2025-10-25 - 2026-04-25
Overview
1 Release published by 1 user
Published
v0.2.0
v0.2.0 — AI-Native Security & Compliance Platform
25 Pull requests merged by 1 user
Merged
#55 fix: CVE notifications during scan + help chat doc loading + Dockerfile
Merged
#53 feat: hourly CVE alerting with notification bell and API
Merged
#52 feat: add E2E test suite with nightly CI, fix dashboard Dockerfile
Merged
#51 feat: add floating help chat widget, remove settings page
Merged
#50 fix: cascade-delete DAST targets, pentests, and downstream data on repo delete
Merged
#49 feat: refine all LLM system prompts for precision and reduced false positives
Merged
#48 feat: deduplicate code review findings across LLM passes
Merged
#47 fix: check Gitea API response status and fallback for PR reviews
Merged
#22 fix: stop storing code review findings in dashboard
Merged
#16 feat: pentest onboarding — streaming, browser automation, reports, user cleanup
Merged
#15 fix: remote Chrome PDF export & MCP endpoint sync
Merged
#14 ci: consolidate CI into single job; fix sidebar footer
Merged
#13 refactor: modularize codebase and add 404 unit tests
Merged
#12 feat: AI-driven automated penetration testing
Merged
#11 docs: rewrite user-facing documentation with screenshots
Merged
#10 feat: per-repo issue tracker, Gitea support, PR review pipeline
Merged
#9 fix: resolve cargo audit failures by updating tantivy, scraper, quinn-proto
Merged
#8 fix: SBOM multi-ecosystem support with correct package managers and licenses
Merged
#7 feat: UI improvements with icons, back navigation, and overview cards
Merged
#6 feat: findings refinement, new scanners, and deployment tooling
Merged
#5 feat: add MCP server for exposing compliance data to LLMs
Merged
#4 docs: added vite-press docs
Merged
#3 feat: opentelemetry-tracing
Merged
#2 feat: add Keycloak authentication for dashboard and API endpoints
Merged
#1 feat: rag-embedding-ai-chat
1 Pull request proposed by 1 user
Proposed
#23 feat: add user login and data processing endpoint
51 Issues created by 1 user
Opened
#18 test: verify Auth0 user cleanup integration
Opened
#19 test: verify Okta user cleanup integration
Opened
#17 feat: implement Firebase user cleanup for pentest sessions
Opened
#20 test: verify PR scanning and review comments
Opened
#21 test: verify issue tracker integrations (GitHub, GitLab, Jira)
Opened
#24 [high] semgrep: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
Opened
#26 [medium] semgrep: Dangerously accepting invalid TLS information
Opened
#25 [high] semgrep: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
Opened
#35 [high] gdpr-patterns: PII data potentially logged
Opened
#34 [high] gdpr-patterns: PII data potentially logged
Opened
#30 [medium] gdpr-patterns: Missing data deletion capability
Opened
#28 [medium] semgrep: Service 'mailserver' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.
Opened
#29 [medium] semgrep: Service 'mailserver' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temp…
Opened
#31 [medium] gdpr-patterns: Missing data deletion capability
Opened
#33 [high] gdpr-patterns: PII data potentially logged
Opened
#27 [medium] semgrep: Dangerously accepting invalid TLS information
Opened
#32 [medium] gdpr-patterns: Missing data deletion capability
Opened
#37 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Opened
#40 [medium] oauth-patterns: OAuth flow without PKCE
Opened
#36 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Opened
#38 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Opened
#39 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Opened
#43 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Opened
#44 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Opened
#41 [high] oauth-patterns: OAuth implicit grant flow detected
Opened
#42 [high] oauth-patterns: OAuth implicit grant flow detected
Opened
#45 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Opened
#46 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Opened
#54 [medium] semgrep: Service 'mailserver' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temp…
Opened
#56 Webhook auth bypass when webhook_secret is None
Opened
#58 JWKS cache never expires — key rotation requires restart
Opened
#57 JWT audience validation disabled — cross-app token reuse
Opened
#59 No request body size limit on API and webhook servers
Opened
#60 Health endpoint does not verify database connectivity
Opened
#61 Scheduled scans run sequentially — one slow repo blocks all others
Opened
#63 Graph endpoints load full node/edge collections without pagination
Opened
#62 CVE monitor loads entire SBOM collection into memory
Opened
#65 No graceful shutdown — in-progress scans left in running state
Opened
#64 sort_by query parameter is a NoSQL injection vector
Opened
#66 get_attack_chain has no pagination — long sessions return unbounded data
Opened
#68 Webhook server port is hardcoded to 3002
Opened
#67 license_summary and SBOM export fetch entire dataset without limits
Opened
#69 Email notification channel for CVE alerts
Opened
#70 Webhook delivery tracking and retry
Opened
#71 Audit logging for security-sensitive operations
Opened
#73 Policy-as-Code: custom compliance rules via YAML
Opened
#72 SOC2 and ISO 27001 compliance control mappings
Opened
#74 CI/CD pipeline gates — block deploys on critical findings
Opened
#76 File splitting refactor — no file over 250 lines
Opened
#75 Executive compliance posture reports
Opened
#77 Migrate secrets management to Infisical, remove Coolify env vars