What changed, and when.

Entries, newest first

1. 16 October 202616Oct 2026
   LatestSecurityAccountsProbeAPI

   A fresh database, closed by default

   Secure Raven moved to a brand-new database built from its migrations. The rebuild came with a security pass across database privileges, request signing, accounts and the audit log.

   Database

   • Every migration now runs on a brand-new database.
   • Closed by default: the public key cannot run functions or read tables in the public schema, and privileged functions are server-only.
   • The cross-tenant isolation tests now check database privileges too.

   Signing

   • Probe and customer API requests are signed with Ed25519. Secure Raven stores only public keys, and unsigned or shared-secret requests are refused.
   • The Supabase probe, the Web Shield adapter and the network probe sign every request.
   • Revoking an API key is final.

   Accounts

   • Removing an authenticator needs an unused recovery code. Recovery codes are stored as keyed hashes.
   • Links in account emails keep their token out of server logs.
   • Passwords need at least 12 characters. Resetting the password of an account with an authenticator asks for a code from it.

   Audit log and keys

   • The audit log keeps only allowlisted fields, and the hash chain covers every field it stores.
   • IP addresses are kept as keyed hashes, never raw, and only owners and admins can read the audit log.
   • The credential encryption key is never read from the database, and the step-up and signing keys no longer fall back to it or to each other.

   Contact

   • The security, privacy and support addresses moved to secureraven.app, and /.well-known/security.txt publishes the security contact.

   SourcePR #33 · 1338b39

2. 8 September 2026 to 9 September 20269Sep 2026from 8 Sep
   ProbeHonesty

   QA summaries, kept small

   Teams can push a summary of their own QA runs, and the site’s claim check got stricter.

   • Secure Raven accepts qa.* summaries that you push from your own test runs. It keeps the summary and never stores test artifacts.
   • QA sessions are capped at Low severity, and Detector does not promote them to findings.
   • Scope decision, written down: Secure Raven will not become a device lab. The site’s claim check now blocks device-lab wording.

   Source7b7562d · a83b181 · c61eeca

3. 2 September 2026 to 3 September 20263Sep 2026from 2 Sep
   SecurityHonestyDashboard

   Isolation fixes and honest wording

   Tighter tenant checks, MFA recovery codes kept as hashes only, and copy that matches the code.

   • MFA recovery codes are stored only as hashes.
   • Tenant checks on privileged code paths are enforced by lint rules, not by convention.
   • Our SOC 2 wording now matches the facts on the site and in the trust center: Secure Raven is not audited, and its Type I target scope is Security and Confidentiality.
   • Scope decision, written down: Secure Raven checks the applications you ship. It will not become endpoint protection.
   • Dashboard actions now say when they fail, and the site’s buttons lead to real pages.

   Source37ced9f · f2fd73b · e3fc98c · e88106d

4. 31 August 202631Aug 2026
   Accounts

   Authenticator fixes

   Enrolling and replacing an authenticator works the way people expect.

   • Authenticator apps show the entry as Secure Raven.
   • Sign-in checks every enrolled authenticator, so codes keep working after a replacement.
   • A signed-in user can replace a lost authenticator from Security settings.

   Sourceaaf09c4 · f8c733b

5. 27 August 2026 to 28 August 202628Aug 2026from 27 Aug
   ProbeAPIDashboard

   Push-probe mode and Customer API v1

   A way to connect a Supabase project without handing over a database password, and an API of your own.

   • Push-probe mode for Supabase: a small probe in your database pushes signed telemetry, and Secure Raven stores no database credential.
   • Customer API v1: systems, sources, findings and scans over signed requests, each bound to its key’s tenant.
   • After adding a public website, you can verify it, authorize a safe scan and start it.
   • Fixes: the probe installs from the Supabase SQL Editor, and step-up accepts an authenticator you already enrolled.

   Source6f040ec · 52121f9 · b4fce8e · 2db5d7e · 049e48b · 5c05fd2

6. 26 August 202626Aug 2026
   SecurityProbeRavensHonesty

   Step-up, the audit log and an isolated broker

   One day of security work on privileged actions, stored credentials, the probe and the claims we publish.

   Access and audit

   • MFA and a fresh 5-minute step-up are required before storing credentials, authorizing scans, starting Watch or changing Shield.
   • Privileged actions are written to an append-only, hash-chained audit log.

   Credentials

   • Only an isolated connector broker can decrypt a stored credential, and each sealed credential is bound to its tenant and source.
   • Connecting a source needs a versioned consent. Private network addresses are refused, and no credential is stored before consent.
   • Disconnecting a source wipes its credentials, so a queued job cannot scan or decrypt it.

   Probe and ingest

   • The probe runs in its own restricted role with pinned checksums, and it never runs dynamic SELECT queries against your business tables.
   • MFA coverage is counted inside your database, so a safe scan never lists your users.
   • Ingest refuses unsigned or altered telemetry, accepts only allowlisted event types and quarantines restricted payloads.
   • A safe scan is built from each Raven’s declared capabilities, so admin or enforcement steps cannot slip in.

   Checks, Shield and trust

   • Postgres Posture checks the major version, extensions and settings, and a leaked anon key is weighed against weak RLS.
   • Shield apply packs never use scan credentials and are bound to a digest, so a replayed or altered pack is refused.
   • The trust center and the machine-readable trust manifest were published, with every certification field set to false.

   Source80bcaef · ea3a568 · d271b3f · e87e9fb · b3559ca · f519426 · 31d2bbd · 49c379e · d5b204b · 55f988f · ecfcbac · 39d9664 · e23ec3a

7. 25 August 202625Aug 2026
   RavensSecurityHonesty

   HIPAA Hawk, the ordered inspection and Shield

   The Ravens started proving things: cited HIPAA checks and an inspection that runs in order.

   Ravens

   • HIPAA Hawk: a mapped catalog of technical-safeguard checks, and every finding cites its HIPAA Security Rule section. It is a scanning aid, not a certification.
   • A synthetic-identity check on a fixture table the probe installed. It read only that fixture, never your tables, and it was retired on 2026-10-17.
   • The ordered inspection: Connect, Static posture, Leak probe. A stage that fails skips the stages after it, and the run is reported as incomplete, never as a pass.
   • Web Surface reads HTML, JavaScript bundles and exposed env files for leaked keys, including Supabase anon and service_role keys.

   Scans and Watch

   • One planner and one session lifecycle for every scan, with provenance in scan history.
   • Watch runs on its schedule from an authenticated cron, and one failing job no longer stops the others.

   Shield and data

   • Shield: optional enforcement you install. Its status sits next to Watch, and a connected source is never shown as Protected.
   • Anonymous access to tables that look like they hold personal data is flagged, with lockdown SQL you confirm. It revokes writes first and never drops reads on its own.
   • A BAA inventory: record each vendor’s BAA status by name, and HIPAA Hawk flags missing or expired BAAs. No contract uploads.
   • Evidence exports leave out finding details and secrets in connection strings.

   The site

   • The site now describes the inspection Secure Raven runs, and calls HIPAA Hawk a scanning aid.

   Source6e2c485 · 2c6991d · 9b2f9da · 8824508 · ffec2f3 · a59caa9 · af39285 · 409d10e · c34de8f · 9f662e2 · 39c0c83 · 41a5953 · d501dad

8. 7 July 2026 to 8 July 20268Jul 2026from 7 Jul
   SecurityData

   Tenant isolation and data handling

   Envelope encryption for stored credentials, isolation tests, and redaction before anything is stored.

   • Stored credentials are sealed with envelope encryption, with a separate data key for each tenant.
   • Cross-tenant isolation tests (rls-smoke) were added.
   • Findings are written through one path that checks the tenant and the system, so a background job cannot write into another organization.
   • Event ingest redacts what looks like Social Security numbers, card numbers, health-record field names and biometrics before anything is stored.
   • One run lifecycle for every Raven, whether it runs in the worker or in the website cron.

   Sourcea23b8f5 · 9c21a90 · 256227f · 4be4e4f

9. 19 May 202619May 2026
   RavensDashboard

   The Web Ravens

   Secure Raven started checking public websites from the outside.

   • The three Web Ravens: Web Headers, Web Surface and Login Flow.
   • A Raven registry, missions that run several Ravens, and a connection wizard for databases.
   • A probe install page, and health and readiness endpoints.
   • Onboarding and getting-started pages in the dashboard.

   Source1f37bd5 · 1274547

10. 23 February 2026 to 25 February 202625Feb 2026from 23 Feb
    AccountsSecurity

    Sign in with Olyron, and hardened sign-in

    Sign in through Olyron, and stricter rules around every sign-in.

    • Sign in with Olyron, over OpenID Connect with PKCE. The PKCE step runs on the server, with an HttpOnly cookie.
    • Owner and admin roles are checked on sensitive actions.
    • A Content-Security-Policy and security headers.
    • After sign-in, redirects only go to pages on Secure Raven.

    Source5a9f03b · 5808fe9

11. 5 February 2026 to 10 February 202610Feb 2026from 5 Feb
    ProbeRavensDashboard

    First commit

    The first commits, and the shape Secure Raven still has.

    • A control plane, a probe that runs in your database, and a worker.
    • Detector turns high and critical events into findings.
    • The first checks: permissive RLS, SECURITY DEFINER functions, search_path drift and storage exposure.
    • Events are hash-chained as they are ingested.
    • A dashboard for systems, findings, controls and evidence, and a pending-setup screen for accounts with no organization.

    Sourcefc59ec8 · da27baf · 7ac8689 · 876d3d4