Increment the events available to be audit via Codacy's API audit logs feature.

See all events available

New tool version to be added to Codacy

New tool version to be added to Codacy

Codacy to integrate with GitHub entreprise features.

Create the possibility of auditing what, when and who did what action in Codacy.

See all events available

Discover lurking security vulnerabilities with pen-testing from certified experts.

• Achieve compliance: Meet ISO 27001, PCI DSS, GDPR, SOC2 requirements & more.

• Find issues SAST can't find: Find and fix security vulnerabilities that aren't found by the tools you already have in place.

• Included in the Codacy Security solution: Leverage your Codacy subscription to get a discounted pen-testing scan.

An IntelliJ extension to review Codacy issues in your pull request flow, seeing issues that were introduced on a pull request reported right on the file in the IDE.

We're working on reducing the time the Coverage status checks take to be delivered to git providers.

App improvements

Codacy is now better at identifying security issues through code scanning with the integration of Semgrep.

• ~2k new Security rules across multiple languages, prioritizing C#, Python, Java, and Javascript/Typescript

• Comprehensive OWASP Top 10 coverage

• Provide the same rules as FindSecBugs and gosec (client-side tools) in the Cloud by default, without any configuration. (Java, Scala, and Go)

Insecure dependencies detection, also called Software Composition Analysis (SCA), is a crucial security practice that involves identifying insecure open-source components used as either direct or transitive dependencies of software applications.

Our goal is to continue to increase the visibility of common vulnerabilities and exposures (CVE), allowing you to strengthen your organization's security posture and mitigate risks by identifying and solving security issues faster.

By combining insecure dependencies detection with static application security testing and secret detection, Codacy now gives you a more comprehensive range of vulnerability scanning to help you get complete security coverage of your applications.

Codacy now supports secret scanning.

Secret detection is a key security practice that involves the identification of sensitive information within the source code of software applications. These sensitive details often include passwords, API keys, cryptographic secrets, and other confidential data. The process of secret detection offers several significant benefits, making it an indispensable component of modern application security.

We're working on Increasing the visibility over new security issues introduced to avoid letting vulnerabilities from being introduced unnoticed or left to rot in their codebases.

The new Slack integration will allow you allow to solve security issues faster.

Allow non organization owners in provider to manage organization level configuration in Codacy.

If users commit with different emails that are correctly listed on their git provider account, they will be merged and occupy a single seat without needing to sign up for Codacy.

We've removed the request to read and write users' SSH keys which were previously required for the "Clone submodules" feature. For repositories with submodules, SSH keys now need to be manually managed.

We're adding support for Rust by integrating with Semgrep.

We've identified that Incidents are the hardest event type to ingest into Pulse, and that as a consequence, most users don't have a way of measuring the Time to recover and Change failure rate Accelerate metrics.

To help with this, we'll detect Incidents from Jira tickets. Any ticket assigned with the label 'Incident' will be considered an Incident. We'll infer how long the Incident took and calculate the Time to recover based on how long the ticket was open.

We'll also resort to the native 'Components' field, from where we'll be able to understand which repositories were impacted by the outage.

For users that are already collecting Incidents, this feature will be disabled by default, but you can opt-in at any time.

When selecting the 'Semantic version tags' option for the Deployment detection strategy configuration, it'll be possible to import historical data, for up to 1 year, giving you the ability to see metrics without having to wait for them to accumulate.

This feature will be available for the GitHub integration.

We've identified that Incidents are the hardest event type to ingest into Pulse, and that as a consequence, most users don't have a way of measuring the Time to recover and Change failure rate Accelerate metrics.

To help with this, we'll detect Incidents every time you revert a pull request. Git providers offer native support for this operation through their UIs. We'll also be able to understand which pull request is being reverted, giving us a way to infer how long the Incident took to calculate the Time to recover.

Pulse can also detect Incidents from arbitrary pull requests. You can configure a prefix that identifies a branch name or pull request title to match the naming convention of what is a rollback or hotfix in your workflow.

For users that are already collecting Incidents, this feature will be disabled by default, but you can opt-in at any time.

We are currently improving the way (and the data) we collect when users decide to remove or delete organizations from Codacy. We believe it is critical to learn from our users - and with this, it is critical that we learn from anyone that is deciding to stop using Codacy, this will help us to understand where to improve.

What will be different?

For organizations canceling a plan or being deleted, we will request the Owner doing that action to let us know why they joined Codacy in the first place and why are they leaving the platform - this will allow us to understand specific use cases that we are not properly serving our users. Additionally, users will be able to provide extra feedback if they are up for it. We are always thankful to learn more from you.