Five changes went live in September. You can now record VEX statements on SBOM findings, share SBOM and HBOM files with approved trust portal viewers, choose which notifications reach you, and switch off or redirect your hosted portal.
Say when a component vulnerability does not affect your product
An SBOM scan often finds a vulnerable component that your product does not use in a dangerous way. Until now that finding stayed open. You can now give each finding a VEX status. The four values are not affected, affected, fixed and under investigation.
A "not affected" status needs a reason. Select one of the five standard CSAF 2.0 justifications, write an impact statement, or do both. The finding then stops counting as an open exposure. It is not deleted. If new evidence shows that attackers exploit the vulnerability, the portal alerts your team at once, so a "not affected" decision gets a second look.
You can export all the statements for a product as one CSAF 2.0 VEX document. Administrators set statements. Members can read them. This feature is available on the Reporting plan and higher.
Where to find it: Settings, then SBOM Registry, then Vulnerability Findings & VEX Statements.
Advisories now also come as OpenVEX
Each published security advisory is now also available as an OpenVEX 0.2.0 document, next to the CSAF file. Both files come from the same advisory, so they state the same facts. Use the one that your customers' tools read.
Give approved viewers your supplier security evidence
Buyers ask suppliers for the same set of documents again and again. The trust portal product page now has a Supplier Security Evidence section that collects them in one place. It shows the security support end date, your disclosure policy and contact, your CSAF advisory and VEX feed, and your remediation targets by severity.
Approved viewers can also download a CycloneDX 1.6 SBOM, a CycloneDX 1.6 HBOM, and an evidence pack in JSON. The SBOM and HBOM downloads are off until you switch them on. To include hardware in the HBOM, link each hardware component to a product in the Hardware Registry. The trust portal is an Enterprise feature.
Where to find it: Products, then a product, then the Monitoring tab.
Choose which notifications reach you
A bell in the top bar now holds your notifications. You can mark items as read or archive them. Each person can set, for each type of notice, whether it arrives at once, in a daily digest, or not at all. You set this separately for the in-app inbox and for email.
Administrators can also send each type of notice, such as threat intelligence or CRA obligations, to a team mailbox. If you leave a type empty, it goes to your existing alert recipients. To follow one report or one product closely, select Watch on its page.
Where to find it: Settings, then Notifications. For your own choices, select the settings icon in the bell.
Switch off or redirect your hosted disclosure portal
Some companies already run their own vulnerability intake. You can now set your hosted portal to active, disabled or redirect. A disabled portal shows "page not found" and accepts no reports. A redirect sends visitors to your own intake page. A redirect requires a verified domain. Your dashboard and your CRA work keep working in every mode.
Where to find it: Settings, then General, then Public Intake Portal.
Change your password in the app
When an administrator adds you to the team, they set your first password. You can now replace it yourself. Enter your current password and a new one of at least 8 characters. The change ends every open session for your account, on every device, and you sign in again with the new password. Accounts that sign in with Google, GitHub, Microsoft or single sign-on have no password here, so the card does not show.
Where to find it: your workspace menu, then Account details, then Password.
A VEX statement or a shared evidence pack records your own assessment. It is not a conformity assessment. This note is not legal advice.