Changelog
What's shipped
Nothing on this page is a roadmap item. Every line below is already live.
Last updated August 2026
Security
- The audit log is now append-only enforced by a database trigger, not application discipline alone.
- Private/internal IP addresses (and known secret shapes) are redacted from server data before it reaches a third-party AI provider.
- Two Postgres hygiene fixes closed after a routine advisor scan — see the security self-assessment.
AI control
- A kill switch, at the organization and individual-server level: when engaged, the AI can't propose or run anything new, enforced server-side — not a UI toggle it could talk around.
- An AI activity view, showing usage, everything recently proposed, and repeated failures against the same goal — the visibility half of "can we stop it."
- Pending approvals and failures now email the org, including a signed, single-use approval link.
Trust & transparency
- Published a self-assessment against the NIST Cybersecurity Framework — real mechanisms and real gaps, not a marketing summary.
- A security posture view for admins: real underlying numbers, deliberately no fabricated 0–100 score.
- A CI pipeline now runs the full test suite on every change, rather than only on request.