Release notes
What's new in RiskEye.
Every production release, in reverse chronological order. Follow Keep a Changelog conventions; the current build is v1.4.2.
- ▸CI import lint —
backend/tools/lint_imports.py walks the AST of every backend .py file, extracts every third-party import, and fails the build if any package is missing from requirements.txt. Handles common name-mismatches (docx → python-docx, jwt → PyJWT, etc.). Wired into .pre-commit-config.yaml so git commit runs it automatically. Prevents the class of bug that broke the v1.4.0 deploy. - ▸
starlette>=0.35.0 pinned explicitly (already installed transitively via fastapi; adding it makes the requirements complete against actual imports).
- ▸Production deploy hotfix — added
weasyprint==70.0, python-docx>=1.1.0, and openpyxl>=3.1.0 to backend/requirements.txt. Fresh Kubernetes rollouts previously failed the health-check with ModuleNotFoundError: No module named 'weasyprint' because reports.py imported them but they were never pinned. Backend + all PDF/DOCX/XLSX report generators verified in 12/12 iter-14 regression.
- ▸Risk Register overhaul — bulk actions (status/category/owner/delete), Kanban view with drag-drop across 5 status columns, saved views persisted in localStorage, CSV import with client-side preview & per-row validation, CSV export of the current filter, 10-column customiser popover, and per-risk overdue-review flag with a "Mark reviewed" action.
- ▸Trend history — per-risk score sparkline on the detail page, derived from the audit trail (
GET /api/risks/{id}/score-history). - ▸Self-service email change —
POST /api/users/me/email with current-password verification, uniqueness check and audit-logged old→new event. - ▸CSV import template —
GET /api/risks/template returns a ready-to-fill CSV with realistic example rows. - ▸Version footer — sidebar bottom-left displays the running app version; backend echoes it on
/api/ and /api/health. - ▸Changelog page — public
/changelog route parses this file and renders the last N releases.
- ▸Dates unified to DD/MM/YYYY across every page via
/lib/dates.js (formatDate, formatDateTime, isoDate). - ▸Sidebar tagline → "a seQure Product". Sidebar brand mark now uses the landing-style gradient dot.
- ▸Support email consolidated to
hello@riskeye.io across Login, Trust, Landing and How-to-use. - ▸Landing product tour now uses real Frameworks + Snapshot-Report screenshots for the Coverage + Reports cards.
- ▸Executive Summary PDF: KPI grid rebuilt as a real HTML table (4 tiles one line, severity-tinted borders, big numbers + micro-labels), with an auto-generated executive commentary block above.
- ▸Public marketing landing page at
/ with animated 5×5 risk-heatmap hero, twin persona strips, 6-card feature grid, dark 3-step "How it works" section, product tour, expandable FAQ, dark final-CTA card and Calendly-powered "Book a demo" links. - ▸Public
/trust page with certifications (SMB1001 Gold Level 3 · Cybercert, CIS Controls v8), encryption posture, access controls, assurance features, component-level 90-day uptime timelines (API / Database / Email) and an incident feed. - ▸Live status pill (
/api/health + /api/status, 30-second polling, 4 states) on Trust and Landing. - ▸How-to-use SOP at
/how-to-use — 11-step guide covering Setup → People → Appetite → Register → Controls → Frameworks → Findings → Acceptances → Reporting → Assurance → Personal. - ▸Dashboard charts — severity donut, category bar chart, radial status chart (recharts 3.6).
- ▸Profile page at
/profile — every user can edit name, job title, avatar (≤1 MB PNG/JPEG/WebP) and change password. - ▸Audit search + filters + drill-down with row-level payload dialog, plus a CSV export of the current filter and a 30-day retention window (
_purge_old_audit() on every read).
- ▸Sidebar accent colour now derived from
tenant.primary_color (RGB-mixed to a deep-navy base). - ▸Login screen redesigned with animated 5×5 risk-heatmap panel + SMB1001 Gold + CIS Controls badges.
- ▸Report Register PDF gained a dedicated cybersecurity-professional cover matching the Executive report style.
- ▸Security audit remediation — WeasyPrint SSRF/XSS input-escape architecture (SEC-002), field allow-list PATCH endpoints (SEC-003), email+IP brute-force lockout with 429 (SEC-004), JWT rotation guard (SEC-001).
- ▸Framework Coverage report heatmap with per-catalogue toggle across NIST CSF, ISO 27001, CIS v8, Essential 8, ISO 42001, NZISM, SCM0020.
- ▸Framework Mapping UI — two-pane control-to-catalogue mapper.
- ▸Super-admin controls — user and tenant suspension with reason and audit trail.
- ▸TOTP 2FA required on every sign-in (pyotp + qrcode); 10 one-time recovery codes issued at enrolment.
- ▸Data-at-rest encryption — Fernet-encrypted TOTP secrets; HMAC-hashed invitation and reset tokens.
- ▸DB renamed
sequre_grc → RiskEye at prod cut-over. Legacy @acme.demo accounts purged on every startup. - ▸Emergent-managed Resend integration for invites, resets and expiry emails (log-fallback if the proxy fails).
- ▸Global font set to San Francisco stack.
- ▸Hash-chained audit trail — SHA-256 chain across every mutation, verifiable via
GET /api/audit/verify. - ▸Snapshot reporting — Executive Summary + Risk Register PDF/DOCX/XLSX exports, byte-identical regeneration via a stored snapshot integrity hash.
- ▸Acceptance workflow — request → approve → auto-expire, with named approvers, justifications and email notifications.
- ▸Cross-tenant Portfolio view for super-admins.
- ▸Initial Governance, Risk & Compliance web platform: multi-tenant, 5×5 risk register, controls, findings, mitigations, risk appetite bands, RBAC (Admin / RiskManager / RiskOwner / Approver / Viewer), MongoDB persistence, and JWT-based authentication.