v0.15.1· May 9, 2026Fix
Migration runner and schema verifier
- — Fixed migrate-tolerant.mjs eating drizzle's `--> statement-breakpoint` markers — line-comment stripping was matching them because they start with `--`. Caught while migrating production from 0002 → 0010.
- — Extended scripts/check-schema.mjs to verify every column and table introduced by migrations 0009 and 0010, so a deploy gap can be detected with a single command.
v0.15.0· May 9, 2026Feature
Pass-3 docs-promise audit — only what's promised, no scope creep
- — N-of-M document approvals: configure the threshold under Settings → Drift, with per-approver tracking and a publish gate that blocks until the count is met.
- — Approval reminder cadence — pending approvals get a 48-hour reminder and a 7-day escalation to the workspace owner, on a single Inngest cron.
- — SOC 2 scope toggle under Settings → SOC 2 scope: Security is mandatory; Availability, Confidentiality, Processing Integrity, and Privacy are opt-in. The generator validates the LLM honored your scope.
- — Plausible / PostHog opt-in for the public trust center, under Settings → Branding. Off by default; emits a single first-party snippet.
- — Public GDPR Art. 28(2) subprocessor objection form at /trust/<slug>/object — file an objection, customer dashboard surfaces them with an `objection` notification state.
- — Approver role alongside admin, with the same approval power. Team page exposes role assignment.
- — AIBOM and Atom feed now resolve URLs through a single `tenantTrustBaseUrl` helper that respects custom domains.
- — API tokens migrated to `atst_live_<base64url>` format (legacy `att_live_` tokens still verify).
- — Webhook event renamed `document.drift` → `drift.detected` with a backward-compat alias so existing subscribers keep working.
- — Two new packages on npm: `@attestly/sdk` (typed `defineDetectors` shim) and `@attestly/audit-cli` (zero-dependency offline verifier for audit-log JSON exports — chain integrity + Ed25519 signature).
v0.14.0· May 9, 2026Feature
Webhooks v2 and programmatic API
- — All ten documented events now wired end-to-end: scan.completed/failed, document.created/published, drift.detected, subprocessor.added/removed, license.policy_violation, aibom.changed, dpa.signed.
- — Outbound deliveries are recorded in `webhook_deliveries` (status, duration, attempt). Failures retry with exponential backoff up to 24h, then drop into a dead-letter you can replay from Settings → Webhooks.
- — POST / GET / DELETE `/api/v1/webhooks` — token-authenticated programmatic subscriptions matching the curl snippet in the docs. Creating returns the one-time signing secret.
- — /api/v1/audit — NDJSON cursor-paginated stream of audit-log entries with `X-Attestly-Public-Key` and `X-Attestly-Next-Cursor` headers.
- — /trust/<slug>/audit-head.txt — public head hash + Ed25519 public key + counts, for cross-checking signed exports.
v0.13.0· May 9, 2026Feature
Tamper-evident audit log, DPA signing, drift magic-link, GitHub PR checks
- — Audit log: every entry now stores SHA-256(prev_hash || canonical_json(body)) as `chain_hash`. Modifying any entry breaks the chain and any verifier can detect it.
- — Per-tenant Ed25519 keypair (private key AES-256-GCM-encrypted under SECRETS_ENCRYPTION_KEY) signs every audit-export header. Rotation supported.
- — Audit export now ships CSV, JSON, and PDF — all carry the head hash, signature algorithm, and signature so an auditor can verify offline.
- — Self-serve DPA signing on the trust center: customers sign at /trust/<slug>/dpa/sign, the rendered Markdown's SHA-256 is verified at submit, and they get a signed copy as .txt or .pdf.
- — OSS license policy: configure allowed/denied SPDX identifiers under Settings → OSS policy. Presets for permissive-only or permissive+LGPL. The OSS Attribution generator pre-classifies every package so the LLM can't invent license findings.
- — One-click magic-link drift approval from email: /approve/<token> shows a diff, Approve republishes the latest draft, Dismiss closes the alert. Audit-logged with IP.
- — GitHub PR-scoped scans: PR opened/synchronize creates an in-progress check; on completion the check concludes success / neutral / action_required based on drift severity.
- — GitHub webhook signatures verified with constant-time HMAC-SHA-256 compare.
- — SOC 2 readiness pack now consumes repo-declared controls from `.attestly/controls.yaml` and renders them as a dedicated section.
v0.12.0· May 9, 2026Improvement
Enterprise-grade scanner accuracy
- — Personal-data detection rebuilt on a ts-morph AST walk — only flags identifiers in real declarations (variables, properties, params), so comments and string literals no longer trip false positives.
- — Polyglot support: dedicated import / manifest / lockfile sweepers for Python, Go, and Rust, plus Ruby Gemfile.lock parsing.
- — Lockfile traversal across npm v2/v3, pnpm, yarn classic, requirements.txt, Pipfile.lock, poetry.lock, go.sum, Cargo.lock, and Gemfile.lock for license findings on transitive deps.
- — File-path heuristics: tests, vendored code, and minified files get a confidence downgrade; AI findings under /hiring/, /credit/, /admissions/ are promoted to high-risk under the EU AI Act.
- — Repo-side configuration honored: `.attestly/detectors.{ts,json}` (custom detectors), `.attestly/vendor.toml` (vendored licenses), and `.attestly/controls.yaml` (internal SOC 2 controls). Parsed statically with Babel — never executed.
- — Built-in detector library expanded across AI, payments, analytics, auth, storage, identity, email, and communications — with language-specific package keys (npm, py, go, rust).
- — New within-scan dedupe pass collapses the same SDK detected via package.json + lockfile + import statements into a single highest-confidence finding.
- — Synthetic-repo regression test asserts 13 accuracy invariants — currently 13/13 green.
v0.11.0· May 7, 2026Improvement
Marketing surface, mobile polish, and a real 404
- — Added Security, Changelog, and About pages and surfaced them in the footer + mobile menu.
- — Branded 404 page replaces the default Next.js error.
- — Onboarding interview ships at /dashboard/onboarding — the five questions promised since launch.
- — Fixed horizontal overflow on the Forcing function section on small screens.
v0.10.0· April 26, 2026Feature
Trust-center publishing
- — Public routing for <slug>.trust.attestly.dev — both the landing page and per-document permalinks.
- — Publish action moves a document version from draft to published and pins it on your trust center.
- — Markdown rendering pipeline for all four document types with citation footnotes.
v0.9.0· April 18, 2026Feature
Document version history + downloads
- — Dashboard now shows every generated version of every document, with diffable rendered Markdown.
- — One-click Markdown download per version.
- — Re-running a scan creates a new draft instead of overwriting the published version.
v0.8.0· April 9, 2026Feature
Inngest workers — scan and generate end-to-end
- — Background scanner downloads your repository, runs automated detectors, and persists structured findings.
- — Four generators (AI Trust Center, Privacy Policy, DPA, OSS Attribution) run in parallel after a scan.
- — Every published fact carries a sourcePath and sourceLine — citations are not optional.
v0.7.0· March 30, 2026Feature
GitHub OAuth + repo connection
- — Connect a repository through a read-only GitHub OAuth flow.
- — Repository list and per-repo detail page in the dashboard.
- — First-class support for monorepos via path-scoped scans.
v0.6.0· March 21, 2026Improvement
Postgres + Drizzle schema
- — Neon Postgres goes live with 13 tables, including tenants, scans, findings, document versions, and subprocessors.
- — Tenant isolation enforced at the row level; every server action resolves the caller's tenant first.
v0.5.0· March 12, 2026Feature
Generator schemas locked
- — Every document type now generates against a strict schema. No free-form LLM prose ever ships in a published legal document.
- — Renderer produces deterministic Markdown so two runs over the same findings produce the same output.
v0.4.0· March 4, 2026Feature
Scanner detectors v1
- — AST-based detection for OpenAI, Anthropic, Google AI, AWS Bedrock, Stripe, Resend, Sentry, PostHog, Auth0, Clerk, Supabase, and 25+ SDKs in total.
- — License detection across package.json, Cargo.toml, requirements.txt, and go.mod.
v0.1.0· February 14, 2026Launch
Attestly is live in private beta
- — Code-aware compliance: trust center, privacy policy, DPA, and OSS attribution generated from your repo.
- — Wedge: EU AI Act high-risk obligations apply Aug 2, 2026.