Company/Changelog

Changelog.

Engineering milestones by month, written from the repository's own audit records. No marketing releases, no invented version numbers.

What we are building next

September 2026

Scanner v2 execution model and the API plane split

Scan bandMulti-container N-pairs pod: one shared fetcher and one tool/adapter pair per tool, with the SV_TOOL / SV_RESULTS_DIR / SV_TOOL_DEADLINE_SECONDS wrapper contract. Per-tool deadlines persisted on the scan; the reaper distinguishes PARTIAL from FAILED_TIMEOUT.

APIFive traffic planes — read, write, callback, stream, admin — built from one router registry and scaled independently.

Data layerForward-only SQL migrations with SHA-256 verification; CI proves a populated upgrade converges with a fresh installation.

WebsitePublic site launch: single Jenkins job, hardened nginx image, relay-only forms with no secrets in the repository.

August 2026

Universal resource lineage graph (ontology v2)

OntologyVocabulary v2 adds Registry, Namespace, KubeService, KubeIngress and the verbs triggered, stored_in, hosted_in, affects, fixes. Per-edge provenance classes: observed, derived, inferred.

LineageExpected-hop template walk from Repository to Ingress with honest missing-hop reasons, bounded blast-radius BFS and the exploit-path view.

RemediationDurable remediation cases with rollout stages, simulation before rollout and honest reporting of aborted rollouts.

Self-scanThe platform's own repository and images scanned on the production pipeline; detector defects and false-positive tuning fixed at the source.

July 2026

Security ontology and Command Center

OntologyVocabulary freeze: 48 entity types, 27 relationship verbs, versioned pipeline events, a single risk scale and source-precedence order. Frozen sets are never mutated.

CorrelationSeeded correlation rules compiled to an evaluator over entity neighbourhoods, projected into security cases; shadow mode before enforcement.

Attack pathsPathfinder with chokepoints and candidate interventions; persistence with shadow comparison.

RiskRisk model v1 with factor groups, explanations and incremental scoring.

June 2026

Cloud 360 and CNAPP

CloudUnified CNAPP engine over CSPM, CWPP, KSPM, DSPM, CIEM, IaC, ASPM and CDR with one cloud-to-finding ingestion path and code↔cloud↔image correlation edges.

ConsoleCloud 360 entity pages mirroring Image 360; cloud inventory and posture dashboard.

May 2026

Unified scanner trust band and native engine foundations

Trust bandappsec-unified runs as an untrusted Kubernetes Job like every other tool. Per-scan single-use SCAN_TOKEN, HMAC body signature, replay nonce, 64 MiB body cap. No privileged in-process fallback.

Native engineEvidence taxonomy with seven kinds, DAST mode taxonomy, native secrets kernel with provider fingerprints, supply-chain primitives (typosquat, dependency confusion, package age, maintainer risk), reachability hints, API discovery interface and a deterministic remediation template registry.

ConsoleEnterprise UX redesign: eight persona-routed home views over the security-entities projection; disposition made human-only with mandatory reason codes; AI natural-language filters made one-shot and audited.

April 2026

Platform hardening and 3.1.0

HardeningRow-level security enforcement audit, audit-before-commit with an outbox, encrypted credential columns with backfill, Redis-backed replay-nonce cache, credential rotation API, per-audience JWT key registry, SSO/OIDC on by default with PKCE, MFA enforcement dependency, account lockout, dual-control approvals, notification outbox with dead-letter queue.

3.1.0Teams two-way, bulk operations, PR annotations, VEX, executive scorecard, application risk view, saved queries, CLI, IDE extension, native Azure and GCP, CIEM depth, CWPP, EASM, serverless, Terraform provider, query console, API discovery, ITDR, DLP, threat hunting, webhooks, XDR correlation, ChatOps, questionnaire auto-fill, regulatory monitor, vendor risk portal.