SentriKat Early Access is open: Cloud is free on the plan you choose, no credit card. Get started
Changelog

What's New

Release notes, new features, improvements, and fixes. Subscribe to the RSS feed to stay updated.

v1.3.0-beta

Beta 2026-09-30

Code dependencies, containers, high availability

  • Improved Upgrade note: back up the database first. New migrations run at the first start and are one-way. Upgrading from any earlier release (1.0.0-beta.1 to 1.2.0-beta) keeps data, users, settings and agent keys. Update agents to 1.7.0 with Push Update All.
  • New Repository scanner for CI and developer machines: one file downloaded from your own server, with ready-to-paste steps for GitHub Actions and GitLab CI, and a fail-on-severity option that breaks the build on high or critical findings in shipped code
  • New More project types read the way the build tools read them: npm, pnpm, Yarn 2+ and bun lock files, Ruby Gemfile.lock, Maven and Gradle (parents and BOMs resolved), .NET projects without a lock file, Dart, Swift, Elixir and pdm
  • New One fix plan per project, the same on the page and in the terminal: the lowest version of each package that fixes every finding on the installed branch
  • New Java applications already running on your servers (.jar, .war, .ear, including packed libraries) are identified by build metadata or exact checksum, so a renamed library is still recognised
  • Improved Dependencies page rebuilt around projects: one row per project, most urgent first, a full page per scan. Shipped code and development tools are kept apart, and a scan says what it could not read and why
  • New Container images: the runtime the image is built around (Node.js, Python, Ruby, PHP) is now checked, with the version that fixes each finding
  • New Out-of-support base images and runtimes are called out with the date support ended
  • Improved Each CVE is counted once per image, vulnerabilities that apply only to Windows or macOS are no longer reported on Linux images, and organization administrators can change the severities agents report for images
  • Improved Dashboard says what is at risk in your code or containers instead of "nothing is being attacked", and the notification bell lists only things to do, each with a count and a link
  • New Exact update commands for apt, dnf, yum, zypper, apk and Homebrew, shown only when the fixing version is known
  • New Sample inventory for a new organization (real products at old versions), removable with one click
  • Improved Faster vulnerability list on large tenants, long-running actions run in the background, and lists gain sorting, resizable columns and filters by state, date range and SLA
  • Improved Software identification improved and checked against independent references. Linux packages are judged by the fixes each distribution ships, backports included. Identification that is not certain is left out rather than guessed
  • Security Sign out everywhere, from your profile or by an administrator for any user. Logging out revokes the session on the server
  • Security Passwords follow NIST SP 800-63B (length first, no composition rules, common passwords refused). Existing passwords keep working and users are told at login if theirs no longer meets the policy
  • Security Writes are accepted only from your own SentriKat page, post-login redirects stay on your server, and first-start setup refuses a weak administrator password
  • Improved A SECRET_KEY of 32 to 63 characters no longer stops an upgrade: a health warning asks you to rotate it
  • New High availability: with two servers on the same database only one runs the scheduled jobs, and the other takes over within about two minutes if it stops
  • Improved Outgoing traffic follows your proxy settings (public services through the proxy, internal ones directly, NO_PROXY honoured), and a time zone change reaches scheduled jobs within minutes without a restart
  • Improved Accessibility fixes across all pages (WCAG 2.1 A and AA)

v0.2.0

Release 2026-04-13

Sprint 4 + 5, SBOM, Compliance & Remediation

  • New SBOM export in CycloneDX 1.5, SPDX 2.3 and STIX 2.1
  • New Compliance gap-analysis reports for PCI-DSS v4.0, ISO/IEC 27001:2022 and SOC 2, JSON or PDF, PASS/PARTIAL/FAIL per control, HMAC-SHA256 integrity block
  • New Remediation Assignments page, full CRUD with filters, inline status change, SLA-driven due dates
  • New Multi-tracker integration, Jira, GitHub Issues, GitLab Issues, YouTrack and generic Webhook (up to 4 simultaneous)
  • New Risk Exception management, accept-the-risk workflow with justification, optional expiry and audit evidence for ISO 27001 / SOC 2
  • New Vulnerability Trending dashboard, daily snapshots, Chart.js widget (total / by severity / open vs resolved)
  • New Patch Tuesday digest, automated monthly email with Microsoft CVEs affecting your fleet, the day after Patch Tuesday at 09:00 UTC
  • Improved Agent delta scan with SHA-256 hashing, ~90% less bandwidth on unchanged hosts
  • Improved Agent payload gzip compression with zip-bomb protection and offline store-and-forward spool for unstable links
  • Improved Product aliases, vendor/product disambiguation so variants roll up to a single canonical record

v0.1.0

Early Access 2026-04-02

Early Access Launch

  • New Cloud platform available at app.sentrikat.com
  • New On-premises deployment via Docker Compose
  • New Exploited-vulnerability feeds, one of them European
  • New CVSS enrichment cross-checked across three databases
  • New Agents for Windows, Linux, and macOS
  • New Container scanning (Docker & Podman via Trivy)
  • New Dependency scanning (7 ecosystems, 11 lockfile formats)
  • New NIS2 Article 21 & DORA compliance reports
  • New SIEM integration (CEF, JSON, RFC 5424)
  • New Jira, GitHub Issues, GitLab Issues integration
  • New Email alerts with daily/weekly digests
  • New Customer portal with license management