Summary
Between April 10 and April 14, 2026, some customers saw SAST scans and findings generated for branches that were not included in their configured branch-scanning settings. This resulted in unexpected findings, including duplicates and false positives, appearing in the product. The issue was caused by a recent update to the branch-scanning control logic that did not correctly apply customers’ branch configuration during that period. The scanning behavior was corrected on April 14, 2026, and the incident was fully resolved on April 27, 2026 after the unintended findings were removed.
Key Timeline (IDT)
April 10, 2026, 09:33 IDT — A production update introduced incorrect handling of branch-scanning configuration for some SAST events.
April 14, 2026, 13:48 IDT — A subsequent update restored expected enforcement of configured branch-scanning rules.
April 21, 2026, 19:00 IDT — Customer reports alerted us to unexpected SAST findings on non-configured branches.
April 22, 2026, 13:52 IDT — Root cause identified; scope assessment initiated.
April 23, 2026, 18:13 IDT — Impact analysis tooling executed to identify affected data and tenants.
April 27, 2026, 14:30 IDT — Cleanup completed; unintended findings removed and incident fully remediated.
Root Cause
A product update introduced an issue in the branch-scanning configuration check, causing the system to create SAST scans for branches outside of customer-defined scanning rules for a limited period (April 10–14). These extra scans produced unintended findings, which became visible to customers as additional or duplicate items.
Actions Taken
Restored correct enforcement of customers’ configured branch-scanning rules.
Assessed the scope of the impact across affected environments.
Removed unintended SAST findings created for non-configured branches.
Confirmed expected behavior after cleanup.
Action Items
Improve validation and safeguards around branch-scanning configuration checks during updates.
Enhance monitoring to detect unexpected increases in scan volume or findings.
Strengthen release checks for feature-gated behavior to prevent similar regressions.
Resolved
Summary
Between April 10 and April 14, 2026, some customers saw SAST scans and findings generated for branches that were not included in their configured branch-scanning settings. This resulted in unexpected findings, including duplicates and false positives, appearing in the product. The issue was caused by a recent update to the branch-scanning control logic that did not correctly apply customers’ branch configuration during that period. The scanning behavior was corrected on April 14, 2026, and the incident was fully resolved on April 27, 2026 after the unintended findings were removed.
Key Timeline (IDT)
April 10, 2026, 09:33 IDT — A production update introduced incorrect handling of branch-scanning configuration for some SAST events.
April 14, 2026, 13:48 IDT — A subsequent update restored expected enforcement of configured branch-scanning rules.
April 21, 2026, 19:00 IDT — Customer reports alerted us to unexpected SAST findings on non-configured branches.
April 22, 2026, 13:52 IDT — Root cause identified; scope assessment initiated.
April 23, 2026, 18:13 IDT — Impact analysis tooling executed to identify affected data and tenants.
April 27, 2026, 14:30 IDT — Cleanup completed; unintended findings removed and incident fully remediated.
Root Cause
A product update introduced an issue in the branch-scanning configuration check, causing the system to create SAST scans for branches outside of customer-defined scanning rules for a limited period (April 10–14). These extra scans produced unintended findings, which became visible to customers as additional or duplicate items.
Actions Taken
Restored correct enforcement of customers’ configured branch-scanning rules.
Assessed the scope of the impact across affected environments.
Removed unintended SAST findings created for non-configured branches.
Confirmed expected behavior after cleanup.
Action Items
Improve validation and safeguards around branch-scanning configuration checks during updates.
Enhance monitoring to detect unexpected increases in scan volume or findings.
Strengthen release checks for feature-gated behavior to prevent similar regressions.
Investigating
A production update introduced incorrect handling of branch-scanning configuration for some SAST events.