RiskEye
Changelog
All systems operational Home
Release notes

What's new in RiskEye.

Every production release, in reverse chronological order. Follow Keep a Changelog conventions; the current build is v1.4.2.

v1.6.6
Current
2026-02-28
Fixed
  • ▸Code review action items — swept the "must fix" bucket from the review:
Deferred (needs separate scope + testing agent)
  • ▸High-complexity function refactor (m365/engine.py:run_assessment cx=27, m365/report.py:build_executive_pdf, m365/demo_seed.py:_build_scan) — would need the testing agent to lock down regressions on live M365 scans.
  • ▸Large-component extraction (OnboardingWizard, AdvisorNotes, RiskFormDialog, Projects.jsx) — behaviour-preserving extraction is a 1–2 day job; defer until after the Entra ID SSO work ships.
  • ▸localStorage → httpOnly cookie migration for the JWT in auth.jsx — architectural; would break the current CORS/preview setup and needs CSRF middleware on the backend. Defer.
  • ▸Nested ternaries + Python is "value" in test files — readability only; no runtime bugs.
v1.6.5
2026-02-28
Added
  • ▸Google Search Console verification — added /app/frontend/public/google94a16c2be4cb3d0a.html so https://riskeye.io/google94a16c2be4cb3d0a.html returns the one-line verification token. Served HTTP 200 from the preview. Once the production domain serves this file, GSC verification turns green and the submitted sitemap starts rich-snippet pickup.
v1.6.4
2026-02-28
Changed
  • ▸Marketing dashboard screenshot refreshed — Patched the heatmap.png hero asset (used in Landing feature-row #1) to show "Risk Overview" instead of "Governance Overview". Used Pillow to paint over the old title with the surrounding #FBFBF9 background and redraw the new title in the same navy (#0A1329) at the same visual weight. Asset re-saved and verified live on /#platform.
v1.6.3
2026-02-28
Added
  • ▸Full SEO + AI crawler optimisation pass. Updated public SEO assets with the new positioning and expanded schema coverage:
v1.6.2
2026-02-28
Changed
  • ▸Repositioning — RiskEye is no longer marketed as a "complete governance platform". New line: *digital risk register and M365 assessment platform with action tracking*. Rewrote hero sub-copy, feature-showcase H2, persona-grid H2, final-CTA H2, and footer tagline on Landing.jsx; renamed the board-report mockup heading from "Governance dashboard" to "Risk register snapshot"; swapped the "GRC advisor" wording on the setup FAQ to "risk advisor"; retitled Dashboard header "Governance Overview" → "Risk Overview"; renamed Pricing compare group "Platform & governance" → "Platform & security"; updated About page document.title + hero copy; updated Blog document.title; updated the Register-step tagline on HowToUse.jsx ("GRC programme" → "risk programme"); rewrote index.html <title>, meta description, keywords, OG, Twitter, AI-content declaration, JSON-LD Organization description, and the noscript <h1> + body copy.
v1.6.1
2026-02-28
Changed
  • ▸Pricing lowered — Starter now $10/seat/mo annual ($20 monthly), The Works $20/seat/mo annual ($30 monthly). Updated PLAN_META in payments.py, Stripe CATALOG amounts in stripe_catalog.py (prices rotate on next backend boot via idempotent sync), the compare-table commercial row, FAQ copy, and the annual-toggle savings label (now "save up to 50%" — Starter 50%, Works 33%).
v1.6.0
2026-02-28
Added
  • ▸Pricing FAQ accordion — 6-question single-open accordion under the Compare table on /pricing ("Can I switch plans later?", renewal, annual discounts, free trial, payment methods, cancellation). shadcn Accordion wired to dark-theme styling with numbered rows and cyan accents.
  • ▸Stripe claim CTA (Settings → Billing) — admin-only BillingCard that reads live Stripe mode from new endpoint GET /api/payments/stripe-status (derives test vs live from STRIPE_SECRET_KEY prefix). Shows a Test/Live mode badge, pre-claim checklist, and "Claim my Stripe account" button linking to STRIPE_CLAIM_URL (defaults to https://dashboard.stripe.com/register). Flips to "Open Stripe dashboard" + "View payouts" once live-mode keys are detected.
v1.5.9
2026-02-28
Added
  • ▸Compare all features collapsible table under the 3 pricing cards on /pricing. 5 grouped sections (Core, Platform, Automation, Expert Support, Commercial), ~18 rows with check / cross / allowance values per plan. Sticky CTA row with Buy / Contact buttons. Mobile-friendly stacked layout at <md.
v1.5.8
2026-02-28
Added
  • ▸Public pricing page at /pricing with 3 cards (Starter · The Works · Ultimate), annual/monthly billing toggle, "Buy" buttons that redirect to Stripe Checkout. Stripe Flow A sandbox provisioned; 2 products + 4 prices synced idempotently on backend boot via stripe_catalog.ensure_catalog(). New endpoints: GET /api/pricing/plans, POST /api/payments/checkout, GET /api/payments/status/{sid}, POST /api/stripe/webhook. On confirmed checkout.session.completed, the configured PURCHASE_NOTIFY_EMAIL + every tenant Admin + every super admin is emailed a branded purchase summary. No access is auto-provisioned — operator onboards manually.
  • ▸/payment/success (polls status) and /payment/cancel landing pages matching the marketing aesthetic.
Fixed
  • ▸Global axios 401 interceptor was hard-redirecting every public page (/pricing, /trust, /about, etc.) to /login when the AuthProvider's /auth/me boot returned 401. Added a public-paths allow-list so unauth pages render cleanly.
v1.5.7
2026-02-28
Fixed
  • ▸Risk edit dialog · AssessmentPanel overlap — the Inherent / Current / Target cards were cramming the 5×5 grid picker, L/I inputs and score into one horizontal row inside a 3-column parent, so content bled together at md widths. Restructured to two rows: grid picker + big score on top, Likelihood / Impact inputs underneath.
  • ▸Risk edit dialog · hero banner contrast — tagline + KPI labels were low contrast on dark navy. Raised tagline to text-slate-200, bumped KPI tile borders/backgrounds (white/10, white/20), brightened kicker labels (cyan-100 font-semibold) and hint rows (slate-300), and switched KPI numbers to brighter accent colors.
v1.5.6
2026-02-28
Changed
  • ▸Risk drill-down (RiskDetail) rebuilt with a dark-navy gradient hero banner, severity-coloured left stripe + glow, chip rail (code · category · register · status · breach · overdue), owner avatar footer, 3-up "treatment reduction" KPI strip, redesigned ScoreCards that each show a mini 5×5 heatmap with the risk's cell highlighted, DeltaChip arrows between the three cards, iconed tabs, severity-accented findings list, iconed mitigations list, nicer treatment-plan empty state, and a vertical timeline for the History tab.
  • ▸Risk edit dialog (RiskFormDialog) rebuilt with the same navy hero band + live treatment KPIs, click-to-pick 5×5 grid pickers for each of Inherent / Current / Target (target is now explicitly editable), per-stage live severity badges and live scores, iconed section headers (Basics · Scoring · Exposure & plan), inline $ icon on the financial impact field, and an in-mode Status select on edit.
v1.5.5
2026-02-28
Added
  • ▸Dashboard · Existing vs Planned risk — two new boardroom-ready charts below the heatmap row.
v1.5.4
2026-02-28
Changed
  • ▸Humanize pass across in-app pages (marketing untouched).
  • ▸Project drawer toned down: dropped the dark-navy gradient and the dual cyan+emerald blur orbs plus the 40 px grid overlay that landed in the previous polish round. Now a flat navy banner with a single soft cyan accent in the top-right. Progress ring, stat chips, and pill chips kept intact.
v1.5.3
2026-02-28
Added
  • ▸Inline currency switcher on the Risk Appetite page header — Admins can change the policy currency in one click; publishes a new version with every other field cloned from the current policy.
Changed
  • ▸Project drawer redesigned with a dark navy gradient banner, 96 px cyan progress ring, pill-style status/health chips and a 4-up stat chip row (Tasks · Open · Milestones · Comments). Headline description now sits in a floating white card over the banner.
Fixed
  • ▸Projects Kanban card overflow — budget text no longer bleeds past the card border; the owner / target / budget footer honours min-w-0 + truncation on long values.
  • ▸Roadmap vote button — added type="button", stopPropagation, and optimistic UI so clicks register instantly; errors roll back the UI and surface a toast with the real reason.
v1.5.2
2026-02-28
Added
  • ▸Risk Appetite v2 — per-category thresholds, quantitative appetite (max tolerable single-risk + portfolio loss per category, currency selectable), board-approved appetite statements, breach email + in-app notifications on the breach edge, 12-month breach trend chart, residual-vs-appetite stacked bar chart per category, and an appetite summary tile on the main dashboard.
  • ▸financial_impact field on risks — quantitative exposure for a single risk; flips appetite_breach=true when it exceeds the category single-loss cap even if severity sits below the threshold.
  • ▸/api/appetite/summary · /breaches · /trend · /heatmap endpoints.
Removed
  • ▸Frameworks section (/frameworks, /frameworks/coverage, /frameworks/<code>) — pages, routes, and sidebar nav entries removed. Backend endpoints kept for M365 CIS internals.
  • ▸Controls section (/controls) — page, route, and sidebar nav entry removed; "Linked controls" tab on RiskDetail removed; linked_control_ids no longer collected in the risk create form. Backend endpoints kept for M365 CIS internals.
  • ▸Dashboard framework-coverage card replaced by the new Appetite summary card.
  • ▸HowToUse "Register your controls" + "Map controls to frameworks" steps removed.
v1.5.1
2026-02-28
Added
  • ▸Product Roadmap — new /roadmap page visible to every authenticated user. Three lanes (Next Release · Planned · Under Review), one-vote-per-user upvoting, "Request a feature" form for anyone, super-admin-only add/edit/move/delete controls. Backend syncs a curated roadmap_seed.json on every startup, upserting by stable slug so committed items always appear — while preserving every vote, voter and admin note across deploys and restarts. Nav link "Roadmap" added to the sidebar for all users.
v1.4.2
2026-02-27
Added
  • ▸CI import lint — backend/tools/lint_imports.py walks the AST of every backend .py file, extracts every third-party import, and fails the build if any package is missing from requirements.txt. Handles common name-mismatches (docx → python-docx, jwt → PyJWT, etc.). Wired into .pre-commit-config.yaml so git commit runs it automatically. Prevents the class of bug that broke the v1.4.0 deploy.
  • ▸starlette>=0.35.0 pinned explicitly (already installed transitively via fastapi; adding it makes the requirements complete against actual imports).
v1.4.1
2026-02-27
Fixed
  • ▸Production deploy hotfix — added weasyprint==70.0, python-docx>=1.1.0, and openpyxl>=3.1.0 to backend/requirements.txt. Fresh Kubernetes rollouts previously failed the health-check with ModuleNotFoundError: No module named 'weasyprint' because reports.py imported them but they were never pinned. Backend + all PDF/DOCX/XLSX report generators verified in 12/12 iter-14 regression.
v1.4.0
2026-02-27
Added
  • ▸Risk Register overhaul — bulk actions (status/category/owner/delete), Kanban view with drag-drop across 5 status columns, saved views persisted in localStorage, CSV import with client-side preview & per-row validation, CSV export of the current filter, 10-column customiser popover, and per-risk overdue-review flag with a "Mark reviewed" action.
  • ▸Trend history — per-risk score sparkline on the detail page, derived from the audit trail (GET /api/risks/{id}/score-history).
  • ▸Self-service email change — POST /api/users/me/email with current-password verification, uniqueness check and audit-logged old→new event.
  • ▸CSV import template — GET /api/risks/template returns a ready-to-fill CSV with realistic example rows.
  • ▸Version footer — sidebar bottom-left displays the running app version; backend echoes it on /api/ and /api/health.
  • ▸Changelog page — public /changelog route parses this file and renders the last N releases.
Changed
  • ▸Dates unified to DD/MM/YYYY across every page via /lib/dates.js (formatDate, formatDateTime, isoDate).
  • ▸Sidebar tagline → "a seQure Product". Sidebar brand mark now uses the landing-style gradient dot.
  • ▸Support email consolidated to hello@riskeye.io across Login, Trust, Landing and How-to-use.
  • ▸Landing product tour now uses real Frameworks + Snapshot-Report screenshots for the Coverage + Reports cards.
  • ▸Executive Summary PDF: KPI grid rebuilt as a real HTML table (4 tiles one line, severity-tinted borders, big numbers + micro-labels), with an auto-generated executive commentary block above.
v1.3.0
2026-02-26
Added
  • ▸Public marketing landing page at / with animated 5×5 risk-heatmap hero, twin persona strips, 6-card feature grid, dark 3-step "How it works" section, product tour, expandable FAQ, dark final-CTA card and Calendly-powered "Book a demo" links.
  • ▸Public /trust page with certifications (SMB1001 Gold Level 3 · Cybercert, CIS Controls v8), encryption posture, access controls, assurance features, component-level 90-day uptime timelines (API / Database / Email) and an incident feed.
  • ▸Live status pill (/api/health + /api/status, 30-second polling, 4 states) on Trust and Landing.
  • ▸How-to-use SOP at /how-to-use — 11-step guide covering Setup → People → Appetite → Register → Controls → Frameworks → Findings → Acceptances → Reporting → Assurance → Personal.
  • ▸Dashboard charts — severity donut, category bar chart, radial status chart (recharts 3.6).
  • ▸Profile page at /profile — every user can edit name, job title, avatar (≤1 MB PNG/JPEG/WebP) and change password.
  • ▸Audit search + filters + drill-down with row-level payload dialog, plus a CSV export of the current filter and a 30-day retention window (_purge_old_audit() on every read).
Changed
  • ▸Sidebar accent colour now derived from tenant.primary_color (RGB-mixed to a deep-navy base).
  • ▸Login screen redesigned with animated 5×5 risk-heatmap panel + SMB1001 Gold + CIS Controls badges.
  • ▸Report Register PDF gained a dedicated cybersecurity-professional cover matching the Executive report style.
v1.2.0
2026-02-25
Added
  • ▸Security audit remediation — WeasyPrint SSRF/XSS input-escape architecture (SEC-002), field allow-list PATCH endpoints (SEC-003), email+IP brute-force lockout with 429 (SEC-004), JWT rotation guard (SEC-001).
  • ▸Framework Coverage report heatmap with per-catalogue toggle across NIST CSF, ISO 27001, CIS v8, Essential 8, ISO 42001, NZISM, SCM0020.
  • ▸Framework Mapping UI — two-pane control-to-catalogue mapper.
  • ▸Super-admin controls — user and tenant suspension with reason and audit trail.
  • ▸TOTP 2FA required on every sign-in (pyotp + qrcode); 10 one-time recovery codes issued at enrolment.
  • ▸Data-at-rest encryption — Fernet-encrypted TOTP secrets; HMAC-hashed invitation and reset tokens.
Changed
  • ▸DB renamed sequre_grc → RiskEye at prod cut-over. Legacy @acme.demo accounts purged on every startup.
  • ▸Emergent-managed Resend integration for invites, resets and expiry emails (log-fallback if the proxy fails).
  • ▸Global font set to San Francisco stack.
v1.1.0
2026-02-20
Added
  • ▸Hash-chained audit trail — SHA-256 chain across every mutation, verifiable via GET /api/audit/verify.
  • ▸Snapshot reporting — Executive Summary + Risk Register PDF/DOCX/XLSX exports, byte-identical regeneration via a stored snapshot integrity hash.
  • ▸Acceptance workflow — request → approve → auto-expire, with named approvers, justifications and email notifications.
  • ▸Cross-tenant Portfolio view for super-admins.
v1.0.0
2026-02-15
Added
  • ▸Initial Governance, Risk & Compliance web platform: multi-tenant, 5×5 risk register, controls, findings, mitigations, risk appetite bands, RBAC (Admin / RiskManager / RiskOwner / Approver / Viewer), MongoDB persistence, and JWT-based authentication.