Security audit service, asset detail, and MSP portfolio
Start with the full note if you need shipped details, or jump to the roadmap and wishlist if you are comparing what to do next.
I want the release list
Go back to the index if you need to compare versions or pick another note.
I want the roadmap
Open the roadmap when the question is direction rather than a specific release.
I want to request something
Send a wishlist item if this release page surfaced a gap you want prioritized.
I want the current note
Jump to the release body and read the shipped change in full.
Release notes
What's new
Security audit service
The security audit workflow now tracks a full run lifecycle. When you request an audit, Sotiras queues a SecurityAuditRun, processes scanner output (nmap, ZAP, Trivy, or Lynis), and normalizes findings into assets, issues, risks, and remediation tasks. You can view per-finding severity, see which assets and risks were created, and queue an AI summary from the run detail page.
Supported scanner types in this release:
- External exposure — nmap XML output mapped to asset open ports and findings
- Web application baseline — OWASP ZAP baseline JSON mapped to web findings and risks
- Dependency and container review — Trivy JSON mapped to asset components and vulnerability issues
- Server hardening review — Lynis report.dat mapped to server configuration findings
Asset detail page
Each asset now has a detail page at /portal/assets/[id] showing properties, components, open security issues, and linked risks. You can acknowledge an issue, accept its risk, or mark it resolved directly from the issue list.
MSP partner portfolio
Partners managing multiple clients can now see a read-only portfolio view at /portal/partner showing all active client tenants with open risk counts, incident counts, security issues, degraded collector counts, and per-client health state.
Plan upgrade workflow
Business and Enterprise plan upgrades are now tracked as a workflow. Your upgrade request is recorded and a platform operator fulfills it. You receive a confirmation when your plan is updated.
Worker health visibility
Platform operators can see AI run processing counts, notification delivery counts, and a stuck-queue alert in the admin operations panel.
Fixes and improvements
- Collector install verification now shows progress for heartbeat, first event, inventory write, and IP pairing as a clear status sequence.
- Manual operator IP bans now publish as active tenant block rules even when automatic enforcement is in monitor or assisted mode, and block forms no longer require ad-hoc operator reason entry when Sotiras can derive the action context.
- Next.js proxy auth-route alerts now distinguish route requests from successful authentication so a sign-in page hit does not read like access was granted.
- First-run checklist on the portal overview surfaces the five key setup steps with direct links.
- AI policy settings now include routing mode, model override, review-required toggle, redaction, second-opinion enablement, data-use consent, and training eligibility.