Injection (Python)

  • CodeQL

    • No space for zero terminator (CPP)

    • Code injection (Python)

  • Datadog

    • no-exec (Python)

  • Fortify

    • Cross-Site Scripting: Persistent (C#)

    • Open Redirect (C#)

    • Buffer Overflow (CPP)

    • String Termination Error (CPP)

    • HTTP Parameter Pollution (Java)

  • Semgrep/Opengrep

    • java/mobb.pt_find_transitives (Java)

    • https://semgrep.dev/r?q=javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization (JavaScript / TypeScript)

    • javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp (JavaScript / TypeScript)

    • django.security.injection.code.user-exec-format-string.user-exec-format-string (Python)

    • django.security.injection.code.user-exec.user-exec (Python)

    • flask.security.injection.user-exec.exec-injection (Python)

    • lang.security.audit.exec-detected.exec-detected (Python)

    • python.lang.security.audit.exec-detected.exec-detected (Python)

  • Snyk

    • Cross-site Scripting (XSS) (C#)

    • Code Injection (Python)

  • SonarQube

    • Accessing files should not lead to filesystem oracle attacks (Java)

    • Dynamic code execution should not be vulnerable to injection attacks (Python)

July 7, 2025

• Added new documentation page: MVS Setup guide for Cursor.

• Added a third mode in MVS called check_for_new_available_fixes, which continuously scans your project and checks for available fixes. Click here to learn more.

• New fixes released:

  • Semgrep/Opengrep

    • javascript.lang.security.audit.prototype-pollution-loop-mobb.prototype-pollution-loop-mobb (JavaScript / TypeScript)

    • javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop (JavaScript / TypeScript)

• New FP rules released:

  • Checkmarx

    • Path Traversal (C#)

  • CodeQL

    • Uncontrolled data used in path expression (C#)

  • Fortify

    • Path Manipulation (C#)

    • Path Manipulation: Base Path Overwriting (C#)

  • Snyk

    • Path Traversal (C#)

  • SonarQube

    • I/O function calls should not be vulnerable to path injection attacks (C#)

June 30, 2025

• Added new documentation page: MVS Setup guide for IntelliJ IDEA + Copilot.

• Published the CodeQL SARIF downloader utility.

• Mobb Vibe Shield has officially been added to the awesome-mcp-servers list.

• New fixes released:

  • Checkmarx

    • HttpOnly Cookie Flag Not Set (JavaScript / TypeScript)

  • Fortify

    • System Information Leak: External (C#)

  • SonarQube

    • Hard-coded passwords are security-sensitive (JavaScript / TypeScript)

    • Hard-coded passwords are security-sensitive (JavaScript / TypeScript)

    • Hard-coded secrets are security-sensitive (JavaScript / TypeScript)

    • Hard-coded secrets are security-sensitive (JavaScript / TypeScript)

• New FP rules released:

  • Checkmarx

    • Client Regex Injection (JavaScript / TypeScript)

    • HttpOnly Cookie Flag Not Set (JavaScript / TypeScript)

    • Missing HSTS Header (JavaScript / TypeScript)

  • CodeQL

    • Inefficient regular expression (JavaScript / TypeScript)

    • Regular expression injection (JavaScript / TypeScript)

  • Fortify

    • Credential Management: Hardcoded API Credentials (DEFAULT)

    • Key Management: Hardcoded Encryption Key (DEFAULT)

    • Password Management: Hardcoded Password (DEFAULT)

    • Password Management: Password in Configuration File (DEFAULT)

    • Password Management: Weak Cryptography (DEFAULT)

  • Snyk

    • Regular Expression Denial of Service (ReDoS) (JavaScript / TypeScript)

    • No Hardcoded Credentials Test (Python)

  • SonarQube

    • Hard-coded credentials are security-sensitive (GO)

    • Hard-coded passwords are security-sensitive (JavaScript / TypeScript)

    • Hard-coded passwords are security-sensitive (JavaScript / TypeScript)

    • Hard-coded secrets are security-sensitive (JavaScript / TypeScript)

    • Hard-coded secrets are security-sensitive (JavaScript / TypeScript)

    • Regular expressions should not be vulnerable to Denial of Service attacks (JavaScript / TypeScript)

    • Regular expressions should not be vulnerable to Denial of Service attacks (JavaScript / TypeScript)

June 22, 2025

• Added new documentation page for FP rules.

• Added new documentation page: MVS Setup guide for VS Code + GitHub Copilot

• Added new documentation page: MVS Setup guide for Visual Studio 2022 + GitHub Copilot

• Issues marked as "Suppressed" in Fortify will be recategorized into the "Irrelevant Issues" section in the fix report. Click here for more details.

• New fixes released:

  • Checkmarx

    • Hardcoded password in Connection String (JavaScript / TypeScript)

    • JWT Use Of Hardcoded Secret (JavaScript / TypeScript)

    • Secret_Leak (JavaScript / TypeScript)

    • Use Of Hardcoded Password (JavaScript / TypeScript)

  • CodeQL

    • Hard-coded credentials (JavaScript / TypeScript)

  • Fortify

    • Credential Management: Hardcoded API Credentials (JavaScript / TypeScript)

    • Key Management: Hardcoded Encryption Key (JavaScript / TypeScript)

    • Password Management: Hardcoded Password (JavaScript / TypeScript)

  • Semgrep/Opengrep

    • jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret (JavaScript / TypeScript)

  • Snyk

    • Use of Hardcoded Credentials (JavaScript / TypeScript)

  • SonarQube

    • Hard-coded credentials are security-sensitive (JavaScript / TypeScript)

    • Hard-coded credentials are security-sensitive (JavaScript / TypeScript)

    • Hard-coded passwords are security-sensitive (JavaScript / TypeScript)

    • Hard-coded secrets are security-sensitive (JavaScript / TypeScript)

June 13, 2025

• Released Mobb Vibe Shield (MVS) - Mobb Vibe Shield connects to your IDE (via the Mobb MCP Server + your AI-agent) and provides fixes directly in your source code. Click here to learn more.

• Added full description in PR generated through Mobb's Auto-PR feature.

• Added new REST API endpoint /reporting/project-aggregated for reporting on aggregated data on projects.

• Added convert-to-sarif mode in the Mobb CLI to better facilitate report processing capabilities of large reports (i.e. multiple repos in a single Fortify FPR report). Click here to learn more.

• Added support for Okta Single Sign-On (SSO) for organizations that wish to integrate with Mobb using Okta as their identity provider (IdP). Click here to learn more.

• Added support for --create-one-pr flag in Mobb CLI - When this flag is added (along with the --auto-pr flag), auto-pr will create one unified PR with all the available fixes in this analysis.

• Added support for prStatus in REST API endpoint GET /api/rest/fix-reports/{fixReportId}

• Added support for Asynchronous Commit - Mobb will now commit fixes (PRs or direct commits) asynchronously to the user's SCMs. Users no longer have to wait until the PR is completed before navigating away from the commit screen.

• Added support for email notifications and configurations - Org admins can now configure email notification settings on fix analysis completion, fix commits, or report expiring under Organization Settings -> Notifications.

• New fixes released:

  • Snyk

    • Open Redirect (Java)

    • Hardcoded Credential (PHP)

    • Hardcoded Credential Test (PHP)

    • Hardcoded Non Crypto Secret (PHP)

    • Hardcoded Password (PHP)

    • Hardcoded Password Test (PHP)

    • Arbitrary File Write via Archive Extraction (Tar Slip) (Python)

  • Fortify

    • J2EE Bad Practices: Threads (Java)

    • Open Redirect (Java)

    • Key Management: Hardcoded Encryption Key (PHP)

    • Password Management: Hardcoded Password (PHP)

    • Weak Cryptographic Hash: Hardcoded Salt (PHP)

    • Password Management: Hardcoded Password (YAML)

  • Checkmarx

    • Open Redirect (Java)

    • Hardcoded Salt (PHP)

    • Use of Hardcoded Cryptographic IV (PHP)

    • Use Of Hardcoded Password (PHP)

  • SonarQube

    • "Preconditions" and logging arguments should not require evaluation (Java)

    • Format strings should be used correctly (Java)

    • Generic exceptions should never be thrown (Java)

    • javasecurity:S5146 HTTP request redirections should not be open to forging attacks (Java)

    • Sections of code should not be commented out (Java)

    • Server-side requests should not be vulnerable to traversing attacks (Java)

    • Try-catch blocks should not be nested (Java)

    • Unnecessary imports should be removed (Java)

    • Unused "private" fields should be removed (Java)

    • Fields that are only assigned in the constructor should be "readonly" (JavaScript / TypeScript)

    • Formatting SQL queries is security-sensitive (JavaScript / TypeScript)

    • Sections of code should not be commented out (JavaScript / TypeScript)

    • Sections of code should not be commented out (JavaScript / TypeScript)

    • Using slow regular expressions is security-sensitive (JavaScript / TypeScript)

    • Using slow regular expressions is security-sensitive (JavaScript / TypeScript)

    • Variables should be declared explicitly (JavaScript / TypeScript)

    • Credentials should not be hard-coded (PHP)

    • Hard-coded credentials are security-sensitive (PHP)

    • Hard-coded secrets are security-sensitive (PHP)

    • "Exception" and "BaseException" should not be raised (Python)

    • Do not name local variables as builtin python functions (Python)

    • Do not use identity comparisons (is / is not) with cached types (Python)

    • Properly use string formatting: add all arguments to the format string, don't supply unused arguments (Python)

    • python:S5443 Using publicly writable directories is security-sensitive (Python)

    • python:S5754 "SystemExit" should be re-raised (Python)

    • Sections of code should not be commented out (Python)

    • String literals should not be duplicated (Python)

    • The "print" statement should not be used (Python)

    • Unused assignments should be removed (Python)

    • Wildcard imports should not be used (Python)

    • Credentials should not be hard-coded (YAML)

    • Ensure whitespace in-between braces in template directives (YAML)

  • CodeQL

    • Arbitrary file write during tarfile extraction (Python)

  • Semgrep/Opengrep

    • Cookie Missing HTTP only (GO)

    • lang.security.audit.unvalidated-redirect.unvalidated-redirect (Java)

    • spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect (Java)

    • javascript.lang.security.audit.detect-redos-mobb.detect-redos-mobb (JavaScript / TypeScript)

    • lang.security.audit.sqli.node-knex-sqli.node-knex-sqli (JavaScript / TypeScript)

    • lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli (JavaScript / TypeScript)

    • OS Command Injection (Express request to shell exec) (JavaScript / TypeScript)

    • python.tarfile-extractall-traversal.tarfile-extractall-traversal (Python)

May 2, 2025

• Added support for Datadog SAST issues. For more details, visit the supported issues page here.

• Added support for fixing a large number of issues (100+ commits) in one PR.

• New PRs or Commits will display a status message when the PR is ready to be merged. Click here for more details.

• Added ability to identify dev owners (git blame) for all supported SCMs.

• Performance improvements when loading large report pages and the dashboard.

• PR agent enhancement - On top of publishing fixes in GitHub PR comments, our PR agent will indicate when you get false alarms from your SAST tool. Click here to learn more.

• New fixes released:

  • Fortify

    • J2EE Bad Practices: Threads (Java)

  • Checkmarx

    • Unsafe Object Binding (Java)

  • SonarQube

    • Function returns should not be invariant (JavaScript / TypeScript)

    • Jump statements should not occur in "finally" blocks (JavaScript)

    • Jump statements should not occur in "finally" blocks (TypeScript)

    • Variables should be declared with "let" or "const" (JavaScript)

    • Variables should be declared with "let" or "const" (TypeScript)

    • Function parameters' default values should not be modified or assigned (Python)

    • python:S5443 Using publicly writable directories is security-sensitive (Python)

    • python:S5754 "SystemExit" should be re-raised (Python)

    • python:S5795 Identity comparisons should not be used with cached types (Python)

  • Semgrep/Opengrep

    • go.lang.security.audit.dangerous-exec-command.dangerous-exec-command (GO)

    • go.lang.security.injection.open-redirect.open-redirect (GO)

    • lang.security.audit.dangerous-exec-command.dangerous-exec-command (GO)

    • lang.security.audit.sqli.pgx-sqli.pgx-sqli (GO)

    • lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter (GO)

    • python.lang.security.audit.formatted-sql-query.formatted-sql-query (Python)

    • python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli (Python)

    • python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 (Python)

    • python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 (Python)

    • python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text (Python)

    • python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query (Python)

    • yaml.github-actions.security.run-shell-injection.run-shell-injection (YAML)

  • Datadog

    • Avoid user-input file (Java)

    • Avoid using printStackTrace() (Java)

    • MD2, MD4, and MD5 are weak hash functions (Java)

    • Prefer SecureRandom over Random (Java)

    • Prevent path traversal (Java)

    • SHA-1 is a weak hash function (Java)

    • Avoid setting insecure cookie settings (JavaScript / TypeScript)

    • Do not use weak hash functions (JavaScript / TypeScript)

    • Avoid SQL injections (Python)

    • Do not use an empty list as a default parameter (Python)

April 8, 2025

New stable fixes released:

• Snyk

  • Insecurely Generated Password (GO)

  • Command Injection (Python)

• Fortify

  • Cross-Site Request Forgery (Python)

• Checkmarx

  • Use of Cryptographically Weak PRNG (GO)

• SonarQube

  • Using pseudorandom number generators (PRNGs) is security-sensitive (GO)

  • String literals should not be duplicated (Java)

• Semgrep/Opengrep

  • lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter (GO)

  • python.lang.security.audit.subprocess-shell-true.subprocess-shell-true (Python)

  • python.lang.security.insecure-uuid-version.insecure-uuid-version (Python)

March 17, 2025

• Mobb Azure DevOps Plugin updated:

  • Supports --commit-directly flag. This capability allows users to commit fixes directly to a target branch (i.e. source branch of a PR).

  • Publishing of Mobb link in the PR comments: A direct link to the Mobb analysis results is now included in PR comments.

  • Publishing of what fix was committed directly in PR comments (if the context is a PR): When a fix is committed within a PR context, the details of the fix will be automatically published in the PR comments.

• New stable fixes released:

  • Semgrep/Opengrep

    • gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check (GO)

    • insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification (GO)

    • lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion (GO)

    • lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 (GO)

    • lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 (GO)

    • lang.security.audit.crypto.use-of-sha1.use-of-sha1 (Java)

March 13, 2025

• New stable fixes released:

  • Fortify

    • Weak Cryptographic Hash (Java)

    • Weak Cryptographic Hash (Python)

  • Checkmarx

    • Reversible One Way Hash (Java)

    • Use Of Broken Or Risky Cryptographic Algorithm (Java)

    • Client Weak Cryptographic Hash (JavaScript / TypeScript)

    • Use Of Broken Or Risky Cryptographic Algorithm (JavaScript / TypeScript)

    • Information Exposure Through an Error Message (Python)

    • Reversible One Way Hash (Python)

    • Use Of Broken Or Risky Cryptographic Algorithm (Python)

  • SonarQube

    • Using weak hashing algorithms is security-sensitive (Java)

    • Using weak hashing algorithms is security-sensitive (JavaScript / TypeScript)

    • Using weak hashing algorithms is security-sensitive (Python)

  • CodeQL

    • Use of a broken or risky cryptographic algorithm (Java)

    • Use of a potentially broken or risky cryptographic algorithm (Java)

    • Use of a potentially broken or risky cryptographic algorithm (Java)

    • Insecure randomness (JavaScript / TypeScript)

    • Use of a broken or weak cryptographic algorithm (JavaScript / TypeScript)

    • Information exposure through an exception (Python)

    • Use of a broken or weak cryptographic algorithm (Python)

    • Use of a broken or weak cryptographic hashing algorithm on sensitive data (Python)

  • Semgrep/Opengrep

    • lang.security.audit.crypto.use-of-md5.use-of-md5 (Java)

February 13, 2025

• Introducing Clean Fix & False Positive Detection! Now, when you generate a fix analysis report, Mobb automatically categorizes issues into Fixable Issues, Irrelevant Issues (False Positives), and Remaining Issues. Click here to learn more.

• New stable fixes released:

  • Snyk

    • Clear Text Logging (GO)

    • Improper Certificate Validation (GO)

  • Fortify

    • Log Forging (GO)

  • Checkmarx

    • Use Of Hardcoded Password (C#)

    • Log Forging (GO)

    • Privacy Violation (GO)

    • SSL Verification Bypass (GO)

    • Frameable loging page (Java)

    • Privacy Violation (Java)

    • SQL Injection Evasion Attack (Java)

    • Stored Absolute Path Traversal (Java)

    • Use of Hard coded Cryptographic Key (Java)

    • Filtering Sensitive Logs (Python)

    • Hardcoded Secrets (Python)

    • Privacy Violation (Python)

    • Unchecked Input for Loop Condition (Python)

    • Default Definer Rights in Package or Object Definition (SQL)

    • Second Order SQL Injection (SQL)

  • SonarQube

    • Loop boundaries should not be vulnerable to injection attacks (Python)

  • CodeQL

    • Clear-text logging of sensitive information (GO)

    • Disabled TLS certificate check (GO)

    • Incomplete regular expression for hostnames (GO)

    • Log entries created from user input (GO)

  • Semgrep

    • lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion (GO)

    • lang.security.audit.sqli.jdbc-sqli.jdbc-sqli (Java)

    • lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request (Java)

January 21, 2025

• New stable fixes released:

  • Snyk

    • Regular Expression Denial of Service (ReDoS) (Snyk/Python)

  • Fortify

    • Cross-Site Request Forgery (Fortify/JavaScript / TypeScript)

    • Privacy Violation: Autocomplete (Fortify/JavaScript / TypeScript)

    • Insecure Randomness (Fortify/PHP)

    • SQL Injection (Fortify/Python)

  • Checkmarx

    • Use of Non Cryptographic Random (Checkmarx/PHP)

    • ReDoS Injection (Checkmarx/Python)

    • Second Order SQL Injection (Checkmarx/Python)

  • SonarQube

    • Unassigned members should be removed (SonarQube/C#)

    • Unread "private" fields should be removed (SonarQube/C#)

    • Unused private types or members should be removed (SonarQube/C#)

    • Using pseudorandom number generators (PRNGs) is security-sensitive (SonarQube/PHP)

    • Database queries should not be vulnerable to injection attacks (SonarQube/Python)

    • Formatting SQL queries is security-sensitive (SonarQube/Python)

    • Regular expressions should not be vulnerable to Denial of Service attacks (SonarQube/Python)

  • CodeQL

    • Regular expression injection (CodeQL/Python)

    • SQL query built from user-controlled sources (CodeQL/Python)

  • Semgrep

    • javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape (Semgrep/JavaScript/TypeScript)

    • javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring (Semgrep/JavaScript/TypeScript)

    • django.security.injection.tainted-sql-string.tainted-sql-string (Semgrep/Python)

    • flask.security.injection.tainted-sql-string.tainted-sql-string (Semgrep/Python)

    • lang.security.audit.formatted-sql-query.formatted-sql-query (Semgrep/Python)

    • lang.security.audit.sqli.psycopg-sqli.psycopg-sqli (Semgrep/Python)

    • python.django.security.django-no-csrf-token.django-no-csrf-token (Semgrep/Python)

    • python.django.security.injection.open-redirect.open-redirect (Semgrep/Python)

    • sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query (Semgrep/Python)

January 7, 2025

• Mobb REST API: You can now interact with Mobb using REST API published here. A walkthrough guide on how to get started is also available here.

• New stable fixes released:

  • Snyk

    • Incomplete URL sanitization (Snyk/Python)

  • Fortify

    • System Information Leak: Internal (Fortify/Python)

  • SonarQube

    • Composite format strings should be used correctly (SonarQube/C#)

    • Fields that are only assigned in the constructor should be "readonly" (SonarQube/C#)

    • Not specifying a timeout for regular expressions is security-sensitive (SonarQube/C#)

    • Sections of code should not be commented out (SonarQube/C#)

  • CodeQL

    • Incomplete URL substring sanitization (CodeQL/Python)

  • Semgrep

    • java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly (Semgrep/Java)

    • java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag (Semgrep/Java)

    • java.lang.security.audit.crypto.weak-random.weak-random (Semgrep/Java)

    • java.servlets.security.cookie-issecure-false.cookie-issecure-false (Semgrep/Java)

    • html.security.audit.missing-integrity.missing-integrity (Semgrep/JavaScript)

    • python.flask.security.audit.debug-enabled.debug-enabled (Semgrep/Python)

    Click here to see all currently supported fixes

December 13, 2024

• Project-level fix policy: You can now define fix policies such as issue types and automatic PRs on a per-project basis. Click here to learn more, or watch the demo video here.

• Committing fixes directly to a target branch: When committing fixes back to your repository, you now have the option to commit it as a Pull Request or directly to a branch of your choice. Watch the demo video here.

• New stable fixes released:

  • Reflected cross-site scripting (CodeQL/JavaScript)

  • SQL Injection (Checkmarx/Python)

  • Reflected_XSS_All_Clients (Checkmarx/Python)

  • Cross Site Scripting (XSS) (Snyk/Python)

  • Client DOM Stored Code Injection (Checkmarx/avaScript)

  • Dynamically executing code is security-sensitive (SonarQube/Javascript)

  • Password In Comment (Checkmarx/Java)

  • NoSQL operations should not be vulnerable to injection attacks (SonarQube/TypeScript)

  • NoSQL operations should not be vulnerable to injection attacks (SonarQube/JavaScript)

  • Password Management: Password in Comment (Fortify/Python)

  • Password in Comment (Checkmarx/Python)

  • I/O function calls should not be vulnerable to path injection attacks (SonarQube/JavaScript)

  • I/O function calls should not be vulnerable to path injection attacks (SonarQube/TypeScript)

  • Heap Inspection (Checkmarx/C#)

  • Missing HSTS Header (Checkmarx/C#)

November 6, 2024

• New Integrations Page added to Mobb UI: The integrations page allows you to centrally manage all your connections between Mobb and external code platforms, SAST tools, and CI/CD tools. Click here to learn more.

• New Mobb plugin has been released for Azure DevOps Pipeline: Click here to learn more. Visual Studio Marketplace link can be found here.

• New guide on integrating Mobb in Bitbucket Pipeline: Click here to learn more.

• New guide on generating SonarQube SAST JSON Reports: Click here to learn more.

• New guide on generating Checkmarx One JSON Reports: Click here to learn more.

• New stable fixes released:

  • Unsafe_Object_Binding (Checkmarx/C#)

  • Log_Forging (Checkmarx/Python)

  • Logging should not be vulnerable to injection attacks (SonarQube/Python)

  • Insecure Randomness (Fortify/Java)

  • Use_of_Non_Cryptographic_Random (Checkmarx/Java)

  • Using pseudorandom number generators (PRNGs) is security-sensitive (SonarQube/Java)

  • CSRF (Checkmarx/C#)

  • Public constants and fields initialized at declaration should be "static final" rather than merely "final" (SonarQube/Java)

  • Null pointers should not be dereferenced (SonarQube/C#)

  • Hardcoded Domain in HTML (Fortify/JavaScript)

  • Client_Hardcoded_Domain (Checkmarx/JavaScript)

  • Using remote artifacts without integrity checks is security-sensitive (SonarQube/JavaScript)

  • Inclusion of functionality from an untrusted source (CodeQL/JavaScript)

  • Missing HSTS Header (Checkmarx/JavaScript)

  • Client_Regex_Injection (Checkmarx/JavaScript)

  • DOM updates should not lead to cross-site scripting (XSS) attacks (SonarQube/JavaScript)

  • DOM updates should not lead to cross-site scripting (XSS) attacks (SonarQube/TypeScript)

  • Database queries should not be vulnerable to injection attacks (SonarQube/JavaScript)

  • Database queries should not be vulnerable to injection attacks (SonarQube/TypeScript)

  • Hard-coded credentials are security-sensitive (SonarQube/JavaScript)

  • Hard-coded credentials are security-sensitive (SonarQube/TypeScript)

  • Regular expressions should not be vulnerable to Denial of Service attacks (SonarQube/JavaScript)

  • Using pseudorandom number generators (PRNGs) is security-sensitive (SonarQube/JavaScript)

  • DOM updates should not lead to open redirect vulnerabilities (SonarQube/JavaScript)

  • HTTP request redirections should not be open to forging attacks (SonarQube/JavaScript)

  • HTTP request redirections should not be open to forging attacks (SonarQube/TypeScript)

  • Unnecessary character escapes should be removed (SonarQube/JavaScript)

  • Cookie Security: HTTPOnly not Set on Application Cookie (Fortify/C#)

  • Cookie Security: Session Cookie not Sent Over SSL (Fortify/C#)

  • Path Manipulation (Fortify/Python)

  • Path Traversal (Snyk/Python)

  • Path_Traversal (Checkmarx/Python)

  • path-injection (CodeQL/Python)

  • Cross-Site Scripting: DOM (Fortify/JavaScript)

  • Cross-Site Scripting: Self (Fortify/JavaScript)

  • Open Redirect (Fortify/JavaScript)

  • Improper_Resource_Shutdown_or_Release (Checkmarx/Python)

  • DOM updates should not lead to open redirect vulnerabilities (SonarQube/JavaScript)

  • Unnecessary character escapes should be removed (SonarQube/JavaScript)

  • Logging should not be vulnerable to injection attacks (SonarQube/C#)

  • Prototype Pollution (Snyk/JavaScript)

  • Allocation of Resources Without Limits or Throttling (Snyk/JavaScript)

September 24, 2024

• Auto-PR feature added to Mobb UI: This feature allows users to specify which issue types Mobb will automatically create a Pull Request (PR) in your Source Code Repository as soon as a fix becomes available. Click here for more details.

• Archive Fixes and Fix Rating: Users can now provide feedback directly to the Mobb support team through the fix feedback system on the Fix page. Users can specify if a particular fix is good and provide their reasons. Click here for more details.

• New stable fixes released:

  • Jinja auto-escape is set to false (Snyk/Python)

  • Extracting archives should not lead to zip slip vulnerabilities (SonarQube/C#)

  • Secure random number generators should not output predictable values (SonarQube/C#)

  • Insufficient Logging of Exceptions (Checkmarx/C#)

  • Missing rate limiting (CodeQL/JavaScript)

September 10, 2024

• Added Support for Multi-tenant Mobb Broker: Mobb Broker allows users to connect their Mobb organization to self-hosted (private) source code repositories that are not publicly accessible from the internet. You can now deploy the Mobb broker if your organization is on the multi-tenant mobb platform. Click here for more details.

• New stable fixes released:

  • Code Correctness: Erroneous String Compare (Erroneous String Compare) for Java (Fortify)

  • use_of_wrong_operator_in_string_comparison (Erroneous String Compare) for Java (Checkmarx)

  • Strings and Boxed types should be compared using "equals()" (Erroneous String Compare) for Java (Sonarqube)

  • Poor Error Handling: Empty Catch Block for Java (Fortify)

  • unvalidated_arguments_of_public_methods (Unvalidated Public Method Argument) for C# (Checkmarx)

  • J2EE Bad Practices: Leftover Debug Code (Leftover Debug Code) for Java (Checkmarx)

  • Poor Style: Confusing Naming (Confusing Naming) for Java (Fortify)

  • confusing_naming (Confusing Naming) for Java (Checkmarx)

  • Debug Mode Enabled (Debug Enabled) for Python (Snyk)

  • flask-debug (Debug Enabled) for Python (CodeQL)

  • debug_enabled (Debug Enabled) for Python (Checkmarx)

  • Delivering code in production with debug features activated is security-sensitive (Debug Enabled) for Python (Sonarqube)

  • information_exposure_via_headers (Information Exposure via Headers) for C# (Checkmarx)

  • Code Correctness: Class Does Not Implement Equivalence Method (Class Does Not Implement Equivalence Method) for Java (Fortify)

  • declaration_of_catch_for_generic_exception (Overly Broad Catch) for C# (Checkmarx)

August 19, 2024

• Added support for GitHub Enterprise: This capability allows users to run fix analysis and commit fixed code directly to GitHub Enterprise. See system requirements for more details.

• Added new "Fixing Effort" feature: Fixing effort is an indicator that informs users the level of effort required to complete the fix. Click here for more details.

• Added Effort as a new filter in the fix report filter list. See all available filters here.

• New stable fixes released:

  • Unreleased Resource: Streams (Improper Resource Shutdown or Release) for Java (Fortify)

  • Poor Style: Value Never Read (Value Never Read) for Java (Fortify)

  • Improper Resource Shutdown or Release for Java (SonarQube)

  • Value Never Read for Java (SonarQube)

  • Improper_Resource_Shutdown_or_Release (Improper Resource Shutdown or Release) for Java (Checkmarx)

August 5, 2024

• SonarQube support added: Mobb now supports SonarQube SAST results! You can now upload SonarQube reports to Mobb to generate fixes. Click here to see a detailed list of currently supported fixes for SonarQube.

• Mobb Fixer adds packages: For JS-based projects, if a fix requires the use of an additional package, Mobb will automatically add that package as part of the fix to package.json file.

• Resend user invitation: Added the option to resend an invitation email to someone to join your organization. Click here for more details.

• Quick analysis rerun: When an existing fix is improved, the Mobb app will indicate this status and offer to rerun the analysis in one click. After the rerun, the app will indicate which fixes are "fresh", meaning these are new compared to the previous run. Click here for more information.

• Added Severity and Language as filters in the fix report filter list. See all available filters here.

• Experimental fixes are now disabled by default. You can go to Settings -> Fix Policy to turn them back on.

• New stable fixes released:

  • Zip Slip for Java (SonarQube)

  • SQL Injection for Java (SonarQube)

  • Log Forging for Java (SonarQube)

  • XSS for Java (SonarQube)

  • Regex Injection for Java (SonarQube)

  • Insecure Cookie for Java (SonarQube)

  • Cookie is not HttpOnly for Java (SonarQube)

  • Path Traversal for Java (SonarQube)

  • Cookie is not HttpOnly for Java (SonarQube)

  • Regex Injection for JavaScript (SonarQube)

  • Insecure Randomness for JavaScript (SonarQube)

  • Dead Code: Unused Field for C# (Fortify)

  • Header Manipulation: Cookies for C# (Fortify)

  • XSS for C# (Checkmarx)

June 27, 2024

• Added support for Bitbucket Cloud - Support for SCM tools (GitHub, GitLab, Azure Repo, Bitbucket Cloud) allows users to automatically run fix analysis by connecting their repository to Mobb, as well as allowing Mobb to automatically generate Pull Requests (PRs) back into the repository. Follow the onboarding guide to learn more about how to submit a fix analysis for your repository.

• Added Live Support via Intercom in the Mobb UI

• New stable fixes released:

  • Information_Exposure_Through_an_Error_Message (System Information Leak) for C# (Checkmarx)

  • Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (Insecure Cookie) for JavaScript (Snyk)

  • Clear text transmission of sensitive cookie (Insecure Cookie) for JavaScript (CodeQL)

  • Cookie Security: Cookie not Sent Over SSL (Insecure Cookie) for JavaScript (Fortify)

  • Unprotected_Cookie (Insecure Cookie) for JavaScript (Checkmarx)

  • SQL Injection for Python (Snyk)

  • Unchecked_Input_For_Loop_Condition (Unchecked Loop Condition) for JavaScript (Checkmarx)

  • insufficient_logging_of_sensitive_operations (Insufficient Logging of Sensitive Operations) for C# (Checkmarx)

  • Incomplete URL scheme check for JavaScript (CodeQL)

  • Prototype-polluting assignment (Prototype Pollution) for JavaScript (CodeQL)

June 4, 2024

• UI Update - Project Settings: This capability provides additional granularity for setting user permissions on a per-project basis. To see more details, click here.

• New documentation page: Mobb GitHub Fixer for CxOne

• New stable fixes released:

  • Arbitrary File Write via Archive Extraction (Zip Slip) for Java (Snyk)

  • Arbitrary File Write via Archive Extraction (Zip Slip) for C# (Snyk)

  • Arbitrary file access during archive extraction (Zip Slip) for Java (CodeQL)

  • Arbitrary file access during archive extraction (Zip Slip) for C# (CodeQL)

  • Path Manipulation: Zip Entry Overwrite (Zip Slip) for Java (Fortify)

  • Path Manipulation: Zip Entry Overwrite (Zip Slip) for C# (Fortify)

  • Hard-coded credentials (Hardcoded Secrets) for JavaScript (CodeQL)

  • Value_Shadowing (Value Shadowing) for C# (Checkmarx)

  • Use_of_Insufficiently_Random_Values (Insecure Randomness) for C# (Checkmarx)

  • Use of Insufficiently Random Values (Insecure Randomness) for C# (Snyk)

  • Insecure Randomness for C# (CodeQL)

  • Insecure Randomness for C# (Fortify)

May 20, 2024

• Mobb Fixer for Checkmarx One GitHub Integration is now available. This integration monitors for `Checkmarx comments in a PR and generates a Mobb Fixer comment in the same PR. Click here for more details.

• UI Update: Hovering over an issue name will display the original issue name from the SAST provider. Click here for more details.

• New stable fixes released:

  • HttpOnlyCookies for C# (Checkmarx)

  • Trust Boundary Violation for C# (Fortify)

  • Privacy Violation for Java (Fortify)

May 7, 2024

• UI Update: Hovering over the (!) tooltip next to the text "Available Fixes" on the Fix Report page will display the number of issues fixed compared to the total issues found in the vulnerability report. Click here for more details.

• New stable fixes released:

  • Just One of Equals() and GetHashCode() Defined for C# (Fortify)

  • Missing equals or hashcode method for C# (Checkmarx)

  • WCF Misconfiguration: Throttling Not Enabled for C# (Fortify)

  • WCF Misconfiguration: Insufficient Logging for C# (Fortify)

  • Incomplete regular expression for hostnames for JavaScript (CodeQL)

  • Overly permissive regular expression range for JavaScript (CodeQL)

April 29, 2024

• Mobb Broker is now released. Mobb Broker allows users to connect their Mobb organization to self-hosted source code repositories that are not publicly accessible from the internet. Please contact us to learn more.

• New feature: Project pages now include a "Language" column that contains information about the languages present in the project.

• New feature: All previously committed fixes now include a "Link to commit".

• New feature: All fixes now contain a "Fix Info" tab, which contains additional info about the issue as well as fix instructions for the issue type.

• A new integration guide has been added for Atlassian Bamboo along with a sample integration YAML

• New stable fixes released:

  • Header Manipulation for C# (Fortify)

  • Password in Comment for XML (Fortify)

  • Server-Side Request Forgery for JavaScript (Checkmarx)

  Click here to see all currently supported fixes

April 18, 2024

• New stable fixes released:

  • Prototype Pollution for JavaScript

  • Insecure Cookie for C#

  • Cookie is not HttpOnly for C#

  • Locale Dependent Comparison for Java

  • Race Condition Format Flaw for Java

  • Server-Side Request Forgery for C#

  • Regular Expression Injection for Java

  • XSS for Java

  • Poor Error Handling: Overly Broad Catch for Java

  • Non-final Public Static Field for Java

  • Missing HSTS Header for JavaScript

  • Dead Code: Unused Field for Java

March 19, 2024

• New stable fixes released:

  • Insecure Randomness for Javascript

  • SQL Injection for Javascript

  • Command Injection for Javascript

  • Hardcoded Secrets in Javascript

  • Deprecated Function in Javascript

  • Null Dereference for C#

  • Trust Boundary Violations for C#

March 4, 2024

• Dashboard with ROI Calculator and Fix Management capabilities released. To see more details, click here.

  • The ROI Calculator identifies the total savings in cost and time from all automatic fixes

  • Fix Management dashboard identifies the most effective fixes available across all your projects

Feb 26, 2024

• New stable fixes released:

  • Path Traversal for JavaScript

  • Error Condition Without Action for Java

  • HTML Comment in JSP for Java

  • Default Definer Rights in Package or Object Definition for SQL

  • Improper Exception Handling for C#

  • Improper Resource Shutdown or Release for C#

Feb 7, 2024

• New stable fixes released:

  • jQuery Deprecated Symbols for JavaScript

  • Missing iframe Sandbox for JavaScript

  • Unsafe Target Blank for JavaScript

  • Missing Anti-forgery Validation for C#

  • Insecure Binder Configuration for C#

  • Overly Broad Catch for C#

January 29, 2024

• New stable fix released:

  • Missing Check Against Null for Java

• Added support for Azure Repo - Mobb can now automatically retrieve source code from Azure Repo and commit directly back to an Azure Repo once a fix is ready.

January 26, 2024

• New stable fix released:

  • Regex Injection for Java added

January 22, 2024

• Mobb Fixer for GitHub is released (Demo video for CodeQL, Checkmarx, Snyk)

Jan 15, 2024

• New stable fix released:

  • Trust Boundary Violations added

  • Log Forging for Snyk and Fortify added

January 9, 2024

• Mobb is now on the Snyk Integrations page

December, 2023

• Mobb is now on the AWS Marketplace

May, 2022

• Bugsy launched. Bugsy is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code. It is the community edition version of Mobb, the first vendor-agnostic automated security vulnerability remediation tool. Click here to learn more.