Known issues & release notes

Released 2026-11-02. Migrations 0055_asset_product and 0056_owner_pickers (new optional columns only) run on start-up.

• Sample data — in Settings → Organization an administrator can load a small realistic sample set (assets and suppliers) to try the product, and remove exactly those records in one action. A banner is shown to everyone while sample data exists. Removal is refused, with the reason, while your own records still refer to a sample record.
• KEV by product — assets can carry vendor, product and version. The KEV report lists assets whose vendor and product match an actively exploited vulnerability as Verify version: the KEV catalog has no version ranges, so these are possible exposures, not confirmed ones.
• Owners are people — evidence and control-assessment owners are chosen from your members, like risks and policies; approving your own evidence or assessment shows the same message as elsewhere.
• Kubernetes — the Helm chart can mount a corporate CA for connectors (corporateCA, off by default).

Released 2026-10-26. Built from the pilot client's deep check of 1.1.0; migration 0054_notification_i18n runs on start-up.

• Exports match the screen — a control with status Not applicable is excluded in every SoA export and in the readiness score; PDFs render Latvian, Lithuanian and Cyrillic text; SoA justifications are printed in full (a very long one says it was shortened and where the full text is).
• SoA import — import an existing Statement of Applicability (CSV or XLSX, including our own export) from the Controls page: preview every change, then confirm. Approved assessments are not changed.
• Language — PDF reports, notifications and the help page follow the interface language (EN/LV/RU); AURA answers in the language of the question.
• Consistent figures — risk and control cards agree on unapproved evidence; freshness and asset visibility say what they are computed over; NIS2 pages say not enabled instead of 0 %.
• Forms — a closed nonconformity explains which fields are frozen (its incident link stays editable); editing an incident no longer asks for a reason when the awareness time was not changed; the current, unapproved version of an evidence chain can be withdrawn (history is kept).

Released 2026-10-21. Fixes found by the pilot client in 1.1.0; migration 0053_legacy_backfill runs on start-up.

• Action1 — set the organization id in the connector; inventory is read per organization.
• Jira Server / Data Center — REST API v2 supported; the version is detected automatically (or set it).
• Corporate CA — put your CA certificates (PEM .crt) in certs/ca/ in the install directory; connectors trust them, TLS verification stays on, updates never touch the directory.
• Connection errors say what failed: DNS, connection (host, port, address), TLS or timeout. The integration card shows one current state; an older failure is kept as dated history.
• Trend Vision One — runs that hit the page limit continue where they stopped and report progress.
• Honest numbers — assurance and the evidence pack count only evidence that counts; an approved but empty policy no longer counts for governance; a self-declared control status earns half the residual-risk credit and the risk card shows which controls are backed by evidence; AURA answers about the control you name (A.8.5, 8.5).
• Earlier records — account types are re-suggested without waiting for a sync (manual choices are kept); tasks verified before the 1.1 rules are flagged for re-check; earlier MFA tasks are linked to A.8.5 and A.5.17.

Released 2026-10-21. Built from the first pilot client's report on 1.0.4: every record can now be opened, edited and linked, numbers say no data instead of inventing a score, and approvals need a second person. Six migrations (0043–0048, 0051, 0052) run on start-up.

• Backups include the evidence files. The built-in backup (Settings → Backups and the nightly run) now uploads an encrypted evidence.tar.age beside the database dump, and the page marks older runs as Database only. Backup runs — in-app and scripts/backup.sh — are recorded in each organization's verifiable audit chain.
• Incidents (NIS2 Art. 23). Awareness time is set and edited with a reason; each report stage is recorded with sent-at, recipient, reference and an optional attachment, and can be corrected or voided, never deleted. The final report is due one month after the 72-hour notification. Timeline, playbook steps, close/reopen and deadline reminders.
• Risks and tasks. Owners from your members, treatment, linked controls (residual risk is derived from them), two-step acceptance by a different person, and a task workflow that needs evidence or a note and a second person to verify.
• Evidence, nonconformities, policies. Pick controls when uploading; attach evidence from a control; nonconformities link controls, findings and incidents; effectiveness and policy approval need a second person; policies carry text or a file and keep every approved version.
• Suppliers and assets. Full supplier profile with contract, DPA and certificates, an explained risk score; editable and bulk-editable assets, Not set instead of silent defaults, and "unknown" coverage is no longer counted as a gap.
• Connectors. Trend Vision One reads every page and keeps one finding per alert (host, model, Workbench link); errors say what came back; assets carry first/last seen and go stale; Entra ID accounts are typed (person/service/shared/sync) with MFA exceptions and bulk tasks; the MFA coverage snapshot can be attached as evidence.
• Honest numbers, language and dates. Dimensions without data are excluded from the readiness index; reports follow the enabled frameworks; the organization's time zone is used for every date; RU/LV no longer fall back to English in the console. Invite members by e-mail link; choose who receives which notification; AURA answers in your language and only about enabled frameworks.

Released 2026-10-05. A security release first: upgrade every install, whether or not you use the features below.

• Entra ID MFA coverage names the accounts. The percentage on the Integrations page now drills down to the enabled member accounts outside MFA, and one remediation task per account can be raised from there (tenant-scoped, recorded in the audit trail). Adds migration 0042_connector_identity_posture; it runs on start-up.
• Off-box backups. scripts/backup-r2.sh now checks the directory it actually uploads (BACKUP_DIR) and uploads only age-encrypted files; anything else in that directory is skipped and named in a warning. If your backups live on a separate volume, pass the same BACKUP_DIR to backup.sh and backup-r2.sh.
• Monitoring overlay (optional, docker-compose.monitoring.yml): images are pinned to versions (they were :latest), every service rotates its logs, and host disk, memory and read-only-filesystem alerts are included. Put your own probe targets in infra/monitoring/scrape.d/ — see its README.

Released 2026-08-19. Forty findings from twelve hours of real testing by a pilot customer on 1.0.2 — a live Entra ID tenant of 1411 users and 1997 devices, a wildcard certificate, Jira Server 8.4.0, an internal Zabbix. Upgrade if you use connectors, rely on the audit trail as evidence, or run a wildcard certificate.

CONNECTOR_ALLOWED_CIDRS=192.168.10.0/24,10.0.0.0/8

• Sign-ins are recorded, attributed and hash-chained. Authentication events had a null actor, no sequence_number and no prev_hash, and were invisible through the API because their organization_id was null — so the audit trail could show that someone signed in from an address, not who. The rule now held, and asserted by a test, is that every event visible in an organization's audit view is in that organization's chain, with contiguous sequence numbers. The API also returns sequence_number, prev_hash and entry_hash, without which an external auditor could not verify the chain at all.
• Deployment-level events stay outside the chain — by design, not by omission. A completed backup, or a failed sign-in for an address belonging to no account, is recorded with its context but belongs to no organization, so it is in no organization's chain; attributing it to one would be an invention. SELECTing backup.completed will therefore still show a null sequence_number. A verifiable deployment-level chain does not exist yet — if you need one for a certification, say so. An earlier draft of these notes said the chain covered backup events too; it does not, and that wording was corrected before release after checking our own deployment rather than our changelog.
• Imported devices no longer merge on hostname. Entra ID devices were keyed on displayName, so two hosts sharing a name collapsed into one asset irrecoverably — 545 of 1997 records at the pilot customer, while the run summary reported 1997 imported. Devices key on the source's own identifier now, the run reports created / updated / total separately, and migration 0041 replaces the database constraint that required the collapse. Re-run your connectors after upgrading to re-key existing assets.
• MFA coverage is computed over one population. The denominator included disabled accounts; the numerator counted registration-report rows that were never matched to the directory, guests included. It is now enabled, non-guest member accounts matched by directory id. Expect the number to change — the old one was not measuring what it named. It still cannot be expanded to a list of people; identities are not stored as an entity yet.
• A long form no longer fails after a session refresh. The CSRF nonce rotated on refresh, so a request replayed afterwards carried the value read at page load and was rejected. Refresh no longer rotates it.
• Wildcard certificates are accepted. Hostname matching implements RFC 6125 §6.4.3, so *.example.com covers host.example.com (and correctly does not cover a.b.example.com).
• Connector failures say what the provider said. The Azure error code, description and trace id reach the operator instead of Token request failed (400), and confusing the tenant ID with the client ID is called out by name.
• "Test connection" tests what the sync actually reads. It probed one resource that needs no permission, so it went green and the sync then failed with 403. It now probes every resource the sync uses and reports them line by line.
• Required permissions are shown in the connect form — the scopes, the admin-consent note, and whether the source has to be reachable on your internal network. They were previously only in the source code.
• Jira Server / Data Center is supported alongside Jira Cloud.
• Licence usage shows assets, the limit an import actually consumes.
• Maturity scores carry their coverage, so a percentage cannot read as complete while most controls are unassessed; the control matrix distinguishes "gap" from "not yet assessed".
• A licence gate is no longer shown as a loading error, and is shown in your language.
• Localisation completed for the maturity questionnaire, sectors, turnover bands and role names.
• New page: Connectors — reachability, the permissions each source needs, per-product notes (Jira Cloud vs Server, EU endpoints), and how to read a failed run. There had been no connector documentation at all for a catalogue of sixteen.
• Documentation matches the shipped version, and the reverse proxy emits exactly one Content-Security-Policy header.

Released 2026-08-17 in response to a pilot customer's install report. Contains a security fix: upgrade if you installed 1.0.1 or earlier.

cd <install dir> && stat -c '%a %n' .env    # 644 means you are affected
chmod 600 .env && stat -c '%a %n' .env      # must print 600

• An access-gate login page is no longer misdiagnosed as tampering. A gate answers an unauthorised download with HTTP 200 and an HTML page, so get.sh failed two steps later with SIGNATURE VERIFICATION FAILED — sending the operator after a supply-chain incident when the real cause was an unauthorised egress address. Both downloads now detect markup first and say so.
• get.sh states its own revision (grep -m1 GETSH_REVISION= get.sh), so a stale saved copy is recognisable instead of having to be trusted.
• Install documentation corrected: the outbound-access table (destination, port, reason, phase) that was missing, the git clone of a private repository that should never have been there, and docker compose version wording that read as rejecting anything newer than v2.
• The self-signed certificate covers the server's IP too, and --tls-san takes extra names.
• CVE-2026-53615 (util-linux, HIGH) patched in the API and control-plane images.
• SBOM is now actually published alongside the bundle. It had been generated for every release and never uploaded, while the install guide listed it among the shipped artifacts.

Released 2026-08-16 — the first build fit to hand to a pilot customer.

• The on-prem bundle stopped shipping Cerynix's own internals. The tarball is git archive of the tag, so v1.0.0 delivered CI workflows, agent instructions and — the reason this is a fix and not housekeeping — our internal security-finding registers to every customer who unpacked it.
• Seven follow-ups from the pre-release adversarial reviews: an LDAP first-login race, DN comparison, clamping directory-controlled strings, a billing-event watermark that could be poisoned by a far-future timestamp, and the licence entitlement basis recorded on the licence row.

Released 2026-07-30 — the first stable release, cut after two independent adversarial review passes and a systematic audit of every claim the product makes about itself. That audit found roughly 70 claim defects, ten of them release-blocking, and all ten were fixed before the tag rather than shipped with an asterisk.

• Audit-evidence chain: hash-chained ledger, immutable snapshots with a database append-only trigger, and a minisign-signed export package that verifies offline with a stdlib-only verifier.
• Clean-VM install qualification: signature verified inside the VM, installer self-test, licence issued and activated, and the golden path driven through to a signed export verified offline.
• Legal and documentation corrections, including removing a Art. 32 measure from the DPA that did not exist in the code.

The v1.0 release candidate: a signed release (cosign-signed container images, an SPDX SBOM and a minisign-signed on-prem bundle) covering the full NIS2 + ISO/IEC 27001:2022 + GDPR control library, findings/CAPA/RCA workflow, management review and a signed Audit Room export. Deployed to production on 2026-07-28 under explicit owner authorization.

Private preview: self-registration is off and access is invite-only while we validate the platform with a small number of organizations before general availability.

The Cerynix rebrand release. Added SSO (SAML) and LDAP sign-in with SCIM 2.0 provisioning, TOTP MFA, a threat-intelligence / CISA KEV exposure feed, AURA RAG v2 (grounded, conversation-log AI assistant), third-party connectors, white-label PDF reports, and the Control Plane / HQ fleet-management console.

Added TLS/HTTPS via a bundled reverse proxy (with bring-your-own certificate support), offline Ed25519-signed commercial licensing across four editions, an application version/build footer, auth-endpoint rate limiting, mobile navigation, Prometheus metrics and a /readyz readiness probe, and end-to-end tests covering the core readiness claims.

The initial tagged release: the multi-tenant foundation (organizations, workspaces, five-role RBAC, JWT auth with bcrypt and account lockout, a tamper-evident hash-chained audit ledger) and the first version of the NIS2 control library with assessments and an evidence vault.