Product updates
Changelog
Every feature, improvement, and fix shipped to CVERiskPilot. Building in public, one commit at a time.
- 0.6.0-alphaSeptember 2026Latest
Enterprise UI, AI safety boundary, and the Claude Code plugin
- Enterprise UI redesign: dark-first design tokens, shadcn component kit, rebuilt app shell with server-side RBAC navigation and a command palette, and every product surface rebuilt on the new system
- Claude Code plugin (cveriskpilot-triage) with an MCP server at /api/mcp: read findings, look up KEV and EPSS, and save VEX dispositions that land pending approval
- AI refusal boundary: provider policy refusals become a typed error that is never retried or sent to another model, and routes answer 422 AI_REFUSAL
- AI provider outages (exhausted credits, rate limits, overload) answer 503 AI_PROVIDER_UNAVAILABLE with Retry-After instead of a generic 500
- Schema validation on 52 mutation routes across auth, MFA, billing, cases, teams, settings, integrations, webhooks and the public triage API, each with route tests; forms show field-level messages
- Audit trail fix: the per-organization advisory lock used a Postgres overload that did not exist, so chained audit writes had failed since April; rows are written again
- Operations: migrations run on every deploy, Sentry and transactional email bound in production, health endpoint warns when no mail transport is configured, provider-outage alert policy
- Documentation: monorepo README, exhaustive .env.example with a CI guard, public changelog driven by release metadata, and a customer guide for the Claude Code plugin
- 0.5.0-alphaMay 2026
Compliance catalog and mapping governance
- Phase 6 compliance catalog and mapping governance rollout
- Framework registry and cross-framework CWE mapping with governance checks across the 13 frameworks
- Compliance scorecards, plus storage for posture snapshots; recording snapshots on a schedule and trend detection are still planned
- 0.4.1-alphaMay 2026
Workflow, evidence, and reporting
- Phase 5 workflow, evidence, and reporting rollout
- Case priority evidence lists and a deferred case status
- Server-side session checks on every product page, role-gated layouts, and per-route error boundaries
- Cross-tenant isolation harnesses for POAM and AI flows, with a static-analysis gate over page and layout patterns
- 0.4.0-alphaMarch 2026
Platform evolution milestone
- First code for the five Solivagant platform phases (Vault Protocol, Cortex Analytics, Horizon API, Signal Engine, Flux Pipelines). Cortex AI chat and the Horizon API went live in Q2 2026; Vault Protocol signing is still in progress, and Signal Engine push ingestion and Flux Pipelines automation rules are planned
- GTM waves G1-G5 implemented: CLI-to-platform funnel, email nurture, LinkedIn automation, UTM tracking
- Evidence collection system for compliance audits
- Python parser support (poetry.lock, pyproject.toml)
- Stress testing framework, tested to 2,000 concurrent analysts at 8.5K rps
- SOC 2 readiness report tool
- Partner program page and partner application form
- Unit, integration, security, and stress suites validated before release
- 0.3.0-alphaMarch 2026
Revenue and enterprise readiness
- RBAC enforcement on all mutation API routes
- Billing gates on AI endpoints with 402 upgrade responses
- Case approval workflow with status transitions and gates
- Session revocation endpoint for security events
- Public pricing page with tier comparison and Stripe integration
- Google OAuth, GitHub OAuth, Microsoft OAuth, and WorkOS SSO wired
- Onboarding checklist on dashboard
- SAML sign-in through WorkOS (Okta, Azure AD, OneLogin), with each workspace connected to its identity provider by our team; self-serve SSO setup is planned
- CSV export for audit logs, cases, and findings
- Health check endpoints (live, ready, full)
- 2FA backup codes with hash-store verification
- Database indexes for query performance
- 0.2.0-alphaMarch 2026
Pipeline CLI and operations
- Pipeline compliance scanner CLI (@cveriskpilot/scan) with framework presets and 13 package manager formats
- Offline-first scanning with npx support
- Ops dashboard for internal staff monitoring and customer support
- AI triage panel on the case detail page
- Automatic triage of CRITICAL and HIGH findings after upload on paid plans (later removed to control AI cost; triage now runs when someone requests it)
- Compliance scores wired to dashboard widgets
- CVE intelligence digest cron
- Security audit remediation: auth, RBAC, CSRF, MSSP isolation, CSP fix
- 0.1.0March 2026
Foundation
- Full MVP scaffold: auth, upload, parsers, enrichment, dashboard
- 11 scanner format parsers (Nessus, SARIF, CycloneDX, Qualys, OpenVAS, SPDX, OSV, CSAF, CSV, JSON, XLSX)
- Scanner connector framework in development, with adapters for Tenable, Qualys, CrowdStrike, Rapid7 and Snyk; connector syncs are not yet available
- NVD/EPSS/KEV enrichment pipeline with Redis caching
- 13 compliance framework mapping via CWE bridge
- AI-assisted triage of individual vulnerability cases
- POAM generation and export
- Stripe billing with webhooks and tier management
- Containerized deployment with infrastructure-as-code pipeline
- Role-based access control with granular permissions
- REST API covering upload, triage, cases, compliance, and billing