Polaris release update: Two-way bug tracker sync, AI-assisted fixes, scanning you can govern

Most AppSec friction is administrative. A vulnerability gets fixed, but the ticket stays open. A triage decision made in Jira never reaches Polaris. Code on an internal server can’t be scanned without a firewall exception. Three repositories scan against a config file nobody has updated in a year.

The latest Black Duck Polaris™ Platform release targets that overhead directly. You can now close the loop between Polaris and five bug trackers, extend secure tunnel connectivity to self-hosted SCMs and internal Jira, centralize how scan rules are defined and enforced, and turn eligible SAST findings into AI-assisted pull requests your developers can review and merge.

AI-driven security and automation: From understanding the risk to shipping the fix

AI-driven Static fix pull requests: AI-assisted fixes and the policy context behind them

Two questions eat a developer’s time on every finding: how do I fix this, and why was it flagged? Polaris now answers both. SAST fix pull requests generate AI-assisted code fixes for eligible findings and submit them straight to your repository. And a new View issue policies action shows which policies, compliance requirements, and governance rules are attached to a finding. Security teams can trigger fix PRs from policy actions or on demand in the UI; DevOps teams can generate them in line with their builds through the Bridge CLI. Both paths use the same Black Duck Assist AI and produce the same PR template.

Key capabilities

• Policy-driven and on-demand fix PRs: Automate fix PR creation through issue policy actions, or generate them from the UI individually or in bulk. If a scan was triggered by an existing PR, Polaris does not stack a fix PR on top of it.
• CI-native fix PR creation through the Bridge CLI: Teams running Polaris scans in GitHub Actions, GitLab CI, Bitbucket pipelines, Jenkins, or Azure DevOps can enable fix PRs directly in their pipeline configuration. Generate fixes and open PRs as part of the build, without relying on server-side scheduling.
• Granular controls that respect your teams: Enable or disable fix PRs at branch, project, application, or organization level with inheritance; cap open PRs per branch or per run; and filter eligible issues by CWE, issue type, language, and file pattern.
• Pull requests developers can evaluate: Each fix PR includes severity, CWE label, file path, a vulnerability summary specific to that instance, an AI-generated explanation of the fix, the code diff applied at the right line, and a link back to Polaris.
• Multi-SCM support with full auditability: Full auditability is available across GitHub, GitLab, Azure DevOps, and Bitbucket, and a dedicated permission will gate on-demand creation and log every event.
  
  

Developer-first workflow and integrations: Security that meets your workflows where they are

Bidirectional synchronization: Two-way sync across five bug trackers

A finding gets fixed in Polaris. The ticket stays open in Jira. A developer closes a work item in Azure Boards but Polaris isn’t informed about it. One-way integrations create drift, and someone has to reconcile them by hand. Polaris now synchronizes in both directions with GitLab Issues, GitHub Issues, Jira, ServiceNow, and Azure Boards, so triage states, ticket statuses, and fix-by dates move automatically between systems.

Key capabilities

• Two-way status and triage sync: Triage and status changes propagate in both directions. GitLab Issues update in real time, Jira can change issue and triage status, GitHub Issues and ServiceNow map triage states to Open and Closed, and Azure Boards map to Proposed, Active, Resolved, and Closed, including dismissed substates.
• Fix-by date synchronization: Polaris fix-by changes can update due dates in Jira, ServiceNow, and Azure Boards, and due date changes sync back. Fix-by changes are also part of the bidirectional field set.
• Configurable, per-project mappings: Save reusable bug-tracking integration mappings across projects and workflows. Configure mappings per project, for all branches or the default branch only.
• Automatic ticket closure: Tickets close when linked issues are dismissed or absent in subsequent scans. If an issue reappears, Polaris creates a new ticket rather than reopening the old one, keeping audit trails clean.
• Governance built in: Configuration changes and sync activity are preserved in audit logs and triage history. Role-based access control (RBAC) determines who configures mappings, and setup errors appear with clear notifications instead of failing silently.
  
  

Bug-tracking integrations: Three new trackers, plus deeper Jira configuration

Security teams shouldn’t have to pick a tracker that suits the security tool. GitLab Issues, GitHub Issues, and ServiceNow all join the ecosystem as native integrations, letting teams export, link, and manage Polaris findings from the systems their organizations already run on. Multiple bug-tracking systems can run in parallel within one organization, so one group can work in ServiceNow while another works in Jira, GitLab, or GitHub—and Jira integration itself becomes far more configurable.

Key capabilities

• Flexible export options: Export individual or multiple issues to GitLab Issues, GitHub Issues, or ServiceNow. You can bundle selected issues into a single ServiceNow ticket or create one per issue and send policy violations directly to GitLab Issues.
• Policy-driven issue creation: Send findings to bug-tracking tickets automatically based on organizational process, so ticket creation doesn’t wait on someone remembering to export.
• Full ticket life cycle management: Link, unlink, bulk unlink, and reassign tickets. Import existing ServiceNow tickets with validation and share ticket links across branches, so an issue appearing in multiple branches maps to one ticket.
• Auto-close and audit transparency: Tickets close automatically when findings are remediated or dismissed. Configure across all branches or the default branch, with every configuration change logged.
• Configurable Jira field mapping and ticket content: Map Polaris issue data to standard or custom Jira fields and customize ticket descriptions, so teams keep the Jira projects, workflows, and governance processes they already run rather than reshaping them to fit the tool.
  
  

On-premises connectivity: Secure tunnel access to internal SCMs and Jira

Self-hosted infrastructure shouldn’t mean second-class security coverage—or a firewall exception request every time. Polaris extends secure tunnel connectivity to self-hosted Azure DevOps Server, GitLab Self-Managed, and Bitbucket Server and Data Center, alongside on-premises Jira for ticket export.

Key capabilities

• No inbound firewall changes: Persistent, outbound-only encrypted connections are built on the Bridge CLI and Teleport infrastructure, removing the network admin dependency that previously slowed deployments.
• Repository discovery and onboarding: Polaris discovers and onboards repositories across ADO projects, GitLab groups, and the Bitbucket project hierarchy individually or in bulk, with PAT or OAuth authentication.
• Automated scans and PR decoration: Webhooks trigger SAST and SCA scans on push, branch creation, and pull or merge request activity, with results posted directly on PRs and MRs, including severity breakdowns and Code Insights reports for Bitbucket.
• Fix and fail PR support: Full fix and fail workflows are available across all three newly supported self-hosted platforms.
• Enterprise-ready Jira connectivity: On-prem Jira configuration happens at the connection level with multitunnel support, and RBAC restricts tunnel setup to org admins. Polaris also provides full audit logging.
  
  

Governance and compliance: One source of truth for how scans run

Central rule configuration: Consistent, enforced scanning without the YAML sprawl

Ask 10 repositories how they’re configured to scan and you’re likely to get 10 different answers. Per-repository config files drift, get copied with mistakes intact, and quietly stop matching what security requires. Polaris replaces that sprawl with a single source of truth. Central rule configuration lets security teams define rule profiles centrally, and they are enforced across CI pipelines, CLI scans, and integrations automatically.

Key capabilities

• Hierarchical profiles with inheritance: Polaris enables you to apply mandatory rule profiles at organization, application, project, or branch level, with inheritance providing global guardrails and room for controlled local tuning.
• Automatic enforcement everywhere scans run: Central configurations apply across CI, CLI, and integrations—no per-pipeline setup, no developer intervention, no YAML to keep in sync.
• Governance built in: RBAC, audit trails, version awareness, and visibility into which profiles were used for each scan let teams demonstrate what ran, where, and under whose authority.
  
  

Comprehensive scanning with depth and accuracy: Broader coverage, sharper detection

Rapid Scan Static engine update: Expanded Scala coverage and sharper detection

Detection only matters if it keeps up with the languages your teams actually ship. The Rapid Scan Static engine expands Scala coverage significantly in this release, alongside accuracy improvements that reduce findings not worth a developer’s attention.

Key capabilities

• Expanded Scala detection: Seven existing Java JWT checks covering algorithm confusion, nonexpiring tokens, ignored expiration and start times, missing claims validation, and untrusted decoding now apply to Scala.
• New Scala web security checks: Six new checks target permissive and credentialed CORS origins, excessive preflight age, missing TLS, and disabled security headers across http4s and Play.
• New crypto bits hardcoded secrets detection: Added a new crypto bits private key pattern to improve detection of embedded cryptographic private keys within source code and configuration files. This helps organizations identify and remediate credential exposure risks earlier in the development life cycle, reducing the likelihood of sensitive key material being committed to repositories.
• Current language version support: Added support for Go 1.26 and Dart 3.11, ensuring accurate security scanning and continued compatibility for teams adopting the latest language releases.
• Accuracy improvements that cut noise: Android database access and file permission checks have been modified for accuracy, and file path checks no longer report issues on empty files.
  
  

fAST SCA engine update: New package managers and more complete SBOMs

Open source risk you can’t see isn’t risk you’ve avoided. If a package manager falls outside what your SCA tooling supports, those dependencies never appear—and neither do their vulnerabilities. This update adds four new detectors, extends coverage across eight ecosystems, and aligns scan behavior so CI, code upload, and SCM workflows all produce consistent results.

Key capabilities

• New package manager support: The update includes UV for Python, Rush monorepo tooling, a tree-based detector for Conda environments, and dependency extraction for Ant and Ivy projects.
• Extended ecosystem coverage: Polaris now providesupdated support across Poetry, pnpm, SBT, SetupTools, and Bazel 9, plus .slnx solution files for NuGet, buildless go.mod analysis for Go, and Cargo workspace support with include and exclude controls.
• More complete, more reliable SBOMs: Fixes eliminate duplicate unversioned NuGet components, npm components silently dropped when no version is specified, Go module infinite loops on circular dependencies, and upload failures in proxied environments.
  
  

Closing the loops between detection, decisions, and delivery

The through-line in this release is straightforward: Security data should reach the people who act on it, in the systems they already work in, without anyone having to act as a courier.

• Bidirectional sync keeps Polaris and your tracker telling the same story down to the counts in your dashboards.
• Secure tunnels bring internal Jira and self-hosted repositories into that same loop without a network exception.
• Central rule configuration ensures the rules your scans run on are defined once, enforced everywhere, and provable when someone asks.
• AI-assisted fix PRs close the last gap, turning a finding you understand into a change you can review and merge.
• Engine updates to Rapid Scan Static and fAST SCA keep detection current with the languages and package ecosystems your team’s ship.

Ready to explore these enhancements? Log into Polaris today to configure bidirectional sync, generate your first AI-assisted fix PR, or set up a central rule profile. For more details, check out our full release documentation or visit our Polaris YouTube channel.