Changelog

Track all updates and improvements to KvantumCI as we build the future of DevSecOps automation

Latest named release Atlas (v1.5.0) is here. Our biggest release yet. Explore the Atlas release →

Version 1.5.0

Atlas
September 2026

Our biggest release yet. Atlas brings search and observability across your whole organization, alongside a GitHub App for enterprise orgs, Chain Analytics, CI/CD BOM in OmniBOM, the open-source KvantumCI CLI, and a new fuzz testing rule. Explore the full Atlas release →

New features

  • 🧭 Atlas: search & observability
    A search and visibility layer across everything KvantumCI knows about your organization.
    • Search: Find projects, dependencies, pipeline commands, CI/CD tools, findings and recommendation snippets. For example, every project that runs npm install, depends on React, or runs Trivy in CI.
    • Filter: Narrow results by project, provider, tool, severity, status or owner.
    • Observe: See how tool usage, dependencies and exposure spread across the organization.
    • Availability: Included on all plans.
  • 🔌 GitHub App
    Connect a whole GitHub organization with one install. Built for enterprise orgs.
    • Org-wide install: Install once and grant access to all repositories or a selected set.
    • No personal tokens: Scoped app permissions instead of personal access tokens.
  • 💻 KvantumCI CLI (open source)
    The platform from your terminal, scripts and CI.
    • Platform access: Work with projects, repositories, integrations, verifications, BOMs and findings from the command line.
    • CI gate: results summary --fail-on-findings exits non-zero when a verification has failed outcomes.
    • Agent-safe scope: No deletes, credential writes or admin changes.
    • Agent skill: The repository includes an installable skill that shows coding agents how to use the CLI.

Rule engine

  • 🔗 Chain Analytics
    Rules now trace every link in a pipeline chain before reporting a gap.
    • Cross-template and cross-repo: When a control such as container scanning is missing from a pipeline, the rule follows linked workflows and templates, including ones in other repositories.
    • Fewer false failures: A control that runs further down the chain is reported as found, not missing.
    • Real gaps stay visible: If the control isn't found anywhere in the chain, it's still reported.
  • 🧪 Fuzz testing rule
    A new rule that checks whether fuzz testing is part of your pipelines.
    • New rule: Detects fuzzing in CI/CD pipelines and reports when it's missing.

OmniBOM

  • 📦 CI/CD BOM
    A new BOM type that records how software was built, not just what's in it.
    • Pipeline dependencies: Detects the actions, templates, tools and images your pipelines pull in.
    • Provenance: Records the provenance of every build path as supply-chain evidence.
    • Alongside existing BOMs: Sits next to SBOM, CBOM, AIBOM and MLBOM in OmniBOM.

Version 1.4.0

Convergence
July 2026

New rule sets for GitHub Actions and Argo CD, a build determinism check for reproducible pipelines, bulk repository import, and per-repository analytics. Explore the full Convergence release →

New features

  • 📥 Bulk repository import
    Onboard your whole organization in one pass instead of adding repositories one at a time.
    • Import sources: Import from a JSON or CSV file, or connect a named integration.
    • Guided wizard: A UI wizard walks you through selecting and importing many repositories at once.
    • Import filtering: Narrow the candidate list by repository name, branch, language, last activity, owner, and more before you commit.
  • 📈 Repository analytics & scan progress
    See what's happening, repo by repo, run by run.
    • Repository-scoped analytics: Analytics broken down per repository.
    • Scan progression indicator: Track a verification run's progress in real time.
    • UI overhaul and broader UX improvements: Easier day-to-day verification across the platform.

Rule engine

  • ⚙️ GitHub Actions verification & security
    A new rule set for workflow verification scanning and security checks in GitHub Actions pipelines.
    • New rule set: Dedicated coverage for GitHub Actions workflows.
    • Security scanning: Surfaces permissions, secrets usage, and unsafe patterns before production.
  • 🚀 Argo CD rule set
    A new rule set for GitOps verification and Argo CD best-practice checks.
    • New rule set: Validates GitOps configs and Argo CD deployment practices.
    • Delivery pipeline coverage: Strengthens security posture across Kubernetes GitOps estates.
  • 🔒 Build determinism
    A build that resolves different dependency versions on every run can't be trusted or reproduced — and that's a supply-chain risk, not just a quality issue.
    • New rule: Flags non-deterministic install commands (e.g. npm install) in CI configs.
    • Deterministic alternative required: Confirms that reproducible, lockfile-respecting commands (e.g. npm ci) are used instead.
    • Drift detection: Reduces exposure to silent dependency drift between builds of the same pipeline.
    • Stronger provenance: Strengthens the guarantee that what was scanned is what actually shipped.

Fixes

  • 🐛 MLflow rule accuracy
    Cleaner signal from the rule engine.
    • MLflow rule: Fixed a false positive on the MLflow rule.

Version 1.3.0

Overworld
June 2026

Verification expands to AWS and the ML supply chain, with a sharper rule engine and scale for the biggest organizations. Explore the full Overworld release →

New features

  • ☁️ AWS support
    Bring cloud-native AI workloads inside your verification perimeter.
    • AWS agent scanning: Detect and review agents running on AWS.
    • Guardrails detection: Surface guardrails configured for AWS workloads.
    • AWS Bedrock review: Review Bedrock usage across your pipelines.
  • 🧠 Model security & MLSecOps
    Security for the ML supply chain, built for DevOps teams.
    • MLSecOps rules: New rules and MLflow best practices.
    • Model security: Model security brought to DevOps teams.
    • New technology detections: Broader coverage across the ML stack.
  • ✨ UI improvements
    A clearer read on every run.
    • Readability: UI improvements for better readability.
    • Run statuses: New statuses for verification runs.

Rule engine

  • ⚙️ Sharper, faster detection
    New rules and performance work across the detection engine.
    • New rules: MLOps, Nvidia tooling, MLflow, and model scanning.
    • CPU-based optimization: Faster code reviews.
    • Detection fixes: Fixed problems with some SCA and SAST tooling and improved markers in our detection capabilities.
    • GitLab: Better pathname handling and error management.

Fixes

  • 🐛 Scale & performance fixes
    Built for organizations with thousands of repositories.
    • Repo pagination: Fixed pagination so we can load more repos for organizations with thousands of repositories.
    • Dashboard performance: Loading optimization and more precise data.

Version 1.2.0

Identity Core
May 2026

Access & Identity

  • 🛡️ Enterprise SSO & Tenant Authorization
    Frictionless access control and granular permissions tailored for complex organizational structures.
    • OIDC Single Sign-On (SSO): Streamlined, secure enterprise authentication using standard OIDC protocols allowing integration into your company.
    • Tenant-Based Custom Roles: Administrators can now define highly granular, custom roles mapped directly to specific tenants, going far beyond default access policies.
    • Centralized Token Management: Distinct, dedicated management for Global Access Tokens (scoped to the entire tenant) and Personal Access Tokens (allowing users to interact across multiple tenants).
    • Refreshed Login UI: A polished, modernized login experience optimized for SSO workflows.

Rule Engine & Performance

  • ⚡ 20% Scan Speed Increase & Advanced Verification
    Massive performance gains across all workflows and deeper cryptographic validation for your repositories.
    • Multi-Level Caching: A completely rewritten caching layer delivers a measured 20% speed improvement across all rule engine scan workflows.
    • Cryptographic Commit Verification: A new rule that validates Git commit signatures, bucketing them by trust level while smartly bypassing auto-generated commits.
    • Template Repository Support: The engine now fully recognizes and seamlessly handles template repositories during scans.
    • Podman Container Detection: Expanded our container definitions to automatically detect and analyze Podman files, extending our coverage beyond traditional Dockerfiles.

Supply Chain Visibility

  • 📦 Interactive OmniBOM Timelines
    Deeper insights into your supply chain evolution and expanded ecosystem coverage.
    • Interactive BOM Analytics: BOM charts are now fully clickable. Select any day to drill down into the exact SBOMs, CBOMs, AIBOMs, and MLBOMs generated, viewing complete component details.

UX & Workflow

  • ✨ Reusable Policies & Platform Resilience
    Streamlined policy management and improved day-to-day usability for DevSecOps teams.
    • Named Overrides: Eliminate per-project repetition with a dedicated management interface. Create reusable rule configurations to manage significance or accept risks, and assign them across multiple projects instantly via a refined, intuitive UI.
    • Connection Resilience: Real-time UI notifications now instantly alert users if the browser loses connection to the platform, ensuring data integrity during active sessions.
    • Direct Billing Support: Enterprise customers can now initiate direct contact with our support and billing teams through a new integrated module on the Billing page.

Version 1.1.0

Azure Sky
March 2026

Integrations

  • ☁️ Azure DevOps Ecosystem Expansion
    Expanding our native DevSecOps capabilities into the Microsoft ecosystem.
    • Seamless integration and native support for Azure DevOps environments
    • Unified DevSecOps posture management across your Azure workflows

Rule Engine

  • ⚙️ Intelligent Skip Checks & Context-Aware Scanning
    Significantly reduce alert fatigue and false positives with smarter, context-aware rule execution.
    • Dynamic Rule Evaluation: Introduced intelligent skip checks that assess repository context before running
    • Higher Signal, Less Noise: Drastically lowered false positive rates to ensure security teams and developers only see relevant, actionable findings

Access & Identity

  • 🔐 Organization Access Control
    Maintain secure boundaries with streamlined user offboarding from your shared organization workspaces.
    • Easily remove users from an organization to instantly revoke platform access
    • Simplified identity management for shared organizational environments

Supply Chain Visibility

  • 📦 Advanced BOM Analytics & Tracking
    Complete visibility into your software supply chain with our new centralized Bill of Materials hub.
    • BOM Hub: A new, centralized page to manage all your SBOMs, CBOMs, AIBOMs, and MLBOMs
    • Historical Auditing: Granular, detailed history of all BOM modifications and updates over time
    • Visual Evolution: New interactive charting to visually track dependency changes and supply chain evolution at a glance

UX

  • ✨ Visual Comfort & Usability Upgrades
    Continuous improvements to our platform's usability, ensuring a seamless experience across all environments.
    • Tuned dark mode color contrast to reduce eye strain and enhance readability
    • Fixed responsive sidebar width for a more fluid and predictable layout across screens

Version 1.0.0

GA
March 2026

Rule Engine

  • ⚙️ Performance, Scale, and Consistency
    Faster evaluations with caching, expanded coverage, and standardized rule outcomes.
    • Improved execution speed with caching
    • Extended rule set for broader coverage
    • Standardized exit IDs across rules
    • Hundreds of new findings states for richer classification

New Components

  • 🧩 OmniBom and Enrichment Services
    New components that expand BOM generation and enrich every verification run.
    • OmniBom generates SBOM, CBOM, AIBOM, and MLBOM
    • More data to every verification run
    • Customizable parameters for AI BOM generation

Rules

  • 📌 Expanded Coverage and Clarity
    More rule coverage, better labeling, and clearer guidance for teams.
    • New rules for signing, attestations, SBOM, and more
    • Enhanced detection and fine-tuning for GitLab
    • Rule labels for faster triage and organization
    • Updated recommendation text and code snippets for clarity
    • Improved data filtering across findings and runs

UX

  • ✨ Workflow and Usability Upgrades
    Streamlined day-to-day workflows and clearer pipeline insights.
    • Bulk weight editing on rules
    • Better pipeline timelines
    • Historical verification runs data
    • SBOM investigation with deeper details

Dashboards Overhaul

  • 📊 Fully Reworked Dashboards
    End-to-end customization with richer analytics and a new visual system.
    • Editable default dashboards with full customization
    • Widget marketplace and drag-and-drop grid layout
    • Analytics per project
    • New icon set, improved button placement, and refined grids

🚀 Beta Release Information

KvantumCI is currently GA. We're actively developing new features and improving existing ones based on user feedback. Thank you for being part of our early access program and helping us build the best DevSecOps platform! The Bets is closed.

Version 0.5.0-beta

BETA
December 2025

Dashboards

  • 📊 Real-time DevSecOps Security Posture
    Comprehensive dashboards providing instant visibility into your organization's security stance across all projects and repositories.
    • Project pulse scoring with real-time updates
    • Verification run statistics and trends
    • Finding distribution and severity analytics
    • Historical data tracking and visualization

Rule Engine (Beta)

  • ⚙️ 23 Core Rules for DevSecOps Validation
    Powerful rule engine with 23 production-ready rules covering multiple security domains and best practices.
    • SAST (Static Application Security Testing) validation
    • SCA (Software Composition Analysis) checks
    • Infrastructure as Code (IaC) security verification runs
    • Git hygiene and repository security rules
    • CI/CD pipeline security checks
    • Container security validation

Findings & Recommendations

  • 🤖 DevSecOps Framework-Powered Remediation Guidance
    Intelligent recommendations that help teams quickly understand and fix security issues with actionable guidance.
    • Context-aware remediation suggestions
    • Priority-based recommendations aligned with risk levels
    • Code snippet examples and best practices
    • Seamless integration with rule engine results

Findings Explorer

  • 🔍 Advanced Search and Filtering Interface
    Powerful exploration tools that make it easy to navigate, analyze, and act on security findings across your entire organization.
    • Advanced filtering by severity, type, project, and more
    • Full-text search across all findings
    • Export functionality for reporting and analysis
    • Severity-based views and grouping
    • Project-specific and cross-project filtering

COMING SOON Product Roadmap

Exciting features we're working on for upcoming releases

Roadmap

  • ✅ Rule Engine Expansion & Depth
    Move from surface scanning to context-aware, infrastructure-intelligent rules.
    • Infrastructure & GitOps Rules: Terraform detection of deprecated, unmaintained, or malicious modules; dependency risk analysis; ArgoCD best-practice detection; Flux configuration analysis.
    • Artifact & Supply Chain Rules: Nexus IQ artifact attribute validation; artifact tree and dependency chain analysis; JFrog repository hygiene and artifact governance rules.
    • Runtime & Monitoring Intelligence: Runtime security tooling detection; metrics-as-code validation (Grafana as Code); monitoring solution detection and coverage gaps; Falco best-practice enforcement.
    • Automation & Workflow Detection: Atlantis best-practice detection; Terraform automation detection (Atlantis, Spacelift, and more).
  • ✅ AI posture management
    Extend posture management into AI systems, models, and pipelines.
    • AI Posture Management: AI posture management module; guardrails with segmented IAM.
    • AI Tooling & Model Governance: MCP (Model Context Protocol) tooling detection and listing; tool inventory; permission review and risk analysis.
    • MLflow & MLOps Scanning: Semantic versioning enforcement; registry usage validation; model configuration analysis; inference server detection.
    • Cloud Coverage: Azure support.
    • LLM model integrations and AI native: MCP server for connecting your agents. LLM model integrations and AI native features - AI data analitics and AI remedition for workflows pipelines.
  • ✅ Foundations & Compliance Alignment
    Establish trust, standards alignment, and core scanning parity across platforms.
    • Product & Compliance: SOC 2, ISO, OWASP SPVS and DORA rule bindings; map rules directly to compliance controls; enable audit-ready reporting per standard.
    • Artifact Ecosystem: JFrog integration; Nexus IQ integration.
    • Platform Exports: Export findings to Backstage, Grafana, and more for developer visibility.
    • Dashbaords: Updated marketplace and widget system with better data visualization and analytics.
  • ✅ Team Access & IAM Experience
    Give organizations clearer team boundaries, access control, and scoped views into posture data.
    • Teams Access: Team-based access so members see only the repositories, projects, and findings relevant to their group.
    • Improved IAM: Refined roles, permissions, and identity workflows that make it easier to onboard users and manage who can view or act on what.
    • Team Data Views: Dashboards and analytics scoped to a team — aggregate posture, coverage, and remediation progress without cross-team noise.
  • ✅ Workflow & Collaboration Integrations
    Make findings unavoidable, actionable, and developer-friendly.
    • CI/CD Feedback Loops: Automated summaries as comments in CI/CD pipelines; clear pass/fail signals with remediation context.
    • Issue Tracking: Jira integration, GitHub Issues, GitLab Issues; automatic ticket creation; rule-to-ticket traceability.