What Checkmarx/kics shipped
Written by FoxPlug from the repository's own releases; not affiliated with Kics. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/Checkmarx/kics; Kics did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Fixed false positives in the Terraform and AWS Network ACL queries for unrestricted RDP and SSH access when the protocol was set to tcp with an open CIDR block. Pull request #8151
- Fixed a false positive in the OpenAPI Security Operations Empty Object Definition query that flagged empty objects in an operation's security array. Pull request #8159
- Fixed a false positive in the OpenAPI Response Code Missing query so an operation that overrides top level security is no longer required to declare 401 and 403 responses. Pull request #8160
- Completed the fallback case in the OpenAPI Response Code Missing query so operations without their own security field still inherit the top level value. Pull request #8168
- Changed release automation to push with a GitHub App token so the prepare-release, update-docs-queries and update-docs-release jobs can update branches under the repository ruleset and push to gh-pages. Pull request #8164
- Updated the Go and Git images used for Dockerfile vulnerability scanning to their newly released versions. Pull request #8165
Why it matters
This week removed several false positives in the OpenAPI and Terraform/AWS queries, so scan results should be quieter for teams relying on these checks. The release automation change addresses failed pushes and missing credentials in the documentation and release jobs. Together these reduce noise and keep published query documentation and release artifacts flowing.
Changelog entry
- Fix(queries): fixed false positive on Terraform/AWS Network ACL with unrestricted access to RDP/SSH queries Pull request #8151
- Fix(query): fixed false positive on Security Operations Empty Object Definition for OpenAPI Pull request #8159
- Fix(query): fixed false positive on Response Code Missing query for OpenAPI Pull request #8160
- Fix(query): added the missing fallback case to the Response Code Missing query for OpenAPI Pull request #8168
- Ci(release): use a GitHub App token for release automation pushes Pull request #8164
- Fix(vulnerabilities): update Go and Git Dockerfile images to new released versions Pull request #8165
This week in Kics: fewer false positives in the OpenAPI Security Operations Empty Object Definition and Response Code Missing queries, plus the Terraform/AWS Network ACL checks for unrestricted RDP and SSH. Release automation now pushes with a GitHub App token.
This week brought query accuracy fixes and a release automation change. False positives were fixed in the OpenAPI Security Operations Empty Object Definition query and in the OpenAPI Response Code Missing query, where operations that override top level security are no longer incorrectly required to declare 401 and 403 responses. The fallback case for operations that inherit top level security was also completed. On the Terraform and AWS side, the Network ACL With Unrestricted Access to RDP and SSH queries no longer report when protocol is tcp with an open CIDR block. Release automation now uses a GitHub App token so the release preparation and documentation jobs can push under the repository ruleset and to gh-pages. Dockerfile scanning images for Go and Git were updated to their new releas
Week of September 28, 2026
What shipped
- Fixed a data race in dockerfile line detection that could cause panics when scanning multiple dockerfiles concurrently. Pull request #8121
- Improved dockerfile query coverage for detecting when the last user is root by adding missing valid USER directive formats. Pull request #8123
- Fixed passwords and secrets queries to reduce false positives, particularly for proto files. Pull request #8117
- Renamed and clarified the CMD and ENTRYPOINT query to properly reflect that it checks for exec form instead of shell form usage. Pull request #8131
- Clarified in documentation that riskScore in query metadata must be a string numeric value. Pull request #8138
- Updated opentelemetry package versions to fix vulnerabilities. Pull request #8137
- Fixed parse error for terraform files with duplicate resource names in the azure
sql_database_without_data_encryptionquery. Pull request #7962 - Standardized kicsbot automation branch names under the feature/kicsbot-* pattern to comply with org rulesets. Pull request #8129
Why it matters
This week addresses critical concurrency issues that could crash the scanner, improves detection accuracy across multiple query types, and fixes infrastructure automation. These changes make scans more reliable and reduce false positives that users need to triage.
Changelog entry
- Fix data race in dockerfile line detection for multiple dockerfiles projects that could cause runtime panics Pull request #8121
- Improve dockerfile root user detection query to cover additional USER directive formats Pull request #8123
- Fix passwords and secrets queries to reduce false positives Pull request #8117
- Clarify CMD and ENTRYPOINT query to check for proper exec form usage Pull request #8131
- Document that riskScore in query metadata must be a string numeric value Pull request #8138
- Update opentelemetry dependencies to fix vulnerabilities Pull request #8137
- Fix parse error for terraform files with duplicate resource names Pull request #7962
- Standardize kicsbot automation branch naming to feature/kicsbot-* pattern Pull request #8129
Weekly update: fixed a concurrency panic in dockerfile scanning, improved root user detection, reduced false positives in secrets queries, and clarified query metadata requirements.
This week's kics improvements focus on reliability and accuracy. A critical data race fix prevents panics during concurrent dockerfile scanning. We've enhanced dockerfile security checks, reduced false positives in password detection, and clarified query metadata documentation. These changes make scans faster and more trustworthy for security teams.
Week of September 14, 2026
What shipped
- Release v2.2.0 shipped with updated queries catalog, new Synapse workspace queries, and a fix for the Last User is Root Dockerfile query. Release
- All Dockerfile queries now support case-insensitive matching of Dockerfile commands. Pull request #8115
- Fixed version checking to remove the extra 'v' prefix when fetching the latest available version. Pull request #8114
- Filesystem scanning now skips.cache files before they reach the parser, improving performance and reducing noise. Pull request #8112
- Queries catalog, index, and Dockerfile were updated for the 2.2.0 release. Pull request #8126
- Removed unused goreleaser configuration files from the release directory. Pull request #8122
Why it matters
V2.2.0 brings improved Dockerfile scanning with case-insensitive command support and new query coverage for Synapse workspaces. Performance improvements from skipping cache files and bug fixes to version detection make the scanner more reliable.
Changelog entry
- Release v2.2.0 with updated queries catalog and new Synapse workspace queries Release
- Fix: added missing case to Last User is Root Dockerfile query Release
- Fix: all Dockerfile queries now support case-insensitive matching of Dockerfile commands Pull request #8115
- Fix: filesystem scanning skips.cache extension files before parser processing Pull request #8112
- Fix: removed extra 'v' prefix from fetched version information Pull request #8114
- Chore: removed unused goreleaser configuration files Pull request #8122
V2.2.0 is out. Dockerfile queries now support case-insensitive matching, new Synapse workspace coverage added, and filesystem scanning skips cache files automatically.
Kics v2.2.0 is now available. This release improves Dockerfile scanning with case-insensitive command support, adds new queries for Synapse workspace security checks, and optimizes performance by skipping cache files during filesystem walks. Version detection and release tooling have also been refined.