🚀 What’s New
- Multifactor Priority Scoring v2: Priority scoring is now powered by a deterministic weighted formula that combines impact, EPSS exploit likelihood, reachability, and confidence into a single, transparent score — replacing the old max()-based approach. Every finding in your inventory is scored consistently, and a backfill migrates all existing findings to the new model automatically.
- Registry & Container Scanning: Container and registry scanning is now fully activated. You can scan images from Google Artifact Registry, Docker Hub, and GitHub Container Registry, and findings flow directly into your Dashboard alongside your existing code, dependency, secret, and IaC results. Registry rate-limit exhaustion now surfaces as a clear error instead of silently returning empty results.
- Spanish Email Delivery: All platform notification emails — from verification to onboarding invitations — are now fully localized in Spanish for Spanish-speaking clients, matching each tenant’s stored language preference.
🛠 Improvements
- Reticulum Exposure Analysis: Reticulum’s exposure and reachability analysis is now significantly more accurate. Exposure data is correctly attached to findings using absolute file paths, the exposure widget on your Dashboard counts only services with a verified exposed verdict (ordered by risk level), and the exposure multiplier no longer over-escalates plain internal services to Medium.
- Dashboard Risk Posture: The risk-posture trend series and top-risky-repositories trend arrow on your Dashboard now include Critical-severity findings in their calculations, so a spike in Criticals is always reflected in your posture score.
- AI Pentest Monitoring: The AI Pentest monitor workflow no longer stalls between cycles — the pod IP refresh activity is now properly registered, keeping pentest scans progressing without interruption.
- Codex Remedium Reliability: The remediation proxy that routes fixes to your configured AI models now starts correctly with the right connection settings, so every remediation job routed through the proxy runs to completion. Autonomous remediation child workflows also now run to completion independently after their parent scan finishes, instead of being terminated early.
- CVSS Accuracy: Scanner-provided CVSS vectors are now preserved exactly as reported — the AI validation layer no longer overwrites real scanner vectors with its own estimates. When a CVSS vector is present, the base score is recomputed deterministically from the vector itself, and estimated scores filled from the severity ladder are clearly stamped with their provenance so you always know whether a score is measured or inferred.
- Confidence Provenance: Confidence values backfilled from a severity-scale echo are now distinguished from real AI-measured confidence in the UI, so you can tell at a glance whether a confidence number is an actual measurement or a sensible default.
- Findings Visibility: Findings are no longer hidden by default when a single AI reachability check returns a negative result. All findings now stay visible, and the existing deprioritization dampener ensures that uncorroborated negatives are appropriately weighted in your priority scores without disappearing from view.
- XBOM Repository Deletion: Deleting a repository now correctly cascades to remove all associated XBOM findings and their stored artifacts, ensuring clean teardown and GDPR compliance.
- API Token Management: The personal API token management page under Settings is now reachable for authenticated users, and a Settings navigation entry has been added so you can find it quickly.
- OAuth Signup Roles: New accounts created through Google or GitHub OAuth signup are now assigned the correct role — admin only for the first user of a brand-new tenant, and a standard member role thereafter — instead of every OAuth user receiving admin privileges.
- Scan Batch Accounting: Concurrent scan batch deliveries from the same owner no longer silently drop progress, thanks to an atomic, owner-gated update that prevents race conditions in batch tracking.
🔒 Security
This release includes a comprehensive supply-chain and platform hardening pass:
- Every baked binary installed in the scanning and remediation images is now pinned to a specific version and verified against an immutable checksum or signature before execution, so a compromised upstream release can no longer poison a build
- The AI Pentest sandbox base image and its entire toolchain are now pinned by digest and specific version tags, making sandbox builds fully reproducible and protected against upstream drift
- Administrative endpoints on internal services now require an authenticated token, and internal service ports are no longer exposed on the network
- Release image tags are now bound to a resolved image digest at publish time, eliminating a race condition where a concurrent build could silently bind a release to the wrong image
- Unused dependencies — including a JWT library and a full web framework — have been removed from the API image to shrink the attack surface
- Worker processes now run under an active memory watchdog, keeping long-running scans stable
🔧 Fixes
- AI Pentest findings: DAST scans now return findings correctly — the required scan templates are bundled into the scanning image, so App Pentest scans produce real vulnerability results instead of aborting with none
- Scan progress: A new Finalize Now action appears on repositories where a scan has stopped progressing, letting you unblock without contacting support
- EPSS priority term: The EPSS percentile factor in priority scoring now writes and reads correctly, so the exploit-likelihood term contributes to your scores as designed instead of silently being zero