Release news for hosted customers

ANNOUNCING Contrast's Northstar Release. Contrast’s new user experience is the industry’s first platform to unite developers, security, and operations teams. Contrast’s enhanced workflow experience is essential for immediate threat detection, providing a real-time view of attacks and critical vulnerabilities, from development to production and how they relate to one another.

At the core of the platform is the Contrast Graph, which powers its most advanced capabilities. The Graph builds a real-time Digital Twin of an organization’s application and API environment, mapping live attack paths, correlating runtime behavior, and exposing how vulnerabilities, threats, and assets are connected. This deep, dynamic context eliminates the guesswork that plagues traditional tools, enabling accurate and automated prioritization and remediation, so teams can focus on real risks and act with confidence.

This includes the following new features:

Contrast Northstar is currently only available to hosted customers and is only offered in English.

ANNOUNCING Deployment Hub. Deployment Hub is your command center for getting up and running on day one. Assign and manage tasks across teams, get help with in-app videos and documentation, and manage progress. With step-by-step guidance, even complex environments can be set up quickly and confidently. (PROD-3062)

Security risks in Java applications using an R2DBC connector. This release improves the Java Agent's capabilities to detect and report SQL Injection vulnerabilities and other security risks in Java applications using Spring-data, H2, MariaDB, PostgreSQL, MySQL, Oracle, and MS SQL Server with the R2DBC connector. Previously, the agent lacked support for this configuration, leading to false negatives. Now, users can ensure their applications remain secure by addressing reported customer issues and improving overall protection. (RFE-342,JAVA-8984)

Enhanced CVE scoring with CNA fallback. CVE scoring improved by introducing a fallback mechanism to use CNA (CVE Numbering Authority) scores when NVD (National Vulnerability Database) scores are unavailable. Users will now have timely vulnerability severity information, ensuring informed remediation decisions. Once NVD scores become available, they will automatically override the CNA values for consistency. (PROD-3469,RFE-329)

Set minimum route coverage policy. Users can now set a policy for the percentage of route coverage and set which applications this minimum coverage policy applies to. Contrast will create a bug ticket for the developer when route coverage falls below the threshold to help users of Contrast improve their route coverage. (AS-6)

Route coverage download enhancement. This release enhances the route coverage download process by making it asynchronous. Previously, large downloads could cause 504 gateway timeout errors due to memory issues. Now, users can efficiently download route coverage for even the largest applications without interruption, with clear feedback and progress tracking for a smoother experience. (AS-4)

Contrast AI SmartFix. SmartFix significantly reduces the time and effort developers spend on vulnerability remediation, allowing them to focus more on feature development. Leveraging Contrast's unique runtime context (including full data flow, stack traces, HTTP requests and more) and AI, SmartFix automatically generates fixes for critical and high-impact vulnerabilities identified by Contrast Assess. It integrates with your organization's approved, self-managed LLM to analyze code and create a pull request with the proposed fix in your GitHub repository, complete with optional security unit tests to validate the solution.

Contrast AI SmartFix is a limited release feature for June and is available by request until general availability.

SARIF output and GitHub Advanced Security. This release addresses issues with SARIF file generation, ensuring successful uploads to GitHub Advanced Security (GHAS) even when the underlying data may be incomplete. Previously, missing information caused errors during the upload process. Now, the system produces a more robust SARIF file, thereby improving compatibility and user experience with GHAS. (SCA-1867)

Libraries tab permissions. This release addresses an issue where the static libraries filter under the Libraries tab failed to correctly apply user permissions. Previously, users could inadvertently view all static SCA projects regardless of their assigned access rights. This fix ensures that the static libraries filter now properly enforces permissions, displaying only authorized projects to users. (SCA-1994)

CLI for .NET projects. Removed the requirement for the --legacy flag when running an audit against .NET projects. This will display results under the Projects tab rather than the Applications tab. (RFE-247)

(Correction) Application pacing algorithm enhancement. Contrast now provides an enhanced pacing algorithm to fine-tune the way Contrast performs strategic analysis of your code. These settings are available when Assess is enabled under Server configuration. Use the settings to select a pacing algorithm level that balances the pacing algorithm with application performance impact, based on the server environment. (AS-8)

Improved date range options. Enabled more date range options for the ATTR (Average Time To Remediate) graph. (AS-7)

Fixed a defect so that the correct behavior of masking of data happens across all parts of the Overview, Details, and Request tabs. Previously, the defect was that it was only being masked in some of these, and switching to another tab would show the unmasked values. (PHP-1207)

Existing Contrast customers will continue to have access to the CLI by connecting to their instance. Customers will need to authenticate using their user credentials and can follow this documentation to do so.

Non-Contrast customers are encouraged to Try Contrast to explore our complete portfolio or contact a sales representative at info@contrastsecurity.com.

New logo change: Contrast has updated the logo on the login page,  logout page, error pages, and the banner for the Contrast web interface.

Enhanced route coverage monitoring with First Seen timestamp. We've added a First Seen column to the Route Coverage tab for applications to help identify when Contrast first sees a specific route. (PROD-3457)

Improved SARIF output. We've improved the format and content of the SARIF file that you can export with Assess (IAST) and SCA details. These improvements ensure better compatibility with VSCode integration and GitHub issues. (SCA-1953)

Improvements for Contrast Security Observability. We've improved the display and performance of the data in the Observability tab. (ADR-193)

Fixed an issue that caused an interruption with a Jira connection following a maintenance window. (PROD-3513)

Existing Contrast customers will continue to have access to the CLI by connecting to their instance. Customers will need to authenticate using their user credentials and can follow this documentation to do so.

Non-Contrast customers are encouraged to Try Contrast to explore our complete portfolio or contact a sales representative at info@contrastsecurity.com.

Incident management with ADR. New and improved features for ADR.

Improved Operator framework currency. We've updated the Agent Operator to be fully compatible with .NET 8. By leveraging the latest .NET framework, we minimize potential security vulnerabilities associated with outdated technologies. (PROD-3333)

More robust agent authentication with multiple user agent keys. We've added user key support for multiple users and teams within an application. This allows Organization Admins to create more precise, narrowly scoped keys for better access control. Additionally, it facilitates improved key rotation processes, ensuring that application downtime is eliminated. (PROD-3155)

Enhanced server monitoring with First Seen timestamp. We've added a First Seen column to the Servers tab in Contrast, to help identify server onboarding times and quickly detect anomalies. (PROD-3458)

Server SBOM Generation & CycloneDX/SPDX Format Updates The SBOM export has updated the CycloneDX format from version 1.4 to 1.6, and we have added support for SPDX 3.0. We also added the ability to generate SBOMs at the server level and the application level. (PROD-3356)

Contrast Security Observability now reports Security controls with detailed attributes. (This feature is supported for Java applications only) To provide a more complete picture of application behavior, we've added Security control as a new Action Type. This change means that actions taken by security controls will now be reported in a consistent format with other Observe mode action types. Each security control action will include the following attributes:

Improved Helm Chart Deployment. To enhance security and deployment consistency, we've updated our Helm charts to adhere to namespace management best practices. We now recommend and support deploying to pre-existing, designated namespaces. (RFE-222)

Enhanced filtering option within the Vulnerabilities tab. We've added the ability to filter Vulnerabilities by the Protected in <environment> column. Now you can quickly see which vulnerabilities are being monitored, blocked, or not covered by Contrast ADR. (PROD-3359)

New feature to export attack event data. To support issue triage, we've added the ability to export attack event data. This allows you to download the attack event data to identify possible issues and share data if needed. (ADR-90)

Existing Contrast customers will continue to have access to the CLI by connecting to their instance. Customers will need to authenticate using their user credentials and can follow this documentation to do so.

Non-Contrast customers are encouraged to Try Contrast to explore our complete portfolio or contact a sales representative at info@contrastsecurity.com.

CVE details: The improved CVE details screen now has key enhancements and helps you quickly understand the impact of CVEs on your organization. First Seen in Contrast provides insights into your exposure window, while the Organizational Impact highlights which applications and servers are affected. Key metrics like Severity, CVSS score, and EPSS help you understand the full scope of risk and prioritize remediation efforts. (PROD-2972)

Enhanced server cleanup: Contrast now offers enhanced server cleanup to remove historical routes associated with inactive servers. This is ideal for customers with ephemeral servers, in which each test run of a Contrast-instrumented application is used to represent a unique, point-in-time scan. For continuous instrumentation and long-running servers, route expiration remains the recommended approach. Enhanced server cleanup helps manage Assess results by simultaneously cleaning up outdated servers, routes, and vulnerabilities. (PROD-3060)

Automatically set arbitrary session metadata via Fingerprinting: Contrast will track and report unique builds of your application, even when session metadata has not been defined. This makes it easy for you to refine your view of important information so you can find what you need quickly while also eliminating manual configuration steps. (PROD-1745)

The minimum agent versions that support this feature are:

Server details: When a user opens the Server > Libraries tab and selects a library to view its details, they will now see the server-specific applications on the application list. (PROD-3489)

Specific record names: When attack events are reported for IP denylists or virtual patches, the specific name of the individual IP denylist or virtual patch record will be displayed instead of the generic IP denylist or Virtual Patch labels. (PROD-3547)

Copy a role: You can copy an existing role, change its settings, and add it as a new role. Copying a role is useful if you need several roles with the same or similar settings or use a specific role as a template. Note that this is for users of role-based access control. (PROD-3276)

RBAC: Items for improved RBAC (Role-based access control). (PROD-3206)

Existing Contrast customers will continue to have access to the CLI by connecting to their instance. Customers will need to authenticate using their user credentials and can follow this documentation to do so.

Non-Contrast customers are encouraged to Try Contrast to explore our complete portfolio or contact a sales representative at info@contrastsecurity.com.

MS Teams Integration. To ensure our customers can continue using MS Teams after the January 2025 Webhook URL deprecation, as Microsoft has already shared here, we have added support for the new power automate integration. This will be enabled by request, and we recommend customers follow the instructions in the integration documents to prepare for the change. Once complete, please contact Support to enable this integration. Note, that if you use the MS Teams integration and do not make these changes by January 31st, the integration will fail. (PROD-3092)

Mapping Assess to ADR. Contrast can associate Assess and AVM findings with ADR (Application and Detection Response) to see which vulnerabilities have corresponding ADR rules. (PROD-2619)

NEW: Wiz Integration. Addition of a Wiz integration to send runtime security information regarding applications from Contrast to a Wiz deployment. (PROD-2694)

Guidance AI. Contrast AI provides additional information about how to fix discovered vulnerabilities with AI guidance that is specific to the frameworks and libraries used by your application. Available to USA users only now and is disabled by default. It can be enabled under the Organization settings section. (PROD-3064)

Jira integration. Enhancements to the Jira integration:

RBAC. RBAC administrators (Role-based access control) can deactivate users from the user grid and properties. This will deactivate the user and the user’s endpoints but keep the record of the user in Contrast with an Inactive status. (PROD-3194)

Assess Vulnerability report. The audit log record now includes details of downloading the reports from the aggregated vulnerability dashboard. Please get in touch with your account manager if you are interested in using this report. (PROD-3198).

Resource group command in CLI. A new resource group command (under the Contrast audit function will specify the required resource groups to eliminate the manual process of generating SCA projects. (PROD-3352)

Applications in the libraries detail view. When viewing the Libraries tab under the Server section, the application list now clearly shows which applications are on the server. (PROD-3489)