A release is accepted only when its source commit, build manifest, checksums, migrations and rollback command agree.
The public site and the operational platform are deployed independently, but refer to the same canonical source revision.
The exact source revision used by the build.
Integrity values for deployed packages and configuration.
The database version expected by the release.
A tested command and the previous compatible artifact.
Deployment is the moment most incidents are born. Ours is deliberately boring.
Each version is packaged as a sealed archive with a checksum, unpacked into its own folder and left untouched. Publishing means pointing a switch at the new folder — an instant, single operation. The previous version stays on disk exactly as it was.
Because the old folder was never modified, undoing a release means pointing the switch back. There is no restore procedure to improvise at two in the morning, and the command is written down before the release goes out, not after something breaks.
The website you are reading and the operational platform are released independently, so a copy change can never disturb protection, and a platform fix does not wait for marketing text. Each keeps its own version history.
Automated tests, a type check, a link and structure check of every generated page, and a claim audit that fails the build if a public page contains an identifier or a version number without a verified source behind it.
Entries describe what changed for you, not which internal component was touched.
If a release changes what a capability can do, its state changes with it on the status page — a capability never quietly becomes «available» without a check behind it. You can also follow releases in a feed reader.
Notable platform releases, in reverse chronological order.RSS
Public reputation feeds are read and every address we already hold for you is checked against them. Nothing is sent to your servers: the lists are read, and the names you gave us are resolved. The finding worth having is the uncomfortable one — your own address inside a listed network, which is how mail starts bouncing and other networks start dropping your traffic, usually without anybody telling you. Spamhaus DROP is used because its terms say plainly that it is free for everyone, and its attribution travels in every row we store. Tor exit nodes are reported too, but as context rather than as wrongdoing: running one is not an attack, and a system that called it one would be teaching you to ignore it. One well-known feed was left out because its terms never say whether commercial use is allowed, which is the same test another feed failed earlier this year.
Two capabilities had been built and could reach nobody: the browser snippet and the WordPress connector both needed a public address, and the only one published sat behind an access proxy that answers 401 to everyone. There is now a dedicated hostname carrying exactly four routes — beacon, inventory, malware reports, public scan — and a 404 for everything else, so the surface is a list somebody can read rather than a proxy rule somebody has to trust. The malware agent stopped needing its courier and posts directly. Payment page integrity moves from unavailable to available on the strength of that, not on a promise.
For sites on our own infrastructure, an agent beside the scanner reads the web content daily and reports conclusions — a path, a signature name, a hash — never the files themselves. It caught a planted test file across 9,415 files in about seventy seconds. A web shell is critical, a packed installer is a nuisance, and the test signature is neither: reporting them all the same way would teach an operator to ignore the panel. Adds 38,927 free third-party signatures, because the core scanner is strong on binaries and thin on the PHP shells that actually turn up on shared hosting.
A card skimmer never touches the server: it arrives as one more script on the checkout page and reads the number out of the form before your own code sees it. So the origin is unchanged and a content hash sees nothing. This watches from the only place it exists — the visitor's browser — and reports structure, never content: which script hosts load, whether a native browser function has been replaced, how many inputs sit where nobody can see them. The first report is a silent baseline. A replaced function is something to explain, not proof of anything: that is also how every session-replay tool works.
Certificate logs already tell us about names somebody asked a CA to certify. This finds the rest, by reading public indexes and asking DNS resolvers — nothing is sent to your servers. The finding worth having is a record pointing at a service that no longer exists: your subdomain is unclaimed at the provider, and whoever registers it there serves content from an address that still carries your name. Reported only after two consecutive sweeps agree, so a resolver having a bad minute does not become an accusation. Mapping our own estate turned up 29 names, including one host we had not listed anywhere.
Generate a report for a period and it states a verdict for each Article 21 measure, cites the exact records behind it — audit entries, signed bundles, drill receipts, case timings — and carries a content hash so a reader can tell it has not been altered. A measure with no recent evidence is reported as Unknown, never as a pass. Three of the ten measures are organisational, and the document says plainly that we do not observe them: training, human resources security, and secured emergency communications.
Every audited action now shows who took it and what the configuration looked like before and after; the records always held this and the screen never showed it. Periodic jobs moved off the shared loop so a slow scan no longer delays anything else, and failed background jobs now back off and dead-letter instead of retrying forever. The Wordfence feed was removed: it is not licensed for the commercial use we intend. WordPress advisories now come from NVD's public CPE data, which is thinner and slower, and says so.
A short snippet, pasted into a page the way an analytics tag would be, reports content-security-policy violations and uncaught JavaScript errors from real visitors' browsers. The key is public and carries no secret; only aggregates are stored, never a visitor.
You name the URL and what proves it is healthy — a status code, a marker in the page. Every five minutes we check it from outside, and a failure opens a case instead of waiting for a customer to notice.
We generate the names a fraudster would register against yours - a dropped letter, a swapped ending, a zero for an o - and check which of them actually resolve. Across the current portfolio that surfaced 45 registered look-alikes.
Public Certificate Transparency logs are read for every monitored domain. What exists when we start watching is recorded silently as a baseline; a certificate that appears afterwards opens a case, because that is the moment to ask whether you issued it.
TLS, security headers, cookie flags, version exposure, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and CAA are checked from outside the perimeter and summarised as a grade from A to F. Nothing is installed and no traffic is redirected; a domain can be monitored this way and nothing else.
Cases can be picked up, annotated, closed, reopened and snoozed, with the operator queue filtered and paged. Notification email with double opt-in and a periodic digest. Account, team and plan settings on their own pages instead of one long form. Autonomy presets with exceptions.
Activation guidance, recovery hostname drill and private origin proof landed in the control plane. Enforcement remains gated behind stability windows and rollback evidence.
Minute-level traffic rollups, observation attribution and verified status displays now power the operational dashboard without entering the visitor request path.
The customer dashboard moved to route-scoped data loading, explicit unknown states and a persistent product shell for portfolio and per-domain operations.
Policy replay evidence, customer edge fallback routes and freshness controls were exercised end to end, including an origin outage drill.
Sign-in moved to the self-hosted AegiFlow identity flow: OIDC sessions, passkeys, TOTP and step-up verification before sensitive actions, with Romanian onboarding.
The public website moved to a single bilingual Astro source with immutable releases, checksums and a tested rollback path.