Release History | CyfroSec Documentation

2026-06-30

The build process was updated to include the --no-editable flag during dependency synchronization. Additionally, test validation for the Python Dockerfile was enhanced to ensure correct build stage sequencing.

2026-06-26

Implemented a comprehensive security analysis reporting system including versioned data models and report serializers. Added quality gate evaluation logic to automatically determine scan pass/fail status based on security metrics.
Introduced a new scan maturity endpoint to provide comprehensive security scan insights and projections. This update includes a dedicated repository and service layer to handle quality gates, analysis reports, and vulnerability intelligence.
The engineering team has introduced a comprehensive strategic plan to evolve CyfroCode into a high-maturity code analysis platform. This initiative focuses on implementing rule governance, quality gates, and advanced semantic analysis to improve detection accuracy.

2026-06-24

Implemented a new seeding mechanism for add-on versions and enhanced the compatibility logic for plan-based add-ons. Added validation to ensure self-service add-ons have associated pricing and quantity constraints.

2026-06-22

The AgentUpdateStatus model was updated to include an attempt_id field for better tracking. Validation for the occurred_at timestamp now supports an alias for updated_at to improve compatibility.
This update fixes a bug in the SBOM tab where dependency counts were incorrectly pluralized. It introduces a more flexible pluralization utility and adds corresponding test coverage.

2026-06-20

The update modifies the backend to suppress progress messages and phases when a scan status is marked as completed. This ensures that historical summaries do not display stale progress data while preserving messages for failed or canceled scans.
Updated the Keycloak authentication theme to improve the layout of login forms and secondary action links. Refined the bootstrap configuration to use explicit home URLs for better navigation consistency.

2026-06-18

The GitHub repository synchronization process now flushes repository records to the database before syncing coverage data. This ensures that parent repository entities exist before their associated coverage records are created.

2026-06-17

The latency chart has been upgraded from an area chart to a line chart with improved data point visibility for sparse datasets. Accessibility is enhanced through the addition of a screen-reader-only data table and a refined tooltip.

2026-06-14

The update hides internal assistant handoff control text from the user interface. It also refines how subagent process data is merged to prioritize authoritative process frames.
The add-ons marketplace has been refreshed with a new hero section, category filtering, and an improved catalog card design. These updates enhance the discovery and purchase flow for subscription add-ons.
The CyfroAssistant engine now implements a strict SDK compatibility guardrail to validate the DeepAgents runtime at startup. Additionally, subagent handoffs have been upgraded from simple text strings to structured results for better error handling and reporting.

2026-06-13

The engineering team has introduced a comprehensive GDPR alignment plan and gap assessment. This documentation establishes a roadmap for improving data inventory, encryption standards, and privacy request fulfillment.

2026-06-12

Introduced a new unified Command Center component to standardize headers and KPI metrics across code security routes. This update streamlines the user interface by removing redundant page headers and consolidating status summaries into a compact row.
The update enhances notification context by adding agent names and test details to scan and agent failure alerts. It also rebrands AI-related notifications to "CyfroAI Insights" for better product consistency.
The notification toast system has been restyled with a new "glass island" aesthetic and moved to the top-right position. A developer-only test panel was added to non-production environments to verify toast severity colors.
The documentation has been updated to remove outdated appendices from the product requirements. This cleanup ensures that the project overview and scope remain current.

2026-06-11

AI insight findings are now linked directly to detailed reports via deep links. This includes automatic linkification of CVE mentions in executive summaries and risk cards.
The Content Security Policy has been updated to allow 'unsafe-eval' specifically during development. This change ensures React development tools function correctly without compromising production security.
The plan builder workflow has been improved by refactoring the feature matrix editor and introducing a read-only review surface for published plan versions. These changes streamline the editing process and provide a clear distinction between draft and published states.
The Project Profile AI metadata has been redacted from customer-facing API responses and the frontend UI. This change ensures internal model details, usage costs, and job identifiers are no longer exposed to end users.
This update ensures that truncated project profiles correctly report the number of included flows rather than the total input count. It introduces a coverage expectations field to provide consistent metadata for project profile validation.
The Project Profile system has been upgraded to v2, introducing a richer evidence payload and a more comprehensive response schema. These changes include enhanced validation for evidence references and a dedicated UI tab for rendering deterministic graph facts.
Updated Project Profile generation to use a strict JSON schema and increased the maximum output token limit to 8192. Introduced a comprehensive state reset mechanism for failed or dead-lettered jobs to ensure clean retries.

2026-06-10

The update enhances remediation draft data by integrating repository, finding, and scan context into the API responses. It also refactors the data access layer to use a dedicated read context for improved efficiency.
The mind map engine was upgraded to include a new deterministic logic-flow extraction system and a generic semantic analyzer for multiple programming languages. These changes improve the platform's ability to map application routes and function calls across diverse frameworks.

2026-06-09

Enhanced the dashboard and detail UX by introducing comprehensive data previews for CyfroCode and compliance frameworks. Improved the backend architecture for dashboard signal processing and refined the AI insight preview limits.
The system now prevents the manual execution of disabled scan configurations through both backend validation and frontend UI restrictions. New status indicators have been added to the scan setup table and detail dialogs to improve visibility of scan states.

2026-06-08

The display name for the GPT-5.4 nano model has been updated to CyfroAI (Beta). This change improves brand consistency across the user interface.

2026-06-07

The assistant service now supports interrupt resolution handling to track and persist approval decisions. This update includes backend logic for processing resolutions and frontend enhancements to manage the visibility of pending interrupts.
Enhanced the assistant run processor to include thread cache invalidation and improved the frontend stream coordination. These changes optimize how active runs are tracked, replayed, and displayed across the user interface.
Enhanced the CyfroAssistant with new reporting and scanning tools, including exploitability prioritization and evidence bundling. Updated agent prompts and routing logic to improve the accuracy of security posture analysis and remediation guidance.
Implemented inactive user lifecycle management, including the ability to restore access or anonymize disabled users. Added new functionality for managing and resending user invitations.

2026-06-06

The Checkov IaC scanner has been updated to disable remote guideline downloads. This ensures scan outputs remain JSON-only and removes dependencies on external network requests during execution.
The Insight Jobs sidebar panel has been temporarily disabled in the AI Insights page. Related data fetching and refetching logic for job history were updated to respect this visibility toggle.
This update resolves merge conflicts in the PR dashboard and introduces a new activity timeline for the assistant workspace. It also implements accessibility improvements by adding motion-safe wrappers to various UI animations.
The documentation has been updated to simplify environment file references and Docker Compose commands in the README. It also provides detailed instructions for bootstrapping the initial super admin user.
The update increases the visual size of product logos within the application shell and sidebar. This change improves brand visibility and UI consistency across the navigation menu.
The assistant live run UX has been hardened by improving event ID tracking and refining message role filtering. Additionally, request parsing logic was refactored into a dedicated helper module to enhance maintainability.

2026-06-05

The assistant interface has been updated to include a new Activity timeline in the workspace and improved spacing for agent cards. Additionally, private reasoning blocks have been replaced with safe working notes to enhance data privacy.
This update improves the visibility of product logos by implementing theme-aware CSS filters. It ensures consistent contrast and brightness across both light and dark modes.
The assistant hero gradient has been scoped exclusively to dark mode to improve visibility. This ensures the title remains readable in light mode while maintaining the gradient effect in dark mode.
Implemented a new system for normalizing and storing SBOM components from CycloneDX payloads. Added API endpoints to list and summarize these components with support for filtering by ecosystem, license, and component type.
Implemented advanced sorting, filtering, and search capabilities for scan results and code health signals. Updated local development workflows by deprecating the strict worker alias in favor of a unified code worker.
The scan logic map now includes status handling to prevent loading projections until a scan is completed. Additionally, a new immutable snapshot class was introduced to improve the handling of scan progress events.
Implemented logic map intelligence by introducing a dedicated controller mixin and AI-driven refinement jobs. This update enables advanced code graph analysis, including architecture views and data flow mapping.
The platform now supports Syft for dependency scanning within the analysis taxonomy. This integration includes updated default scanner policies and enhanced error handling for unavailable runtimes.
Implemented public API endpoints for sales inquiries and demo bookings to facilitate lead intake from landing pages. The system integrates with the transactional email outbox to notify the sales team and send customer confirmations.
The update tightens type handling for scanner policy configurations to ensure strict integer and float casting. These changes improve the stability of the OSV online executor and policy validation.

2026-06-04

Updated the impersonation session UI to improve the layout of lifecycle and audit details. Added comprehensive tests for session detail cards, breadcrumbs, and data table components.
Enhanced report functionality by integrating additional asset, network, and vulnerability metadata into the UI. Improved data retrieval for curated reports to include detailed evidence summaries and source metadata.
Implemented scan correlation snapshot source tracking and introduced scoped report exports. Users can now choose between curated, raw, or all-inclusive data scopes for report generation.
The impersonation session detail page has been redesigned with new components for improved session lifecycle visibility and control. Key updates include a new session hero, a dedicated lifecycle panel, and a streamlined control sidebar for session operations.
Introduced new agent skills for full-output enforcement and minimalist UI design to improve generation quality and visual aesthetics. Added updated SIEM log ingestion architecture documentation.
The system has been updated to prioritize compatibility with the external CyfroAgent v2.26 codebase, removing the redundant internal agent runtime to ensure wire-contract parity.
Implemented compliance mapping and visibility features, including new paginated drilldown endpoints for controls and findings. Introduced evidence projection read models to optimize deterministic compliance scoring across frameworks.
Implemented new telemetry and metrics visualization components, including a component heatmap, latency trace charts, and plane-specific resource monitoring. Added a recent suspensions panel to the activity overview for improved tenant event tracking.
Implemented the StaffDetailWorkbench component to provide a modernized staff management interface. This update introduces an enhanced identity posture overview and a dedicated management rail for administrative actions.
Implemented a comprehensive operational dashboard featuring new telemetry, activity, and KPI panels. These components provide real-time visibility into platform health, audit events, and system-wide operational metrics.
The dashboard and administrative interfaces have been updated to improve visual consistency and terminology across the platform. Key enhancements include refined page headers, updated telemetry color tokens, and improved empty state messaging.
The update introduces two new specialized design skills for brand-kit image generation and high-end frontend development. These additions enable the platform to produce professional identity systems and "anti-slop" user interfaces.

2026-06-03

Enhanced raw report columns and export functionality across port scans, asset discovery, and fingerprinting. Added support for agent names, normalized host identities, and detailed vulnerability scoring in reports.
Implemented a new subscription management interface with grouped feature matrices and plan status banners. The update refactors billing data fetching to use TanStack Query for improved state management and performance.

2026-06-02

The AI report generation has been updated to use plain text instead of structured JSON. This change improves compatibility across different AI providers, including self-hosted Ollama endpoints.
Implemented an automated reporting system that sends GitHub activity and CI/CD results to Google Chat. The system utilizes AI providers for summarizing changes and includes monorepo-aware component mapping.

2026-06-01

Enhanced the compliance engine with new coverage checks for agent presence, evidence recency, and EOL components. Improved reporting accuracy by implementing database-level projections for evidence counts and refining snapshot fingerprinting.
The compliance catalog sync process now includes retry logic for LLM provider failures and improved metadata handling. It also introduces baseline control anchors to maintain consistency across catalog versions.

2026-05-31

Implemented a new run_tool executor for the endpoint agent to support allowlisted diagnostic commands. This update includes a secure subprocess runner with strict input validation and a new output streaming mechanism.

2026-05-30

Implemented assistant handoff functionality and enhanced the agent fingerprinting intake process with sharding support. Updated infrastructure validation to include bounded Redis pool waits and improved error metadata for graph call limits.

2026-05-28

The dashboard has been updated with enhanced KPI tiles, improved styling for activity trends, and a redesigned recent activity feed. These changes introduce new data visualizations and a more refined layout for operational overview components.
Introduced a new lab.css file to manage component styling and layout. This change migrates specific design system styles from the reference stylesheet to a dedicated laboratory file.
Introduced a standalone design system reference application to standardize UI components and theme behavior. Updated development workflows and documentation to integrate this reference plane via a new Makefile command.
The compliance catalog extraction process has been enhanced to support PDF and JSON source ingestion with strict validation bounds. AI response schemas now mirror Pydantic constraints to ensure oversized control fields are rejected before worker-side processing.
The update corrects a revision ID within the compliance evaluation migration script. This ensures proper data models versioning and migration sequencing.
Implemented a new staff activation flow allowing invited users to activate their accounts after completing identity provider setup. This includes a new activation endpoint, updated authentication dependencies, and corresponding audit logging.

2026-05-27

The email worker startup process now includes validation for inline logo presence to prevent runtime failures. New automated tests ensure the worker fails fast if required assets are missing.
The notification system has been updated to use customer-facing labels and a structured resource object instead of internal service identifiers. These changes improve the UI consistency across the notification table and detail modals.
Implemented notification broadcast services and workers within the admin backend. The update introduces unread cache invalidation and streamlines real-time event payloads.
Implemented notification controllers, routes, and dispatch services to enhance the backend notification system. The update introduces a public type-key filtering system and improves unread cache invalidation logic.
Implemented a new notification repository and public view mapping to standardize customer-facing alerts. Added unread cache invalidation logic and updated the notification cache schema to version 3.
The admin telemetry UI was updated to resolve a duplication issue in the dead letters sections. This change also improves the layout and accessibility of component health status badges.
Implemented a new dead letter console in the admin frontend to provide read-only failure diagnostics for platform workers. The update includes a dedicated navigation item, a filterable data table, and a detailed view for analyzing failure causes.
Implemented a new dead-letter console in the admin backend to provide diagnostics for failed background jobs. This includes new controllers, routes, and repositories to aggregate and inspect failures across multiple AI and scanning services.
This update improves the Agent Details modal by aligning test configuration displays and enhancing test counter validation. It also introduces a new optional field for tracking source run keys in agent test runs.
Implemented enhanced error tracking and retry logic for AI insight workers, including detailed failure categorization. Improved agent test configuration alignment by introducing source run keys and refining runtime assignment logic.
This update resolves React hydration errors by implementing a custom hydration hook and updating script tag handling. It also refines the dashboard insights UI for better text layout and readability.
Implemented a data-preserving agent deletion process that uses tombstones to maintain referential integrity for historical data. The update includes new API endpoints for agent deletion and corresponding control stream updates to notify agents to stop polling.
Implemented a new agent name availability check and integrated it into the agent registration workflow. The update includes a preflight API endpoint, backend validation for duplicate names, and frontend UI updates for real-time availability feedback.
Implemented staff management capabilities across the backend and frontend. The update centralizes password reset configuration to the server side and improves error sanitization for identity provider responses.
The onboarding theme CSS has been updated to simplify the backdrop and spotlight styling. New automated tests were added to ensure the visual consistency of the onboarding tour.
The onboarding process now includes a visibility check for the backdrop. Additionally, the blur effect has been removed from the global theme.
Enhanced the frontend SSR configuration and authentication initialization to improve stability and deployment flexibility. Updated Docker build scripts and provider logic to better handle runtime configurations and identity provider timeouts.
The backend startup process no longer requires provider configurations for Stripe and object storage. These settings are now optional at boot and are only validated when their respective features are accessed.

2026-05-26

Added explicit Alembic support to the backend runtime image to ensure reliable database migration jobs. Updated staging deployment documentation and implemented smoke tests for critical startup modules.
The workspace configuration has been updated to include a specific list of allowed built dependencies. This change ensures that only trusted packages like esbuild, sharp, and unrs-resolver can execute build scripts.
Introduced staging environment configuration and example secret templates for the SaaS stack. Updated documentation and gitignore rules to support staging deployment workflows.

2026-05-25

This update enhances the GitHub patch publishing workflow with improved error handling, sanitized logs, and a retry mechanism in the UI. Additionally, the usage views have been reorganized into more granular categories for better clarity.

2026-05-24

Implemented a platform-wide entitlement and feature policy system to enforce access control for specific functionalities. This update introduces granular feature gating for AI assistant modes, code security scanners, billing visibility, and compliance frameworks.

2026-05-23

Implemented a new usage limits grouping and presentation system for the organization usage page. This update introduces categorized views and enhanced visual indicators for tracking resource consumption.
The usage limits display has been refactored to group limits into user-friendly categories with associated icons. The UI now utilizes a card-based layout for better readability and improved accessibility.
The admin usage and activity interfaces have been updated to support more detailed usage limits and audit logging. These changes include improved grouping of usage metrics and a refined data model for organization activity tracking.
The admin usage summary functionality has been expanded to provide detailed entitlement and limit tracking. This update introduces a new shared application state for settings caching and integrates entitlement resolution into the billing service.
The system now filters customer usage limits to ensure only relevant limits based on active entitlements are displayed. This update includes the removal of redundant repository and service files in favor of shared usage libraries.
Implemented shared usage limit helpers to standardize how resource quotas and consumption are calculated. Added a new repository to track live resource counts for hard-cap limits across the platform.

2026-05-22

Implemented seed repositories and integration tests for AI models, compliance frameworks, and subscription plans. Added new Makefile targets to automate the seeding of these platform catalogs.
Introduced a dedicated SIEM module for ingestion and search capabilities. Integrated scan setup functionality into the CyfroAgent category for improved organization.
The update redacts exact AI cost metrics from customer-facing APIs and UI, replacing them with percentage-based usage displays. Additionally, it introduces a feature matrix to the subscription settings to provide a clear view of active, customer-visible entitlements.
The MutationFeedback component has been integrated across multiple features to standardize error handling and user feedback. This update improves the consistency of permission, limit, and subscription-related alerts throughout the platform.
Introduced a new MutationFeedback component to standardize error and state handling across the frontend. This component is now integrated into account group and user invitation dialogs to provide consistent feedback for limits, permissions, and API errors.
Implemented feature gating for assistant tools to restrict discovery and execution based on tenant entitlements. Enhanced the tenancy service to enforce seat and account group limits across both REST and assistant-driven paths.

2026-05-21

The code security frontend has been updated to support advanced scan configurations and privileged patch approvals. Key enhancements include a new scan targeting interface and the ability to bypass validation for patch publishing.
Implemented code scan targeting to allow scans on specific branches and commit SHAs. Added support for listing repository branches via GitHub API and manual git commands.

2026-05-19

The dashboard has been enhanced with a new metrics strip and a redesigned premium card layout for improved data visualization. These updates introduce refined styling for security metrics, including new AI insights and compliance tracking components.

2026-05-17

The customer signup process was updated to use scalar identifiers, preventing potential session expiration errors during notification and caching. Additional test coverage was implemented to validate this behavior, and minor refinements were made to database health checks and exception handling.

2026-05-16

The CyfrOne admin UI has undergone a comprehensive visual and information architecture refresh to improve enterprise posture. This update introduces a new primitive component library, a restructured sidebar, and a global command palette.
Implemented a resource-safe scan correlation engine to normalize and correlate results across port scans, asset discovery, and fingerprinting. This update introduces durable processing jobs and materialized read models to support AI Insights and network topology mapping.
The customer shell navigation has been refreshed with updated branding, a new theme system, and improved sidebar collapse functionality. Several new route placeholders and redirects were implemented to align with the updated navigation structure.
Implemented new tenancy endpoints to allow users to retrieve their identity scope and update their default account group. This includes a new projection service to aggregate user roles, organization memberships, and associated permissions.

2026-05-15

The signup process has been updated to prioritize password setup over email verification. Users are now automatically marked as email-verified during signup and receive a direct password setup notification.
Implemented a new internal observer identity and enhanced the Keycloak reconciler to support automated service account role bindings. These changes enable secure platform health monitoring and refined administrative access control across realms.
The CyfrOne platform has been updated with new administrative controls for AI model management and add-on compatibility rules. Additionally, a new platform health monitoring system has been integrated using a dedicated customer platform client and Redis caching.
Implemented a multi-step customer signup wizard featuring user profile, organization, and account group configuration. Added a success state and supporting UI components to streamline the onboarding experience.
The admin console has been expanded to include a comprehensive platform health dashboard with real-time polling and detailed component metrics. Additionally, new functionality for managing add-on compatibility rules has been implemented to control plan-based purchasing.
Implemented a comprehensive platform health monitoring endpoint and a subscription-based write gate for customer organizations. Additionally, expanded the customer signup process to capture more detailed professional and organizational metadata.
Implemented shared platform health primitives, including a new service-to-service authentication mechanism for internal endpoints. Expanded the AI model catalog to support Ollama and introduced dedicated columns for reasoning capabilities.
Implemented canonical billing read models to unify subscription and plan metadata access via the the billing endpoints. This update removes legacy subscription and add-on clients in favor of a centralized billing service.

2026-05-14

The engineering team has implemented a comprehensive set of AI agent skill definitions to standardize development across the platform. These documents establish strict architectural boundaries, security protocols, and quality gates for the backend, frontend, and AI security modules.

When a change with customer-visible, security, or compliance relevance ships to production, add a new dated entry (or a new bullet under today's date if one already exists) at the top of the dated log above, following the category and phrasing conventions shown. Keep entries in plain, customer-facing language — no internal infrastructure identifiers, credentials, hostnames, cloud account details, or internal code names.