What does it take to secure an application end to end? Source code, yes. But also the container images and binaries that carry hidden dependencies, and the AI frameworks your developers are already building with. As your application security program grows across more repositories, pipelines, and environments, you need coverage that keeps pace and automation that ensures nothing slips through the cracks. You need scan configurations and remediation workflows that follow your teams wherever they work, not the other way around.
The latest Black Duck Polaris™ Platform release delivers on that criterion. You can now trigger container scans from wherever you work through CI/CD pipelines and Black Duck Security Setup workflows, extend fix PR flexibility to the CLI, the Jenkins plug-in, and Black Duck Security Setup workflows, onboard GitHub Enterprise Cloud tenants with data residency, and get security analysis for AI frameworks and the latest languages. Together, these enhancements help you see risk across every layer, scale scanning without scaling manual effort, automate only the remediations you trust, and ship secure code without slowing down.
Comprehensive scanning with depth and accuracy: Better coverage with stronger detection
Rapid Scan Static enhancements: Catch security risks in AI frameworks and the latest languages
Developers and security teams working with modern tech stacks, including Go 1.27, Groovy-based frameworks like Grails and Micronaut, and AI integration libraries, often lack immediate, automated security feedback. They rely on manual configuration reviews or generic scanners that miss specific vulnerabilities in AI agent setups or Java Virtual Machine (JVM)-based build tools. The result is increased risk of AI prompt injection, tool enablement exploits, Cross-Origin Resource Sharing (CORS) misconfigurations, and exposed secrets in build scripts.
Polaris now supports Rapid Scan Static (Sigma 2026.9.1), delivering specialized security analysis for AI frameworks (the Anthropic and OpenAI SDKs and LangChain) and expanded language support for Go 1.27. This update lets developers build with the latest technologies while Polaris automatically catches complex misconfigurations and secrets across Groovy, JavaScript, and Python environments. Rapid Scan Static includes expanded language coverage, new security checks, improved hard-coded secret detection, and enhanced detection accuracy.
Polaris is among the first to provide specific security configuration checks for popular AI orchestration frameworks and SDKs like LangChain and the Anthropic SDK, addressing a critical gap in the emerging AI-driven development landscape. The expanded Groovy support ensures that security analysis stays consistent across the entire JVM ecosystem, including build tools like Gradle and CI pipelines like Jenkins.
Key capabilities
- AI framework security: Specialized detection for AI agent configuration files and dangerous tool enablement in the Anthropic and OpenAI SDKs and LangChain, catching emerging AI development risks that generic scanners miss.
- Latest language support: Go 1.27 coverage and expanded detection across Groovy, JavaScript, and Python, so security keeps pace as developers adopt new technologies.
- Improved detection accuracy and JVM coverage: Reduces false positives in JavaScript unit test files, improves detection for CORS and Transport Layer Security (TLS) misconfigurations in Groovy/Grails applications, and extends security analysis across build tools (Gradle) and CI pipelines (Jenkins).
Developer-first workflow and integrations: Security that stays in sync with development
Fix PR control: Automated remediation across CLI, pipelines, and workflows
The Polaris UI already lets you configure fAST SCA and fAST Static AI fix PRs independently, so you can enable automated remediation for one assessment type without committing to both. The CLI already supported both SCA and Static AI fix PRs, but they were triggered together as an all-or-nothing setting. The Jenkins plug-in and Black Duck Security Setup workflows supported fix PRs for SCA issues, but not AI fix PRs for Static issues.
This release expands both coverage and control. At the CLI level, you can now choose which assessment types generate fix PRs: SCA only, Static only, or both. Static AI fix PRs are also now available through the Jenkins plug-in and Black Duck Security Setup workflows, extending those integrations beyond the SCA fix PRs they already supported. In Jenkins and the setup workflows, enabling fix PRs turns them on for both SCA and Static issues together.
Teams that want assessment-specific control can use the Polaris UI or CLI to enable fix PRs for SCA only, Static only, or both. Teams using the Jenkins plug-in or Black Duck Security Setup workflows—which support GitHub, GitLab, Azure, and Bitbucket—can now add Static AI fix PRs to their existing SCA remediation workflow, with both types enabled through the same fix PR setting.
[Figure 2. Fix PR configuration across the Polaris UI, CLI, Jenkins plug-in, and Black Duck Security Setup workflows, including scan-type-specific control in the UI and CLI and combined SCA and Static enablement in Jenkins and setup workflows.]
Key capabilities
- Assessment-specific control in the Polaris UI and CLI: Choose whether fix PRs are generated for SCA only, Static only, or both, so automated remediation aligns with your team’s priorities.
- Static AI fix PRs in Jenkins and Black Duck Security Setup workflows: Add AI-generated code fixes for eligible fAST Static vulnerabilities through the same integrations that already supported SCA fix PRs. Enabling fix PRs in these surfaces turns them on for both SCA and Static issues.
- Expanded automation across supported SCM platforms: Bring SCA and Static fix PRs into existing development workflows across GitHub, GitLab, Azure, and Bitbucket, while using the Polaris UI or CLI when you need assessment-specific control.
Container scan initiation and automation: Trigger container scans from wherever you work
Source code scanning is common, but the final container image often includes third-party binaries, libraries, and OS-level components that never get analyzed during the build phase. Relying on manual workarounds or separate, disconnected tools to scan those images creates friction and leads to a fragmented view of risk across the application life cycle. DevOps engineers and security teams lose time reconciling disparate reports and may miss critical vulnerabilities hidden in container layers.
Polaris now lets you trigger and automate scans from wherever you work. Whether you run scans through GitHub Actions, GitLab templates, Jenkins, Azure DevOps (ADO) extensions, the CLI, or Black Duck Security Setup workflows, the experience stays consistent. Configure your pipeline or workflow to pass the container image path and a unique container name, and Polaris handles the rest. Results surface in the same Polaris platform alongside your source, binary, package manager, and signature scans, giving you one unified view for all SCA findings.
Unlike standalone container security tools, Polaris provides a unified SCA experience, so container risk is managed in the same place as the rest of your application, from code to container.
[Figure 3. Container scanning triggered from CI/CD pipelines and Black Duck Security Setup workflows, OR results surfaced in the Polaris platform from those scans.]
Key capabilities
- Multichannel scan initiation: Trigger container scans from GitHub Action, GitLab template, Jenkins plug-in, Bitbucket pipe, ADO extension, the CLI, or Black Duck Security Setup workflows using your existing pipeline configuration. Container scanning works alongside your other scan types, so security policies and reporting stay consistent across the entire software supply chain, from code to container.
- Layer-level risk analysis: See exactly which container layer introduced a specific vulnerability or component, so you can target remediation precisely.
- Unified component inventory: Container scan findings combine with binary, package manager, and signature scan results into one actionable view, so you can understand total deployment risk without jumping between tools.
GitHub Enterprise Cloud with data residency: Onboard regional GitHub tenants and scan within your compliance boundaries
If you’re a GitHub Enterprise Cloud (GHEC) customer with data residency, you’ve been blocked from using Polaris. Existing integrations default to the standard global API host, which is incompatible with regional data residency tenants. Security teams and developers in highly regulated industries, especially in the EU, must keep source code metadata within specific compliance boundaries. Without data residency support, they’ve had to rely on manual workarounds that increase compliance risk and fragment their security posture.
Polaris now supports GHEC tenants with data residency. You can connect your customer-specific regional GitHub host, and Polaris automatically routes API calls to the correct regional endpoints. Onboard repositories and run automated security scans while keeping source code metadata within your compliance boundaries, whether you work from the CLI, GitHub Actions, or the Polaris UI.
[Figure 4. Onboarding a GitHub Enterprise Cloud tenant with data residency in the Polaris UI.]
Key capabilities
- Regional data residency support: Connect your customer-specific GitHub regional host instead of defaulting to the global API, so teams in regulated industries can adopt Polaris without violating data sovereignty requirements.
- Automated API routing: Polaris derives the correct regional endpoints for your tenant automatically, so you don’t need manual configuration workarounds or custom integration scripts.
- Multichannel onboarding: Onboard through the CLI, GitHub Actions, or the Polaris UI, whichever fits your team’s workflow, so you can integrate data residency tenants without changing how you already work.
- Compliance-bound scanning: Run automated security scans while keeping source code metadata within regional data sovereignty boundaries, so your scanning strategy stays aligned with your compliance obligations.
Bringing it together
This release extends fix PR flexibility to the CLI, the Jenkins plug-in, and Black Duck Security Setup workflows, lets you trigger container scans from wherever you work through CI/CD pipelines and Black Duck Security Setup workflows, supports GitHub Enterprise Cloud tenants with data residency, and delivers security analysis for AI frameworks and the latest languages. Together, these enhancements help you see risk across every layer of your application, scale scanning without scaling the manual effort, automate only the remediations you trust, and ship secure code without slowing down the development life cycle.
Log in to Polaris to explore these updates. For more details, check out our full release documentation or visit our Polaris YouTube channel.
