Changelog

What shipped, and when

2026-07-14

Enterprise hardening pass

  • Fixed a cross-tenant SOC event forgery vulnerability — ingest now requires authentication and derives organization from the verified token, never the request body.
  • Fixed billing webhook signature verification failing open on an unconfigured secret — now fails closed.
  • Replaced fabricated EASM discovery output with real DNS/TCP/TLS/HTTP probing.
  • Fixed a deployed-but-non-functional continuous re-scan scheduler.
  • Extended AI safety guarding to the analyst copilot endpoints (previously only the customer chat had it).
  • Added self-service password reset and account settings — previously staff-only.
  • Added role-based access control to DFIR case management (previously any authenticated org member could modify cases).
2026-07-09

Public launch readiness pass

  • Rebuilt AI guard around a retrieve-by-default architecture.
  • Fixed a critical Enterprise-tier billing edge case.
  • Real Kubernetes rehearsal, backup/restore test, and 150-user load test.
  • Fixed login latency (blocking bcrypt call) — ~13x improvement.
2026-07-08

Hardening sprints

  • Fixed AI response fabrication (invented CVEs/incidents) found via adversarial testing.
  • Fixed a LAN IP/model-name leak in AI responses.
  • Shipped marketing homepage, admin console, and business analytics dashboard.
2026-07-07

Foundational remediation

  • Fixed a live JWT placeholder-secret vulnerability that allowed forging admin tokens.
  • Fixed unauthenticated data-ingestion endpoints.
  • Discovered and fixed zero real persistence in two services (in-memory only despite unused database models).