> For the complete documentation index, see [llms.txt](https://docs.gomboc.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gomboc.ai/changelog.md). # Changelog ### Hosted MCP Server, Audit Findings, and Portal Improvements July 20, 2026 `New` A packed couple of weeks across the platform — a new hosted MCP server, end-to-end Audit Findings, and a set of scanning reliability improvements. **Hosted Gomboc MCP Server.** Gomboc now offers a hosted MCP (Model Context Protocol) server, live at `mcp.app.gomboc.ai`. Any MCP-compatible client — such as Claude Code, Cursor, Gemini CLI, or OpenAI Codex — can connect directly to Gomboc without running a local server or managing containers. Authentication uses your existing Gomboc access token, which is passed through securely to the Gomboc Rules Service. The initial release exposes rule search, letting agents query the Gomboc rule library on demand, and establishes the hosted foundation for a growing set of tools. To see how this fits alongside our local skills, see [Agent Skills](https://docs.gomboc.ai/orl/agent-skills). **Audit Findings, end-to-end.** Violations that ORL detects but does not (or cannot) auto-remediate are now surfaced with full context instead of being left out. A new `orl audit` command scans a workspace for rule violations in a non-destructive, dry-run mode and outputs results in a standard linter format (`file:line:column - message`). It never modifies your files and returns a non-zero exit code when violations are found, so it drops cleanly into a [CI pipeline](https://docs.gomboc.ai/integrations/continuous-integration-ci-build-systems) as a gate. In the Portal, the [Scan Results](https://docs.gomboc.ai/scan-results) screen now displays these audit findings alongside remediated ones — each with a severity level, the rule's violation message, precise line-and-column coordinates, and a read-only view of the original source context — giving developers and security engineers a clear way to inspect and triage outstanding issues. **Scanning reliability and consistency.** We shipped a set of improvements to make scans more dependable and results consistent everywhere: * Accurate scan status: scans that fail after retries now correctly report as failed instead of getting stuck showing "In Progress." * No more silent empty scans: a rules-service timeout no longer lets a scan quietly complete with zero rules applied. * Consistent reports across surfaces: ORL reports are now parsed and stored the same way regardless of origin, so results look identical whether a scan comes from the [IDE](https://docs.gomboc.ai/integrations/vscode-plugin), the [GitHub Action](https://docs.gomboc.ai/integrations/continuous-integration-ci-build-systems/github-actions), or [Agent Skills](https://docs.gomboc.ai/orl/agent-skills). * Faster handling of large YAML files during scanning. * [Community Skills](https://docs.gomboc.ai/orl/agent-skills/gomboc-community-skills) (Claude plugin) now write run activity logs to your Gomboc run history. *** ### Agent Skills and Portal: Closed-Loop Reporting July 8, 2026 `Improvement` Gomboc agent skills — running inside Claude Code, Gemini CLI, OpenAI Codex, or Cursor — now report their results directly back to the Gomboc Portal. When an agent completes a remediation run, the Portal run history captures the full ORL report, the duration, and a direct link to the fix PR opened by the agent. This closes the loop between local IDE work and the centralised visibility that security and platform teams need. Alongside this, the plugin installer now includes an OS-aware setup skill that verifies and installs all required dependencies automatically on first run, across macOS, Debian/Ubuntu, Red Hat/Fedora, and Windows (WSL). Getting a coding agent connected to Gomboc no longer requires manual dependency troubleshooting. See the [Agent Skills documentation](https://docs.gomboc.ai/orl/agent-skills) and the [Gomboc Enterprise Skills](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills) guide for setup instructions. *** ### New ORL Rules: Python, Django, TypeScript, and Node.js June 30, 2026 `New` Gomboc has expanded its ORL rule library to cover OWASP Top 10 use cases for **Python and Django** and for **TypeScript with Node.js, Express, and NestJS**. These rulesets extend Gomboc's automated remediation capabilities beyond infrastructure-as-code into application code, enabling teams to detect and fix common web application security issues using the same ORL engine already scanning their IaC. This is part of Gomboc's ongoing expansion of coverage across languages and frameworks. For an overview of what ORL can scan and remediate today, see the [Gomboc Playbook](https://docs.gomboc.ai/gomboc-playbook). *** ### Workspace-level Exception Management June 29, 2026 `New` It is now possible to suppress specific findings at the **workspace level**, rather than applying exceptions account-wide. When a finding is not applicable to a particular workspace — for example, a rule that does not fit a specific environment's configuration — teams can now mark it as an exception scoped only to that workspace, leaving other workspaces unaffected. This gives platform and security teams more granular control over what gets reported and acted on in each environment. Exceptions can be managed directly from the workspace view in the Portal. See the [Workspaces documentation](https://docs.gomboc.ai/workspaces) for details. *** ### Community Skills: Full Parity Across All Coding Agents June 16, 2026 `Improvement` The [Gomboc Community Skills](https://docs.gomboc.ai/orl/agent-skills/gomboc-community-skills) plugin now fully supports **Cursor**, **OpenAI Codex**, **Gemini CLI**, and **Claude Code** — all four major coding agent platforms — with verified installation paths and consistent command behaviour across each. Previously, some platforms had gaps or untested configurations; all are now at parity and covered in the documentation. At the same time, the agentic remediation loop has been extended end-to-end: a coding agent can now run a full `diagnose → fix → push PR → publish rule → repeat` cycle autonomously on a codebase, stopping for user input only at key decision points. This is the same loop described in the [Policy Enforcement Loop](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/policy-enforcement-loop) documentation and is available to both Community and Enterprise skill users. *** ### Portal: Selective Fix Delivery by Rule or by Finding June 16, 2026 `New` When reviewing scan results in the Portal, users can now choose **exactly which fixes to apply** before a pull request is generated — either by selecting individual rules or individual findings within a rule. Previously, applying a scan result meant applying all available fixes at once. The new selection model gives developers and security reviewers full control over what goes into each fix PR, making it easier to stage remediation incrementally or to exclude fixes that require additional review. This feature is available directly in the scan results view for all workspace runs. ### GitHub Actions: ORL Runner with Inline PR Comments June 11, 2026 `New` We shipped a new self-contained GitHub Action — `on-pull-request-runner` — that runs ORL directly inside your GitHub runner without requiring repository registration or any manual linking in the Gomboc Portal. The only setup needed is a `GOMBOC_ACCESS_TOKEN` stored as a GitHub Actions secret. The action supports two modes: **audit** (posts inline review comments on every changed line with a finding, plus a PR summary comment) and **remediate** (opens a stacked pull request with the applied fixes targeting your feature branch). You can set `fail-on-findings: true` to block the pipeline when issues are detected, making it straightforward to enforce security policy as a required CI gate. The action works across all 38+ languages supported by ORL, covering IaC, application code, and configuration formats. Setup and YAML examples for both modes are in the [GitHub Actions documentation](https://docs.gomboc.ai/integrations/continuous-integration-ci-build-systems/github-actions). *** ### Agentic CSPM Triage: From Wiz Alert to Code Fix and PR June 9, 2026 `New` The Gomboc CSPM Triage Loop connects live cloud security alerts from Wiz directly to the infrastructure code that caused them, and automates the full remediation cycle in a single skill invocation. A developer passes a Wiz alert ID or permalink to the `/cspm-triage` command in their coding agent (Claude Code, Gemini CLI, Codex, or Cursor) — the skill fetches the alert, matches it to the affected IaC code, builds or reuses an ORL rule, applies the fix, opens a GitHub pull request, and posts a timestamped resolution note back to the Wiz observation so security teams have full traceability. The loop uses a 4-tier fallback model so it degrades gracefully: if local IaC code isn't available yet, it completes the classification and triage brief and lets you resume later when the source path is provided. Code match confidence is scored (HIGH / MEDIUM / LOW) before any rule is built or released, preventing rules from being created for alerts that don't trace to the provided code. Triage findings — including observation metadata, rule details, Git attribution, and PR link — are persisted as structured JSON artifacts in `.gomboc/triage/` and committed on the fix branch. See the full [CSPM Triage Loop documentation](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/cspm-triage-loop) and watch the [walkthrough video](https://www.youtube.com/watch?v=Dm_WxA_LsyQ). The Wiz integration setup is documented at [docs.gomboc.ai/integrations/cloud-security-posture-management-cspm/wiz](https://docs.gomboc.ai/integrations/cloud-security-posture-management-cspm/wiz). *** ### Gomboc Enterprise Skills: All Major Coding Agents Supported June 5, 2026 `New` Gomboc now ships official agent skill packages for [Agent Skills](https://docs.gomboc.ai/orl/agent-skills): [Claude](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/claude-enterprise), [Gemini](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/gemini-enterprise), [Codex](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/codex-enterprise), and [Cursor](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/cursor-enterprise) - giving engineers a unified way to run ORL-powered security and compliance workflows directly inside their coding environment. Each package delivers the full Gomboc enterprise skills suite: * `/fix` (analyze → build → apply a deterministic fix in-context) * `/new-policy` (create a classification from a policy document or standard) * `/new-rule` (full production-quality rule creation pipeline) * `/enforce-policy` (diagnose an entire codebase, cover gaps, apply fixes, and verify) * ...and more! > Enterprise customers receive the plugin as a zip package shared via Google Drive during onboarding. Community users can install the open-source plugin directly from [GitHub](https://github.com/Gomboc-AI/gomboc-community-skills). For an overview of all available skills and the full [Policy Enforcement Loop](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/policy-enforcement-loop), see [Agent Skills](https://docs.gomboc.ai/orl/agent-skills). *** ### Expanded Compliance Coverage: OWASP, ASVS 5.0, Kubernetes, and PCI DSS June 2, 2026 `New` We significantly expanded ORL's compliance rule coverage across four areas this quarter. We released a new ruleset targeting the **Kubernetes OWASP Top 10**, covering misconfiguration patterns in Kubernetes workloads and manifests — extending deterministic remediation beyond cloud IaC into Kubernetes security. We also shipped the full set of **OWASP Application Security Verification Standard (ASVS) 5.0 classifications**, mapped chapter by chapter, section by section, requirement by requirement, so rules and fixes can now map to the latest application security standard. Earlier in the quarter we released **OWASP Top 10** rules for Java and Spring Boot applications, and completed the full **PCI DSS → Gomboc Policy mapping** so teams with PCI compliance requirements can enforce and auto-fix relevant controls. All of these additions are available in the Policy Library and can be enabled in your Policy Sets. To get started, go to Policy Management → Policy Sets in the [Gomboc Portal](https://docs.gomboc.ai/policy-management/policy-sets) and enable the frameworks relevant to your environment. *** ### Policy Sets Backup and Version Control via API May 26, 2026 `New` You can now manage Policy Sets programmatically through the Gomboc Rules Service API, enabling GitOps workflows, automated daily backups, and environment promotion (e.g., copy a policy configuration from staging to production). The API supports export, batch upsert/restore, and per-policy-set CRUD operations — all authenticated via a personal access token from the Portal. This is useful for disaster recovery, audit trails (tracking every change to your policy configuration in Git history), and teams that prefer to store their compliance posture as code. A GitHub Actions workflow for automated daily backups ships ready to use in the documentation. Full guide and scripts at [Policy Sets: Backup and Version Control via API](https://docs.gomboc.ai/policy-management/policy-sets/policy-sets-backup-and-version-control-via-api). *** ### Agentic Rule Generation: End-to-End Pipeline May 19, 2026 `New` Platform engineers can now go from a policy document, CSPM finding, or compliance framework directly to a deployed ORL rule — end-to-end, without writing rule syntax by hand. The agentic rule generation pipeline analyzes policy intent, builds test cases, authors a deterministic ORL rule, validates it against the test suite, enriches metadata (classifications, risk scores, framework mappings), and publishes it to the Gomboc Rules Service — with human review steps built in at every stage. In this release cycle, we completed the full user story for generating ORL rules from Terraform IaC policy documentation, added **Terraform and CloudFormation variable support** in rule generation (so parameterized infrastructure is handled correctly), and converted all **890 HashiCorp Sentinel public policies** into ORL classifications and rules. A new `/convert-sentinel` skill is also available in the [Community Skills](https://docs.gomboc.ai/orl/agent-skills/gomboc-community-skills) plugin, letting any team port existing HCL Sentinel policies directly to ORL. To start generating and enforcing your own rules, see the [ORL Quickstart](https://docs.gomboc.ai/orl/quickstart) and the [Policy Enforcement Loop](https://docs.gomboc.ai/orl/agent-skills/gomboc-enterprise-skills/policy-enforcement-loop). > **Note on HCP Terraform Run Tasks:** As part of this release cycle, the [HCP Terraform Run Task integration](https://docs.gomboc.ai/integrations/cloud-orchestration/hcp-terraform) was migrated from legacy configuration options to native ORL-based policy evaluation, giving it the same deterministic enforcement and fix delivery capabilities as all other Gomboc scan surfaces. *** ### Portal and IDE: Data Library, Open in IDE, Workspace Archival, and More April 29, 2026 `Improvement` We shipped a series of usability improvements across the Portal and IDE extension, released through April: * **Data Library**: A new searchable page in the Portal for browsing rules, channels, and classifications in your account — making it easier to understand what's enforced and why. * **Open in IDE**: Jump from a scan report finding directly to the relevant file in your preferred editor, without leaving the Portal. * **Policy Library search**: A search box in the Policy Library lets you quickly find specific policies by name or keyword. * **Policy rule view**: Each policy now has a dedicated Rule view showing exactly what ORL is checking at the code level. * **Run History filters**: Improved filter UX on the Run History page so you can narrow results by workspace, status, and time range. * **Dashboard CSV export**: Exports now include start and end date columns. * **Configurable remediation timeout**: The IDE plugin now exposes a configurable timeout for fix execution, so long-running remediations don't silently fail. * **Workspace archival**: [Workspaces](https://docs.gomboc.ai/workspaces) that no longer exist in the source code repository are automatically archived, keeping your workspace list accurate without manual cleanup. For an overview of the daily workflows these improvements support, see the [Gomboc Playbook](https://docs.gomboc.ai/gomboc-playbook). *** ### Multi-language Support: ORL and IDE Go Beyond IaC April 10, 2026 `New` Gomboc now scans and fixes code beyond Terraform and CloudFormation. The IDE plugin, ORL engine, and scan workflows all gained multi-language awareness: ORL can recursively discover file types across a repository tree, detect the language for each target, and apply the right ruleset automatically. This release adds support for **Java, TypeScript/JavaScript, Python, Go, Bicep, and Kubernetes YAML** alongside all previously supported IaC formats — laying the foundation for applying deterministic ORL fixes to your full application stack, not just infrastructure. In the VSCode extension, the scan surface now covers any supported code file you open — not just `.tf` files — and Terragrunt is recognized in IDE diagnostics. Under the hood, language detection and report generation were centralized into a shared SDK so results are consistent across the IDE, the Portal, and CI scan workflows. See the [ORL documentation](https://docs.gomboc.ai/orl) for the full list of supported languages, and [Workspaces](https://docs.gomboc.ai/workspaces) for how scans map to your repository structure. *** ### Exception Handling for Policy Sets March 27, 2026 `New` Gomboc now supports Exception Handling in the Portal, giving teams a governed way to exclude specific rules from enforcement within selected Policy Sets when remediation is not the right action. Exceptions help reduce noise while preserving audit context: users can create an exception for one or more rule IDs, attach it to one or more Policy Sets, and provide a clear reason for why the rule should be bypassed. This is useful when a finding is already mitigated by another approved control, does not apply in a specific environment, or needs to be handled through a separate business process. Exceptions can be created from scan results or managed from the Exceptions page. See the [Exception Handling documentation](https://docs.gomboc.ai/policy-management/exception-handling) for setup guidance and best practices. *** ### ORL Custom Rules (turn guardrails into fixes) March 17, 2026 `New` Our custom rules let teams convert existing guardrails into actionable fixes, not just pass/fail checks. You can codify organization-specific policies (including conversions from existing policy investments) into deterministic remediation rules and apply them to the environments that matter, enabling “blocking mode” style enforcement in real pipelines. You can now **create your own deterministic remediation rules** using our **ORL engine,** so your existing internal guardrails (tagging standards, IAM patterns, encryption requirements, etc.) become **repeatable checks + auto-fixes**. Start with the [**Custom Rules Quickstart** guide here](/orl/quickstart.md). *** ### “Beyond IaC” demo/use cases March 9, 2026 `New` Gomboc now delivers **end-to-end, deterministic remediation across codebases -** not just IaC. The shift is powered by our **ORL-based engine**, which turns remediation intent into precise, repeatable diffs across many file types and languages, so teams can trust and operationalize fixes (reviewable, consistent, and scalable). To see this in action outside Terraform, start with this demo case: [Demo case Java with dolphinscheduler log4shell](/getting-started-ce/gomboc-demo-cases/demo-case-java-with-dolphinscheduler-log4shell.md) - it walks through scanning a real Java project (Apache DolphinScheduler), flagging a Log4j risk, then using the IDE Reviewer to **preview the diff**, apply the deterministic dependency change (replacing `slf4j-log4j12` with `slf4j-reload4j`), and **verify via re-scan** that the issue is resolved. *** ### Drift Reconciliation February 28, 2026 `New` We shipped drift reconciliation to keep cloud reality aligned with IaC. Gomboc maps IaC resources to live cloud resources, detects drift, and generates the exact deterministic code changes needed to reconcile differences, helping you preserve “break-glass” incident changes and avoid surprises over time. **Get started here:** [Drift Reconciliation (setup + steps).](/drift-reconciliation.md) *** ### ORL (Open Remediation Language) February 17, 2026 `New` We released ORL (Open Remediation Language) for our enterprise customers and the Gomboc Community Edition. **ORL is our new execution engine** that powers how Gomboc evaluates policies, detects issues, and generates deterministic fixes directly in your code. Instead of alerts or suggestions, ORL generates repeatable, policy-aligned code changes that engineers can safely apply, and it also lays the foundation for Custom Rules so teams can enforce, and deterministically fix, their own organization-specific controls the same way. If you want the full mental model (what ORL is, why it exists, how it maps Policies → Policy Sets → Rules → Findings/Fixes, and the core concepts like determinism + syntax trees + separation of concerns), read the [ORL overview here](/orl.md). *** ### New Reports and Analytics Page February 10, 2026 `New` **ROI metrics framed as Focus → Progress → Outcomes** The new Reports feature enables customers to easily track their fix burn-down, prioritize results, and report success to management. We added new reporting and analytics centered on the three stakeholder questions: **Where should we focus?** **Are we making progress?** **What did we achieve?** Reports highlight prioritized work, show burndown and trends over time, and summarize measurable impact (like fixes delivered and time saved) to make ROI clear and easy to communicate. Learn from our [case study](https://www.gomboc.ai/case-study/upwork-eliminates-iac-security-debt-with-gomboc) how you can save hours to you team. *** ### IDE Fix Reviewer (webview, diff preview, bulk apply patterns): January 22, 2026 `New` We introduced the Gomboc IDE Fix Reviewer (webview) to bring fixes directly into the developer workflow. It provides an in-IDE review surface with diff previews before changes are applied, plus bulk actions that let you multi-select findings and apply the same fix pattern across multiple files and occurrences—turning remediation into a fast, reviewable flow. **External findings ingest (e.g., Checkov) + verification** The Fix Reviewer can ingest external findings (for example, from Checkov) and map them into Gomboc’s deterministic remediation logic. After applying fixes, verification helps confirm the issue is actually resolved, identify false positives from third-party tools, and ensure the change matches the intended policies and rules. **To try it right now**, follow the [**VSCode Plugin setup**](/integrations/vscode-plugin.md) (install extension, add your personal token, enable scan-on-save), then run **`“Gomboc: Scan current file or scenario”`** and open **`“Gomboc: Reviewer (webview)”`** from the Command Palette. *** ### **Workspaces Tags** January 10, 2026 `New` We added workspace tagging to strengthen deterministic fix delivery and make remediation operational at scale. Workspace tags help you segment and route work simpler by letting teams group and filter workspaces by dimensions like team, application, environment, business unit, or compliance tier. This improves ownership and reporting! so leaders can quickly answer “what’s running where, who owns it, and what’s the remediation status?” across large numbers of repos and environments. *** ### **Policy Sets Per Environment Or Workspace** January 6, 2026 `New` You can create and apply **Policy Sets** for each environment (e.g., dev, staging, prod) and attach them to specific **workspaces**, so the right guardrails, and the right fixes, apply automatically wherever the code lives. Teams typically start with the **Gomboc default policy set** as a baseline, then tighten standards for production and create targeted sets for high-risk repos or critical services. Because policy is the control plane, fix configuration stays simple and consistent: results and fix reports roll up **by policy**, with **severity and risk-based prioritization**, and you can also align policies to known frameworks (e.g., CIS/NIST) and deliver **custom fixes** only to the environments that matter. *** ### **New Policy Management + Smart Prioritization** December 23, 2025 `New` We are shifting remediation from “a list of findings” to “fixes aligned with intent.” Teams can define what guardrails matter (by category, framework, internal standards, or tool-mapped policies), and Gomboc consistently generates deterministic fixes that match those guardrails. The outcome is higher trust and adoption: engineers see fixes that reflect agreed-upon standards, and security teams get predictable enforcement without repeated manual interpretation. **Smart prioritization** Smart prioritization ranks fixes by severity, risk, and impact so teams tackle what matters first (especially production blockers). The outcome is faster risk reduction, fewer stalled backlogs, and clearer progress over time. *** ### **Gomboc Portal Redesign** December 21, 2025 `New` We shipped a complete Portal overhaul with a refreshed UX/UI and significantly faster navigation and page load performance. The new experience is designed around real remediation workflows, making it easier to move from “what did we find?” to “what do we fix next?” without jumping between disconnected views. Book a fully interactive demo with our team: [Book a demo](https://meetings.hubspot.com/gomboc-demo/one?uuid=02ec3652-7555-49d9-ab35-b01b2dc09cdb&__hstc=239846108.d9abb7a6c8409d9962c467d347a3b69a.1747674668709.1771607018868.1771619176053.93&__hssc=239846108.3.1771619176053&__hsfp=36b799a02b3d61e1a71fb88f8f5d5cb5). *** ### **Workspaces** November 13, 2025 `New` A Workspace is the single unit of IaC: **IaC tool + repository + branch + path**. It mirrors how code is deployed and reviewed and becomes the **control plane** for scans, and fixes. **Why this change** We’re deprecating the **Projects** and **Repositories** views and consolidating them into **Workspaces** to provide: * One coherent view instead of bouncing between pages. * No manual linking of repos/paths. * Clear ownership and reporting per deployable unit. **How it works** * **Auto-discovery:** New repos under your connected SCM scope are discovered and turned into Workspaces; PRs auto-map to their ancestor Workspace. * **Indexer:** An hourly job indexes new repos, new workspaces, and new subgroups and performs an IaC presence check. * **Scans:** Run on demand from the Portal, or automatically on PR open/update. * **Scope:** Workspace creation is limited to default/protected branches for stability. * **Manual setup:** You can Add Workspace manually and edit names if needed. {% hint style="danger" %} Note: The Projects and Repositories views will no longer be available starting November 28, 2025. {% endhint %} *** ### **Fixes for CIS Benchmarks** October 17, 2025 `New` Today we release over 100 new fixes that relate to CIS Benchmarks. This marks a significant advancement supporting multiple cloud providers (AWS, Azure, and Google) across an array of services from data storage, databases, compute, Kubernetes, and general cloud configuration. The following CIS benchmarks were addressed: * AWS * Amazon Web Services Foundations Benchmark v5.0 * AWS Database Service Benchmark v1.0 * AWS End User Compute Services Benchmark - v1.1 * AWS Storage Services Benchmark v1.0 * AWS Compute Services Benchmark v1.1 * AWS Elastic Kubernetes Service Benchmark v1.7 * Azure * Microsoft Azure Foundations Benchmark v4.0 * Microsoft Azure Kubernetes Service Benchmark v1.7 * Microsoft Azure Compute Services Benchmark v2.0 * Microsoft Azure Database Services Benchmark v1.0 * Microsoft Azure Storage Services Benchmark v1.0 * Google Cloud * Google Cloud Platform Foundations Benchmark * Google Kubernetes Engine (GKE) Benchmark * Google Kubernetes Engine (GKE) Autopilot Benchmark * Google Workspace Foundations Benchmark **Why this change** We've been working on scaling our fix generation capabilities and this is a step toward making it possible to gain assurance that your cloud configuration adopts CIS best practices. **How it works** * **Enable policy recommendations**: applying the new rules simply involves turning on the corresponding benchmark in the "Security Policy" view. *** ### **HashiCorp Terraform Run Task Integration** August 6, 2025 `New` We’ve added a new integration with HashiCorp Terraform, a leading IaC platform used to provision and manage any of your cloud environments. With this update, Gomboc can automatically check and fix issues in your infrastructure code before deployment, helping prevent security risks, downtime, and unnecessary costs by delivering ready-to-merge pull requests. Authentication is secured via HMAC, and enforcement can be set to advisory or mandatory. Detailed pass/fail callbacks include severity‑ranked outcomes, resource addresses, and remediation guidance, helping teams focus on the highest‑impact fixes first. Engineers benefit from native workflow integration with no CLI changes or extra tools, plus RFC‑style documentation for knowledge sharing and easy troubleshooting. Setup takes minutes via Settings > Integrations > HashiCorp in the Gomboc Portal. See our [user documentation](https://docs.gomboc.ai/integrations/cloud-orchestration/hcp-terraform) for complete instructions. *** *** ### **Create Custom Rules** June 30, 2025 `New` We’ve introduced the ability to create custom security policies, giving teams control over how Gomboc enforces best practices in their environment. Whether it’s tagging standards, KMS key access, or IAM permissions, users can now define and scope their own policy rules, customized down to the cloud resource and attribute level. * Build from scratch or start with existing rules using our new policy builder interface. * Apply rules globally or scope them to specific projects, repositories, or folders. * Customize policy logic using exact values, value patterns (e.g., starts with), or organizational tags. * Automatically generate rule descriptions and link policies to your security frameworks (e.g., CIS, NIST). *** ### **Gomboc Community Edition** June 24, 2025 `New` We’ve launched **Gomboc Community Edition -** a free, quick-start version of Gomboc deterministic AI platform automating IaC remediation, designed to let developers explore our core functionality. Community Edition delivers: * Merge-ready PRs for Terraform misconfigurations. * Instant onboarding via GitHub. * Real-world policies covering security and compliance best practices for AWS, Azure and Google Cloud. * Deterministic AI that delivers verifiable fixes you can trust. Unlike static scanners or recommendation tools, Gomboc Community Edition actually fixes the problem. This release reflects our commitment to supporting Platform and DevOps teams with tools that work the way they do: fast, reliable, and developer-first.\ Grab it now at and see Gomboc in action. *** ### **Code Validation for Gomboc PRs** May 30, 2025 `Improvement` Gomboc now automatically validates the Terraform code in its generated pull requests for type and configuration accuracy before it ever reaches your repo. What this means: * Every PR from Gomboc now runs `terraform validate` behind the scenes. * This catches syntax and type issues early, before any human review. * We simulate backend and provider authentication to avoid the need for user credentials or setup. * Future phases will include full `terraform plan` validation and state analysis for customers who want deeper trust signals and automation. Time is key, and having to check out a branch, run `init`, and review `plan` output slows developers down. This validation upgrade Gomboc to fully trusted IaC remediation that developers can merge with confidence. *** ### **Gomboc Compliance Companion** April 21, 2025 `New` The Gomboc Compliance Companion is a new feature that helps companies keep their cloud systems secure and compliant automatically, without slowing down developers or rewriting existing code. Automatically scans all your configurations across AWS, Azure, and GCP, and provides: * Instant, auditable security fixes in PRs with one-click approval. * Real-time compliance enforcement in development, CI/CD, and pipelines. * No rewrites required, works with your existing codebase. * $100K+ potential annual savings per workload by eliminating 50+ days of developer toil Compliance Companion shifts teams from periodic audits to automated, continuous compliance, accelerating delivery while reducing risk. *** ### **Automated Onboarding Assessment** April 2, 2025 `Improvement` We’ve streamlined the onboarding experience to make it faster, smarter, and easier to manage. With just a few clicks, Gomboc now automatically discovers your IaC repositories and delivers a comprehensive report with actionable insights in under 5 minutes. What’s better: * Zero manual setup: Automated repo discovery means no team or project gets missed. * Smart impact report: Highlights misconfigurations, team activity, and ROI projections. * Prioritized fixes: Aligned to compliance frameworks like CIS IG1/2/3. * No code stored: All data is processed securely and ephemerally. [Try the improved onboarding flow](https://meetings.hubspot.com/celsinger?uuid=007a6d36-2959-4c04-8ad5-e0c69ef11ce7&__hstc=239846108.d9abb7a6c8409d9962c467d347a3b69a.1747674668709.1752262501325.1752599560527.46&__hssc=239846108.8.1752599560527&__hsfp=1666919083) and see your first value, fast. *** ### **Gomboc Extension for Visual Studio Code** March 13, 2025 `New` We just dropped a VSCode extension that enables developers to get a real-time generated code as they develop cloud infrastructure. The extension applies Gomboc’s deterministic AI to highlight and fix misconfigurations precisely and instantly. Whether you're writing new infra or cleaning up legacy code, it keeps your cloud setup tight, without slowing you down. Install it via the [VSCode Marketplace](https://marketplace.visualstudio.com/items?itemName=GombocAI.gomboc-vscode-extension\&ssr=false#overview), learn about all the features, and start building reliable cloud infrastructure without leaving your editor. *** ### **CSPM Alert to Code Discovery and Fix** March 2, 2025 `New` We’ve closed the loop from cloud alerts to actual code-generated remediations. Gomboc now connects CSPM findings directly to the code that caused them. Here’s what’s new: * When a CSPM alert comes in, Gomboc identifies the code location that caused it and provides a fully described pull request with the fix. * We show full observation detail and lets you dive into context across code resources. * You can now select policy-based remediations, preview the fix, and generate a PR, all in one click. This dramatically reduces investigation time and makes remediating cloud infrastructure feel like a GitHub feature. [Try it from the Observations tab now.](https://meetings.hubspot.com/celsinger?uuid=007a6d36-2959-4c04-8ad5-e0c69ef11ce7&__hstc=239846108.d9abb7a6c8409d9962c467d347a3b69a.1747674668709.1752262501325.1752599560527.46&__hssc=239846108.8.1752599560527&__hsfp=1666919083)