# Changelog > Customer-facing release notes for Wahukeza, release by release. The engineering changelog with tests and design records ships in the documentation. Source: https://wahukeza.com/changelog Resources ยท Changelog ## What changed, release by release. Customer-facing notes. The engineering changelog (every change with its tests and design-record reference) ships in the documentation with every release. Unreleased 2026-11-07 On the main branch, ahead of the next tagged release. - Availability DoS and DDoS detection from your own routers and hosts A collector reads NetFlow, IPFIX and read-only SNMP counters from your routers and a Linux host agent reads kernel network counters. Learned baselines raise an alarm and an all-clear that closes the same incident, corroborated by the deception fabric. Detection only: it never mitigates and never writes to your network. - Regulatory DORA and NIS2 on the incident Classify an incident against the DORA major-incident criteria and the NIS2 significance test, run the reporting clocks, and render notifications from the incident's own fields. A management-body report in English and Montenegrin, per-tenant report branding and multi-recipient delivery. - Audit Tamper-evident audit log and auditor evidence pack Audit records are hash-chained and each day is closed by a signed anchor. A verifier, an audited export and an audit stream to your SIEM, plus an evidence pack mapped to DORA, ISO/IEC 27001 and NIS2 controls. - Fraud protection Customer-facing fraud protection Seven financial indicator types (IBAN, BIC, card BIN, phone number, SMS sender ID, app package, social handle; full card numbers are refused). Takedown notices sent on the analyst's click with evidence, reminders and a measured time-to-takedown; a page canary that spots your login page being served from someone else's domain; a confirmed per-brand blocklist and a public fraud-alerts page; stealer-log exposure monitoring. - Brand Protection Fake apps, customer scam reports and social watch lists Fake apps in the Apple App Store and Aptoide, a public report-a-scam page for your customers that reads QR codes in the browser, and watch lists for your own Telegram and YouTube presence. Every candidate is confirmed by corroboration or an analyst before it is published. - Exchange Sector sharing groups Vetted sharing groups with per-indicator TLP, distribution and expiry, MISP in both directions, a TAXII inbox, revocation, and a payee-risk lookup for payment fraud under its own API scope. - Exposure Leaked secrets in public code Your identifiers searched in public GitHub code, hits classified against a catalogue of 22 documented secret formats, stored masked and never tested. Your own organisation's GitHub secret-scanning alerts are mirrored too. - Deception Three new decoy targets An SSL-VPN remote-access gateway portal, an MCP server for AI agents whose toolset differs between boxes, and an SAP NetWeaver application server, each in its own small image. - AI Model training and AI evaluation that survive restarts The triage model and AI evaluation runs now live in your tenant's own database. An evaluation runs as a background job that executes at most once and reports its progress. 0.1.0 2026-10-28 - Release First versioned release, signed with our own key Images, the Helm chart and SBOM attestations are signed with the project's cosign key and verify against a published public key; nothing is written to a public transparency log. Each release carries CycloneDX SBOMs, vulnerability scan reports, the API specification and checksums for every file. - Operations Upgrade and restore drills gate every release A release ships only after the previous version has run against the new schema and a backup has been restored. Base images with a critical vulnerability are refused. - Attack Surface Management External attack-surface management Declare your domains, ranges and ASNs and prove ownership. The platform discovers internet-facing assets from certificate transparency, DNS and RDAP, evaluates them against a closed catalogue of exposure rules, and matches software versions to known vulnerabilities ranked by EPSS and by what your own sensors see being probed. Active checks run only against assets you have proven and consented to, from a probe runner with a signed plan and a published opt-out page. - Endpoint Intelligence Your own osquery, patch compliance and endpoint vulnerabilities Write and schedule osquery queries behind a fail-closed read-only validator, track patch compliance against policies, and match installed packages against Red Hat, Microsoft, Debian and Alpine advisories. New internal admin-port fan-out between hosts is flagged as lateral movement. - Mobile Android devices under the same protection An Android agent in the work profile reports to the same Endpoint Intelligence gateway: posture, sideloaded and fake apps, user-installed certificates, and blocking through Private DNS first and an on-device filter second. - Mobile Act from your phone An installable web app with push notifications and a focused decision board for approvals. The highest-consequence decisions require a fresh sign-in. - Endpoint Response Five signed response actions, as a separate channel Isolate host, kill process, quarantine file, disable local account and revert, as signed, host-bound, expiring documents with four-eyes approval, a dry run first, daily and fleet-fraction ceilings and a fleet kill switch. Response never rides the telemetry gateway. - Deception Internal deception: zones, canary tokens and decoy groups Mark sensors as internal so any touch pages as Critical, plant honey credentials and beacon URLs, and group decoys into coherent fake sites with internal DNS so an intruder's pivot between them is visible. - Deception Web-server and Linux personas, exploit watch, novelty nginx, Apache and IIS personas; bounded Linux shell personas; a cited catalogue that names the exploitation campaigns reaching your sensors and backfills history; novelty scoring for request shapes the fleet has never seen. - Analyst experience Security wire Curated advisories from CISA, NCSC UK, SANS ISC and Microsoft MSRC, flagged when they mention a CVE you are exposed to. Context only: news never becomes an indicator. - Analyst experience Clearer navigation, a readable relationship graph, a SOC wall Nine sections organised by what the analyst came to do, a relationship graph that opens as a collapsible tree with a layered view and a full-screen stage, and a full-screen attack map built for the wall. - Brand Protection Fewer false lookalikes Lookalike domains are read for page content, so parked pages and unrelated businesses are proposed benign instead of raised, and copies of the same phishing kit are linked by fingerprint. - Operations Appliance supervision The malware-analysis appliance reports liveness through an outbound agent. A stalled analysis backend is detected and work is deferred instead of silently failing, with optional bounded self-restart. - Cases Incident lifecycle on a case Declare a case an incident with a severity, move it through detected, contained, eradicated, recovered and closed with SLA clocks, attach evidence from the platform's own artefacts, complete a post-incident review, and download a hashed evidence bundle. - Operations Disaster recovery hardened Stated RPO/RTO per topology, encrypted off-site backup copies, per-tenant restore without stopping the platform, a secrets-custody table and a backup-freshness health check. - Sources Certificate pinning for blocklist sources, and SSLBL certificate fingerprints Pin a blocklist source's TLS certificate by SHA-256. A new abuse.ch SSLBL certificate-fingerprint preset joins the catalogue. - Scale Monthly partitioning for sensor events and sightings The two highest-volume tables are range-partitioned by month with a nightly maintenance job; a capacity model and growth alerts ship with them. - Feed Anonymous public feed tier An opt-in, unauthenticated feed of attacker addresses only: 48-hour delay, 1,000-row cap and its own throttle. Off by default and kill-switched. - Documentation Documentation ships with every release A strictly built documentation set, every link resolved, packaged with each release for on-premises and air-gapped mirrors. Full engineering notes ship in the documentation with every release. [Ask for the current set](https://wahukeza.com/contact?intent=docs). Supported version lines and the remediation clock are on the [security page](https://wahukeza.com/security). ## See what shipped, on a live deployment. A demo on a reference deployment, or a pilot sensor in your own network. Pricing follows a short scoping workshop. [Book a demo](https://wahukeza.com/contact?intent=demo) [Research](https://wahukeza.com/research)