Changelog

New — v2 merged review pipeline

• Correctness reviewer: one LLM call returning bugs + security + performance findings via strict per-lens JSON schema. Preserves the deterministic secret regex pre-scan + evidenceQuote hallucination filter + self-justifying-comment discipline from the split agents.
• Style reviewer: one LLM call returning documentation + readability + best-practices findings. Same HIGH BAR noise discipline as the split agents.
• Batched verifier: one LLM call re-reads ALL findings together (was 5-25 separate calls). Bonus quality upgrade — sees cross-lens duplicates and contradictions the old per-finding verifier missed.
• 6-agent UI framing preserved: server buckets the merged output into 6 phantom AgentOutput entries with the original slugs so the review tabs, per-agent progress ticks, .lgtm.yml paths[].skip_agents filter, and CLI output all work with zero changes.
• Feature-flagged via USE_MERGED_PIPELINE env — v1 classic pipeline kept as instant rollback path for 48h bake.
• Real-PR verification: PR #22 (JWT alg=none auth vulns) caught same critical findings in 19s vs 30-90s on v1; PR #23 (SQL injection) caught in 40s. 30/30 fixtures passed with 90% verdict correctness.

New — OpenRouter unified BYOK

• Direct Anthropic provider removed. Claude models now consumed via OpenRouter which unlocks the same Opus 5 / Sonnet 5 / Opus 4.8 catalog plus 400+ more models across Google, xAI, DeepSeek, Meta, Mistral, Qwen through one API key.
• 21 curated model slugs in Settings → AI Provider. Custom-slug input for any of OpenRouter's 400+ models beyond the curated set.
• Server catalog cache: OpenRouter /models fetched on boot + refreshed hourly. validateModel does a synchronous Set lookup (µs) instead of per-model HTTP round-trip.
• cache_control forwarding for Claude models — ~90% prompt-cache discount on the shared context block preserved despite the merged pipeline having fewer downstream calls.
• Legacy Anthropic-BYOK users get a persistent migration banner in Settings with one-click Remove + a link to openrouter.ai/settings/keys.

New — Sprint 2 cached repo knowledge index

• RepoContext extended with cachedFrameworks, cachedConventionFiles, lastIndexedSha. Populated by context.workflow.ts on every push, refreshed atomically in the finalize step.
• context-builder.ts prefers cache with backfill-on-miss fallback — legacy repos populate their cache on the next review (zero-cost path when populated, matches old behavior when not).
• Per-review context assembly latency: 7-10s → ~1s. GitHub API burn per review: 20-40 calls → 3-5.

New — Zero-touch onboarding

• connectRepo endpoint auto-enqueues the context workflow in the background when the GitHub App is installed. No manual click required.
• Repos.tsx handleConnect surfaces the auto-index with a distinct toast: 'first PR review will start working in ~2-5 minutes'.
• OnboardingBanner rewritten as a proper 4-step progress checklist (Install App → Connect Repo → Codebase indexing → Add AI Key) with a real 'waiting' state for the background index. Line-through on completed steps. Auto-hides when everything is done.
• AI Key step now points to the new /dashboard/ai-provider dedicated page (was pointing at stale /dashboard/settings) and shows buttons for BOTH OpenRouter and OpenAI key sign-up.

Improvement — smarter Index Codebase button

• The Index Codebase button on /dashboard/repos is now SHA-diff aware. Three responses: 'already up to date' when the cached SHA matches HEAD (no-op), 'already in progress' when a previous run is going (no concurrent-clobber), or fresh 'indexing started' when there's real work to do.
• The `force` concept was removed entirely — indexing is deterministic on the current commit. If nothing changed, nothing runs.
• Removed the redundant Re-index Codebase card from RepoSettings General tab (Repos-page button now does the smart thing).

Improvement — UI cleanup

• Removed the Review focus areas toggle from RepoSettings. All 6 agents always run — simpler mental model, and the merged v2 pipeline runs 2 calls regardless so per-agent opt-out no longer saved cost. .lgtm.yml disabled_agents YAML kept for backward compat.
• Client Settings AI Provider: new Waypoints icon for OpenRouter, cleaner provider card layout.

Infra — rate limiting

• aiValidateLimiter (20/min per user, fails open) wired to /ai/providers/validate, /validate-saved, /validate-model — bounds worst-case OpenRouter/OpenAI HTTP burn from a compromised session.
• aiKeyWriteLimiter (30/min per user, fails open) wired to POST /providers, DELETE /providers/:provider, PATCH /default — bounds crypto.randomBytes spam.
• Existing contextIndexLimiter (3/min per user, fails closed) already covered the new /repos/:id/reindex endpoint automatically.

Infra — observability

• ai.service.ts callOpenRouter now dumps the full error body (err.error, err.response.body) on any 400+ from the SDK — masked 'Provider returned error' generic message is over.
• Fixture eval SYNONYMS table expanded from 3 to 30+ entries. Real precision/recall numbers instead of category-mismatch false negatives.

New — Posture Score

• Posture Score 0-100 per repo — deduction-based formula, letter grade, colored gauge (green/amber/red band), 30-day trend sparkline, week-over-week delta.
• Fleet posture strip on /dashboard/security — average score across every enrolled monitor + top-3 worst repos + link to Security Analytics.
• Per-repo posture badge on the enrolled-repos list — inline score + progress bar, color-tinted by band.
• Public README badge — shields.io-style SVG at /security/badge/:repoId.svg. No-auth, 5-minute cache, embeds anywhere Markdown renders.
• SecurityPosture Mongo model with a 400-day TTL; scanner upserts today's snapshot after every scan. Backfill script reconstructs historical daily posture from the existing audit log.

New — Security Analytics dashboard

• NEW /dashboard/security/analytics page: 30/90/365-day window toggle, fleet posture area chart, top 10 firing rules (horizontal bar), MTTR by severity (vertical bar), opened-vs-resolved dual line, CI-system donut, false-positive leaderboard (rules with the highest FP rate — candidates for tuning or muting).
• Server aggregates all six charts in a single /security/posture/analytics call so the page renders in one round-trip.

New — Sidebar restructure

• Three semantic groups: AI Review (Pull Requests, Reviews, My PRs, Review Analytics), LGTM Security (Security, Security Analytics, SBOM Search, Custom Detectors, API Tokens, Organizations), Account (Settings, Plans & Billing).
• Read Docs + Repos + AI Provider at the top, ungrouped — cross-product actions users touch every session.
• Notification bell moved next to the LGTM logo in the sidebar header (desktop) and mirrored in the mobile top bar. Dropdown portalled to document.body so it can never be clipped by the sidebar's overflow context.
• Collapse toggle removed — Pattern A (always expanded on desktop, drawer on mobile). Matches Vercel / Linear / GitHub / Notion.

New — Custom Detectors: per-repo scoping

• New appliesToRepos field on CustomDetector — empty = every repo in owner scope (existing behavior), non-empty = only those specific repos.
• Editor UI: new Applies-to section with All / Specific chips + repo picker (respects org isolation).
• List row: scope badge (All my repos / All org repos / N repos) so users know the reach at a glance.

New — AI Provider page

• AI provider keys moved from Settings into a dedicated /dashboard/ai-provider page — sidebar link near the top.
• Settings page now focuses on plan / email / notification / privacy consents. AI providers get their own home so they're easier to find + link to from onboarding.

Fix — Scanner file discovery

• Scanner now walks the full git tree once via GitHub's Trees API + GraphQL blob batch fetch instead of trying a fixed list of paths. SBOM finds lockfiles anywhere in monorepos (client/package-lock.json, server/package-lock.json, docs/, lgtm-cli/, lgtm-action/, marketing/ — all of them). CDA globs like `**/*.ts` actually match the whole tree now.
• Two-tier size cap: 150KB for source files, 5MB for lockfiles (a mature package-lock.json can be several MB). REST-raw fallback for lockfiles GraphQL null-texts (>512KB).
• Redis blob-SHA cache (7-day TTL) — re-scans on the same commit skip GitHub entirely.
• Rate-limit awareness: stops batch fetch below 200 remaining GitHub API hits.
• Split built-in scanning from CDA-discovered file set — built-in detectors no longer accidentally fire secrets.hardcoded on test fixtures the CDA path fetched.
• docsUrl on SecurityAuditLog: custom detectors' Learn-more URL propagates from detector definition into findings + shows as a Learn more link on the audit card. Backfill runs on next scan to populate existing rows.
• lastSeenAt on audit rows: scanner bumps it on every reconfirming scan; audit log groups by lastSeenAt so today's rescan puts findings under Today, not stuck under first-detected.

New — Chart primitives (Recharts v3)

• Themed wrappers under client/src/components/charts: LineChart, AreaChart, BarChart, DonutChart, SparkLine, Gauge — all reuse existing --primary / --chart-* CSS tokens so palette stays coherent.
• Bundle 150KB, tree-shakes, animates via Recharts' built-in springs.

Fix — UX polish

• Select dropdown portalled to document.body via createPortal + position:fixed. Fixes a class of bug where filter dropdowns in card containers with overflow-hidden would silently clip. Applies to every Select instance across 6 pages.
• SBOM cross-repo search page no longer crashes on undefined matchedComponent — server v163 populates it from cyclonedx.components + client normalizes defensively.
• Every array-returning client API method (sbom, customDetectors, orgs) guarded with Array.isArray so unexpected server shapes never bubble into '.map is not a function' crashes.
• Audit log renders a 7-day skeleton (Today → 6 days ago) even when a day is empty, with a friendly hint inside; Older catch-all appended for anything past 7 days.
• Repo cards on /dashboard/security show a pulsing 'Scanning…' / 'Scan queued' badge when a scan is in flight — reads from a new activeScan field on the monitor and auto-clears on socket scan-complete.
• Pages spread edge-to-edge inside the layout padding (stripped max-w-4xl/3xl/2xl/xl on all page containers).
• Notification bell relocated next to the LGTM logo in the sidebar (was pinned bottom); dropdown portalled to escape sidebar's stacking context.
• Bulk defensive normalization on server responses at the client boundary — no more '.slice is not a function' style crashes when the server returns a partial object.

Engineering decisions

• Deduction-based posture formula (not category-weighted): users can trace why the number moved. `100 - Σ(count × weight)`. Legible beats sophisticated for a metric users see every day.
• Score band thresholds (85 / 60) live in exactly two places — client theme.ts scoreColor + server badge endpoint. Kept in sync manually; a diverging pair would be caught by a snapshot test if we add one.
• Backfill reconstructs historical posture by rolling the audit log forward day-by-day — meaningful trends from day one instead of a single dot.
• Same Settings component serves /dashboard/settings AND /dashboard/ai-provider with a useLocation guard — 400 lines of provider state don't get duplicated across two pages.

New — SBOM

• CycloneDX 1.5 JSON generated on every scan, upserted per (repoId, headSha), 90-day TTL to bound storage.
• 9 ecosystem parsers with dedup on (ecosystem, name, version): npm (package-lock v1/v2/v3), yarn.lock, pnpm-lock.yaml, Pipfile.lock, poetry.lock, requirements.txt, Gemfile.lock, go.sum, Cargo.lock. purl (Package URL) computed per component.
• GET /security/repos/:repoId/sbom — latest or ?sha=X. GET /security/repos/:repoId/sbom/download — CycloneDX JSON attachment. GET /security/sbom/search?package=X — cross-repo lookup scoped to enroller-owned monitors.
• 20 vitest tests: parser fixtures for all 9 ecosystems, CycloneDX spec-compliance, dedup semantics, malformed-lockfile bails without throwing.
• SBOM generation failure never fails the scan — try/catch swallows + Sentry-reports.

New — Docs restructure

• NEW /docs#sec-recipes tab under LGTM Security — 20+ copy-paste YAML recipes organized by category (Supply chain, Workflow hygiene, Provenance & signing, Secrets).
• NEW /docs#sec-provenance tab — SBOM explainer, CycloneDX field reference, list of supported ecosystems, download + cross-repo search workflow, US EO 14028 / EU CRA compliance angle, Compliance Copilot teaser.
• Custom detectors docs section (/docs#sec-custom-detectors) trimmed — 15 recipes moved to the new Recipes tab; DSL reference, pattern types, playground, gotchas, marketplace all stay put with a short pointer to the Recipes tab.
• 5 new sigstore recipes: docker push audit, npm publish provenance audit, release upload audit, docker pull verify audit, SBOM upload step audit — all single-detector single-match style with human-review copy in the message.

New — Dashboard UI

• SBOM panel on per-repo security page — shows short SHA + component count + timeAgo + ecosystem breakdown + Download primary button + 'Search across all repos' link.
• NEW cross-repo SBOM search page at /dashboard/security/sbom-search — package name input + ecosystem filter + results table (repo · matched component · scanned time · View SBOM link).
• SBOM search entry in LgtmSecurity header actions (SearchCode icon), next to Custom Detectors and Tokens.

Engineering decisions

• Sigstore built-in detector DEFERRED — same reasoning as skipped Group 4 (CVE feed): can be expressed as an 8-line CDA recipe with acceptable false-positive rate. Users who care copy-paste from the Recipes tab. Revisit if 3+ enterprise buyers explicitly ask.
• Cross-repo SBOM search intentionally filters on enroller-owned monitors instead of canUserAccessRepo per row — a live GitHub API call per SBOM row would fan out on every keystroke. Per-repo endpoints retain the full canUserAccessRepo gate.
• poetry.lock + Cargo.lock parsed via conservative regex-TOML (no full TOML parser dep added — @iarna/toml would balloon install size for two files).

New — DSL

• Five pattern shapes: contains (safe substring), regex (JS regex with gm flags auto-applied), allOf (file-level AND; optional sameLine: true forces line-level AND), anyOf (file-level OR), noneOf (fires when NO leaf matches — for 'this file MUST contain X' asserts like 'every workflow declares permissions:').
• sameLine modifier on allOf — separates 'file uses both A and B' from 'this exact line uses A and B together'.
• ReDoS protection: every regex leaf runs through safe-regex before save; nested quantifiers like (a+)+ and unbounded backtracking are rejected with a hint pointing at the docs.
• Hard caps enforced at Zod-validation time: 10 file globs · 500-char pattern strings · 5 leaves per combinator · 1000-char messages · 20 detectors per user · 100 per org · 100 matches per file at scan time · 200-char snippets in the audit log.

New — Marketplace + sharing

• sharedTo: [orgId] lists — cap 200 targets per detector; sharing does NOT copy, it makes the detector discoverable on the target org's Marketplace tab.
• Import creates a COPY in the target scope with sourceDetectorId pointing at the original for provenance. Source can be deleted without breaking consumers.
• importCount bumped on every import — surfaced in marketplace listings as 'used by N teams' social proof for ranking + trust.

New — Docs

• New docs tab at /docs#sec-custom-detectors under the LGTM Security group — overview, DSL reference, all five pattern types with examples, file-glob semantics, playground guide, 15 ready-to-copy recipes (deprecated internal libs, unpinned actions, hardcoded buckets, pwnrequest strict, missing permissions block, npm mirrors, Node/Python EOL bases, banned Terraform providers, banned Docker bases, missing SBOM step, fenced secrets, curl|sh, sudo in Dockerfile, old Terraform version), gotchas (ReDoS · sameLine vs file-level AND · noneOf-fires-on-absence · snippet + match caps · case sensitivity), marketplace flow, promotion channel to built-in.
• New glossary entry: /glossary/custom-detector — definition, personal vs org scope, DSL summary, marketplace flow, 4 FAQs.

New — Playground

• Every detector form has a Test panel — paste sample filename + content, hit Test, see matches with 1-indexed line numbers and which leaf produced each match. Rate-limited to 10 tests/min per user.

Contract

• Custom-detector findings post as inline PR comments, contribute to the merge-block Check Run, and land in the immutable audit log — identical to built-in behavior.
• Org-scoped detectors with enforced: true render the standard 'Enforced by <org>' chip on the per-repo policy editor. Override attempts return HTTP 409, matching Group 5 Item 2 semantics.
• Personal-scope detectors ignore the enforced flag; validator rejects the combination at authoring time.

Improved

• New transactional category `org-invite` + template `orgInviteEmail.ts` on the outbox.
• Invite form auto-looks-up the invitee's LGTM account email; falls back to an optional email field for new invitees.
• Invite response payload now carries `emailSent: boolean` + `emailAddress: string | null` so the UI shows "Emailed to alice@example.com" or a copy-link fallback banner.
• Server v153-v154 shipped.

New

• Enforced-rule locking — Policy Admins mark org rules Enforced with the lock icon; per-repo editor shows a locked chip and rejects override attempts server-side (409).
• Inheritance chips on per-repo Policy — "Enforced by <org>", "Inherited from <org>", "Override (default: X)" — plus a bulk banner with a Reset-all-overrides button.
• Model B repo access gating — attached-org repos are gated on canUserAccessRepo(user, repo) with a 10-minute Redis cache, fail-closed on GitHub error. Enroller auto-passes. Uses the user's existing OAuth token — no new scopes.
• Per-user Security notification prefs live at Settings → Security notifications, respected across every monitor you can see.

Improved

• Attach/detach loosening — no longer requires the caller to be the original enroller; Policy Admin+ AND repo access is sufficient.
• Attach bugfix — attach used `findById(repoId)` (wrong: that's a monitor id). Now `findOne({ repoId })`.
• Populate bugfix — org member list rendered "@(pending)" for active Owners because Mongoose populate selected `githubUsername` but the User field is `username`. Fixed.
• GitHub App admin verification uses the installation-token pattern (`GET /orgs/{org}/memberships/{user}`) instead of the caller's OAuth token — prevents org-squatting.

Deprecated

• Per-monitor `updateNotify` endpoint retained for API back-compat but deprecated. Migrate to per-user preferences in Settings.

New — Organizations

• Create an organization from Dashboard → Security → Organizations. Owner is the sole creator initially.
• 4 roles: Owner (full control), Policy Admin (edit policy + invite), Member (view), Viewer (view). Last-Owner protection blocks demoting or removing the sole Owner on every mutation endpoint.
• Invite teammates with 14-day tokens; invitee lands on the Accept-invite page and status flips pending → active.
• Shared OrganizationPolicy: same rule + allowlist shape as per-repo policy. Attach any of your SecurityMonitors to an org via the API or the org detail page.

New — GitHub org sync

• Owner-only toggle on the org detail page. Progressive re-auth: LGTM requests `read:org` at toggle time, not at App install time — keeps the initial install low-friction.
• Once enabled, `organization` webhooks provision GitHub admins as policy_admin and members as member. Manual > Sync — manually-invited members are never overwritten by sync; sync only flips a `githubOrgMember: true` flag on them.
• GitHub App admin verification uses the installation-token pattern (`GET /orgs/{org}/memberships/{user}`) to prevent org squatting.

Contract (design invariants)

• Merge semantics: repo-wins-except-enforced. `mergeWithOrgPolicy(repoPolicy, orgPolicy)` returns the repo's action UNLESS the org marked the rule enforced. Allowlists always union. policyVersion takes the max.
• Deleting an org unsets `SecurityMonitor.orgId` on all attached monitors (they revert to standalone), deletes the OrganizationPolicy, and deletes members. No monitor gap.
• Standalone monitors (orgId == null) are a strict no-op path — non-org users see literally-identical behavior to pre-org.

New — GitLab CI

• gitlab.shell-injection (critical/block) — untrusted GitLab predefined var ($CI_COMMIT_MESSAGE, $CI_MERGE_REQUEST_TITLE, etc.) reaches script/before_script/after_script.
• gitlab.privileged-container (high/warn) — docker:dind service or privileged: true.
• gitlab.unpinned-include (medium/warn; high for remote URLs) — project include without SHA ref, or remote include.
• gitlab.cache-key-poisoning (high/warn) — cache.key interpolates untrusted var.
• gitlab.self-hosted-runner-on-public-repo (high/block) — custom runner tags on public repo.

New — CircleCI

• circleci.shell-injection (critical/block) — << pipeline.git.branch/tag/parameters.* >> in run steps.
• circleci.privileged-container (high/warn) — machine executor on public repo.
• circleci.unpinned-orb (medium/warn) — orb pinned to @volatile / @x / @x.y (only @x.y.z is strict).
• circleci.cache-key-poisoning (high/warn) — restore_cache / save_cache key uses untrusted pipeline value.
• circleci.self-hosted-runner-on-public-repo (high/block) — namespaced resource_class (namespace/name) on public repo.

New — Azure Pipelines

• azure.shell-injection (critical/block) — $(System.PullRequest.SourceBranch) or ${{ parameters.* }} in script / bash / pwsh / powershell.
• azure.privileged-container (high/warn) — container options include --privileged.
• azure.unpinned-repo-resource (medium/warn) — resources.repositories[].ref is not a SHA.
• azure.self-hosted-pool-on-public-repo (high/block) — pool: name: (not vmImage:) on public repo.
• azure.plaintext-secret-variable (high/block) — variables: block has SECRET/TOKEN/KEY/PASSWORD-shaped name with plaintext value (skips $() macros, ${{ }} templates, isSecret:true).

Detector count

• 21 → 36 across 4 CI systems

Improved

• Repos list now shows a per-card SecurityBadge (Security · N open / Security · clean / Security paused / Security off) fed by a single listEnrolled() call on mount. No more opening the Security dashboard to see posture.
• PR inline review comments from ci-security detectors now include a "Mute rule" deep-link that jumps straight to the Policy editor with the offending rule pre-scrolled and highlighted (`#rule-<ruleId>` anchor).
• Successful enrollment now redirects to the new monitor's detail page with a Configure-policy CTA banner (dismissable, param-clean) — no more dropping back on the enrollment list wondering "what next?".
• LgtmSecurity docs now have real appUrl() deep-links (Security dashboard, Repos, Tokens, Policy) instead of prose "Dashboard → Security → Tokens". Fixed 2 stale lgtm-audit → lgtm-feedback issue-tracker links.
• Every finding row on the Security dashboard has a "Mute rule" shortcut — same anchor as the PR inline mute link.
• Cross-link between per-repo General settings and Security Policy in both directions (SecurityCallout on GeneralTab; "Repo settings" button on the Security dashboard + Policy pages).
• Default allowlist ships with `actions/*` and `github/*` — GitHub's own first-party action orgs no longer fire `workflow.unpinned-third-party-action` warnings out of the box. Existing enrollments backfilled (10 monitors touched). Customers wanting maximum-strict posture can remove the globs via the Policy tab.

New detectors

• workflow.cache-key-poisoning (high/warn) — actions/cache uses whose key: or restore-keys: interpolate untrusted GitHub event fields (pull_request.title/body/head.ref, issue.title, comment.body). Adnan Khan 2024 research; attacker crafts a PR that writes into a predictable cache key, then a legitimate run restores their poisoned cache into node_modules / .venv.
• workflow.forking-toctou (high/warn) — pull_request_target with always() or !cancelled() in job or step if-conditions. Trusted-context step still runs when validation fails — fork PR slips past. Legit Security 2023 research.
• workflow.oidc-overpermissive (medium/warn; escalates to high/critical) — two-part: workflow-side fires on `permissions: id-token: write` (medium; high if using aws-actions/configure-aws-credentials / google-github-actions/auth / azure/login / hashicorp/vault-action without an explicit role-to-assume). Cross-file: any committed trust-policy JSON with a wildcard sub claim fires critical. Handles AWS (`token.actions.githubusercontent.com:sub`), Azure (`subject`), Vault (`bound_subject`), GCP (`attribute.repository`).

Also

• Monitor-side now fetches trust-policy files (trust-policy.json / aws-trust-policy.json / oidc-trust-policy.json / iam-trust-policy.json / .github/trust-policy.json) on scheduled scans.

New detectors

• deps.lifecycle-script (high/warn; escalates to critical on exec+network patterns) — fires on any preinstall / install / postinstall / prepare / preprepare / postprepare / prepublish / prepublishOnly / postpublish script in package.json. Escalates on curl|sh, wget|bash, base64-decoded exec, PowerShell IEX+WebClient, nc -e, inline python -c / node -e with fetch, eval(atob(...)), raw IP references. Safe-prefix allowlist (husky / node-gyp / prebuild-install / patch-package / tsc / next / etc) keeps noise down.
• deps.dependency-confusion (high/warn; critical on internal-name-leak) — two attack classes. Typosquat: Levenshtein-distance-1 from a curated top-~150 popular-packages list (expresss, lodashe, reactdom, discord.js.js). Dependency confusion (Alex Birsan 2021): unscoped name matches a documented internal-name-leak dictionary (amzn, microsoft-internal, azure-sdk-internal, myorg-utils, corp-shared).

Fixed

• PR-side ci-security agent now honours per-repo policy overrides. When you mute a rule via /security/repos/:repoId/policy (action: "off"), the PR-review agent stops flagging it AND stops posting a failing GitHub Check Run for that rule. Previously the monitor-side dashboard respected the mute but the PR gate kept blocking merges ("why does the merge keep failing on a rule I turned off?")
• Allowlist unification — the PR-side agent now uses the same allowlist you configured for monitor-side scanning. Adding `actions/*` to your allowlist stops both monitor-side AND PR-side unpinned-action warnings, not just monitor-side
• PR-side audit-log dedup — re-reviewing a PR on the same head SHA no longer accumulates duplicate audit rows per finding. Bundle-batched with the audit-log query so the dedup adds ~one extra query per persist call, not per finding

Internal

• AgentInput gains an optional ciSecurityPolicy field carrying the SecurityMonitor.policy snapshot. Unenrolled repos leave it undefined; the ci-security agent falls back to the built-in seed policy — same behavior as pre-fix, no regression path
• persistCiFindingsToAuditLog got a two-layer defense: policy action:"off" suppression AND (ruleId, file, line, headSha) dedup against existing unresolved pr-review rows. Headshas are part of the fingerprint on the PR side (unlike monitor-side) because a bug at the same line on a new commit is legitimately a new context

Fixed

• Review-job crash handler no longer strands re-reviewed PRs in "pending" limbo. When processReviewJob or notifyReviewJobFailure crash, the handler now looks up whether the PR has any prior Review with an overallVerdict — if yes, status restores to "reviewed" (with the failed Review row + retry badge preserved); if no, status resets to "pending" as before. Fixes the 39-PR dashboard-vanishing incident caught during the 2026-07-28 Securacy demo prep
• Off-rule audit-log filter: rules set to `action: "off"` via the policy API no longer write findings to the audit log. Previously the rule engine still ran and the writer downgraded findings to `"warn"` — user complaint was "I muted the rule but still see findings on the dashboard". Now filters ruleFindings BEFORE building fingerprintNew + auditDocs, so muted-rule historical findings auto-resolve via the stale-check pass
• Audit-log dedup across rescans: every SecurityAuditLog rescan was re-inserting a row per finding even for fingerprints already unresolved. On the hourly cron this meant a single un-fixed finding accumulated 24 duplicate rows per day; concurrent scans on the same SHA measured 2.0× redundancy. Now filters activeFindings to genuinely-new fingerprints before insertMany; counts + halt decision aggregate from all findings so rescans of still-dirty commits don't accidentally soft-pass
• deps.lockfile-hash-mismatch detector was dead code — neither call site populated RuleFile.previousContent. Wired base-branch content fetch on PR side + previous-scan SHA fetch on monitor side; added package.json to CI_FILE_PATTERNS so the paired-manifest lookup works. Rule now fires as designed on lockfile-only edits with unchanged package.json

Improved

• Synthesizer verdict-escalation cap: the LLM synth pass can now nudge the heuristic verdict one tier in either direction but NOT jump from "approve" straight to "request_changes". Prior behavior was over-triggering on PRs with only nice-to-have findings (~1 medium + 2 low would still land as request_changes at 78% confidence). Now those correctly land as approve with the nits listed as suggestions
• Security agent self-justifying-comment discipline: explicit prompt handling for five patterns that let planted-bug stress-test findings slip past — MD5 for security-sensitive fingerprinting, JWT alg:none, TOCTOU stat-then-read races, ReDoS via nested quantifiers, prototype pollution via Object.assign of user-controlled input. Any nearby code comment claiming these are "fine because…" is now treated as a claim to verify, not authoritative context that suppresses the finding
• Path-scoped convention enforcement: strengthened the existing `Project Conventions authoritative` rule with explicit path-scope carve-out language. When CLAUDE.md / AGENTS.md / .cursorrules etc carve a directory or file pattern out of a rule (e.g. "any is allowed in scripts/**"), findings inside that scope are dropped entirely — not offered as nits either. A carved-out pattern is a decision, not a nit

Removed

• /dashboard/repo-health page + sidebar nav slot
• The 4 signal cards (coupling / churn / debt / confidence), composite health gauge, commit timeline, and full-page commit-diff viewer — all deleted
• Backend healthScore.service.ts + RepoHealthSnapshot model + /health API routes + associated tests
• computeAndSaveHealthScore call inside the context-workflow — the workflow no longer writes health snapshots on every push
• /dashboard/models 'Compare Models' page + sidebar nav slot — the same info now lives on docs.looksgoodtomeow.in under AI Providers, and the Settings-page 'Compare model pricing' link routes there instead

Fixed

• .lgtm.yml parse-error banner used to stick around forever — the DB field was $set to undefined which Mongoose strips, so successful runs never cleared prior errors. Now uses $unset properly + also clears on any manual toggle
• auto_approve_docs_only and skip_lockfile_changes short-circuits used to skip creating a Review document — the dashboard /pr/:id page stuck on 'agents queued' and no completion notification fired. Now creates a proper Review doc, emits sockets, and writes the notification just like a normal review
• Repos.tsx cleanup regressed the page with a `ReferenceError: user is not defined` runtime crash on the whole /dashboard/repos surface — the useAuth destructure was over-eagerly removed. Restored + verified in the browser
• resolveProvider errors (missing API key for a per-repo model override) used to silently drop the review — no PR record, no notification, invisible failure. Now creates a Failed Review with a human-readable 'no API key for provider X — add one in Settings, then Retry' reason + fires a review_failed notification
• commit-yml endpoint used to return raw 403s when the GitHub App was missing 'contents: write' scope. Now returns a structured `APP_MISSING_CONTENTS_WRITE` code and the RepoSettings UI renders an actionable 'Re-install to grant write access' toast — plus notes that hand-editing .lgtm.yml still works

Polished

• .lgtm.yml editor now has proper YAML syntax highlighting (comments, keys, strings, numbers, punctuation) via a Prism + react-simple-code-editor overlay
• Repos page cleaned up — all per-repo settings (auto-review, focus areas, PR chat, model override) now live only in the new /dashboard/repos/:id/settings page. Repos card now shows just indexing + context detail + action buttons
• 290 lines of dead JSX + 5 orphaned handlers + 9 unused icon imports removed from Repos.tsx

.lgtm.yml — first-class repo config

• New YAML file at repo root (or .github/lgtm.yml). Opt-in per repo. Rules enforced at the pipeline layer — the LLM can't 'forget' them. Full spec: /docs#lgtm-yml
• Rules shipped: disabled_agents, max_inline_comments, paths[].skip, paths[].skip_agents, paths[].max_severity, suppress_categories, severity_overrides, frameworks (override auto-detect), auto_approve_docs_only, skip_lockfile_changes
• Zod schema validation. Invalid YAML falls back to defaults + posts a one-line warning on the PR — never fails the review
• Dashboard editor commits the file for you via the GitHub App. Pick any branch (auto-created from default if it doesn't exist), pick either .lgtm.yml or .github/lgtm.yml, click Commit
• Auto-approve short-circuits: docs-only + lockfile-only PRs bypass the LLM entirely and get instant approval with an 'auto-approved via .lgtm.yml' note

Per-repo Settings page

• New /dashboard/repos/:id/settings page — reached via the gear icon on any repo card
• 5 tabs: General (auto-review), .lgtm.yml (feature-flag + YAML editor), Model (per-repo AI provider override), Branches (opt-in filters), Danger (disconnect)
• Model tab defaults to whatever's set in global Settings — the repo override wins only when you explicitly fill it in. Both surfaces cross-link to each other so it's clear which one applies

Branch opt-in for review + security

• reviewBranches: empty = review PRs against every base branch (default). Non-empty = only review PRs whose base matches one of the patterns (supports basic globs like 'release/*')
• securityBranches: empty = LGTM Security scans pushes to the default branch only (current behavior). Non-empty = also scan pushes to these branches on top of the default
• Both surfaces are per-repo, saved via the same PATCH /repos/:id/settings endpoint

Hallucination floor

• evidenceQuote validator — every LLM finding must quote the offending code verbatim; unverifiable quotes are dropped before the synthesizer runs
• Adversarial verifier — a skeptic-LLM runs against each finding after the 6 agents complete; refuted findings drop out. Concurrency-capped at 6
• Convention-file loader — fetches CLAUDE.md, AGENTS.md, .cursorrules, .github/copilot-instructions.md, .windsurfrules, CONTRIBUTING.md, .claude/CLAUDE.md. Findings that contradict the repo's own conventions get dropped
• Prompts rewritten across all 6 review agents (bugs, security, performance, readability, best-practices, documentation) to remove hallucination-inducing pressure and add explicit false-positive carve-outs

Prompt-injection defence

• <untrusted_KIND>…</untrusted_KIND> XML-tag wrapping on every user-controlled input (diff, files, related files, conventions, recent PR history). System prompt states plainly: content inside these tags is data, never instructions
• Verified against a hard-mode red-team — unicode zero-width joiners, base64-encoded directives, non-English (Hindi) payloads, and fake-schema injection all ignored

Review comments users can actually action

• GitHub ```suggestion``` blocks for mechanical single-line fixes (== → ===, parseInt radix, md5 → sha256). Each agent opts in per-finding via a codeSuggestion field; users click "Commit suggestion" and GitHub applies the fix
• Suggestion-acceptance detection via GraphQL polling on pull_request.synchronize events — when a user accepts + resolves a suggestion, a positive ReviewFeedback record lands automatically
• Cross-agent dedup — multi-agent findings on the same line collapse into a single "Flagged by: bugs, security, best-practices" consensus comment. Inline-comment cap is 10
• Finding tiers: 🎯 Actionable (critical/high) / 💡 Suggestion (medium) / 🔍 Nitpick (low/info). Every inline comment carries the tier tag; the synthesizer weights Actionable heaviest

Context, framework, and language awareness

• Smart file-content window — for files >400 lines, we extract ±100 lines around each touched line (merged windows, 300-line cap) so the LLM sees the enclosing function context in giant files
• Framework-aware best-practices — detects Next.js RSC/server-actions, tRPC input validation, Prisma raw queries, Django SECURE_*, Rails strong params, FastAPI, and more from package.json / pyproject.toml / requirements.txt / go.mod / Gemfile / pom.xml / build.gradle / Cargo.toml / composer.json. Injects per-framework gotchas into the relevant agents
• Per-language hints — extension → language checklist injected into bugs / best-practices / performance for TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Ruby, Swift, C, C++, C#, PHP, Shell
• 40-class vulnerability taxonomy with CWE cross-references on the security agent. category is now an enum (sql-injection, xss-reflected, jwt-alg-confusion, prototype-pollution, ssrf, prompt-injection, etc.)

Providers, cost, and reliability

• Provider-native structured output — Anthropic output_config.format json_schema, OpenAI Chat response_format json_schema strict, OpenAI Responses text.format. No more JSON-mode fallback logic
• Per-agent model routing — documentation + readability agents auto-route to the same-provider mini/flash tier (gpt-5.4-pro → gpt-5.4-mini, Claude Opus → Claude Haiku). ~3.3× cheaper on those two agents. Bugs/security/performance/best-practices/synthesizer/verifier stay on the strong tier
• Anthropic prompt caching — cache_control: ephemeral on the shared per-review context (diff + files + conventions + repo map). All 6 agents + verifier hit the cache after the first call
• Gemini and Mistral removed as supported providers. OpenAI + Anthropic are the two live BYOK options

Feedback loop + eval harness

• ReviewFeedback collection — reply-text sentiment (keyword-classified positive / negative / neutral) + suggestion-acceptance events. Admin analytics tile at /admin/analytics/feedback
• Golden-set eval harness — npm run eval:full runs the pipeline against fixture PRs and reports precision / recall / noise / verdict-mismatch with GREEN / YELLOW / RED grading. 30 fixtures ship at v0.13.0 covering clean PRs, straightforward bugs, framework-specific gotchas (Next.js / Django / Prisma / Express / React), prompt-injection payloads, convention-file carve-outs, and mechanical suggestion PRs

Side items shipped the same day

• Dashboard: failed reviews stay on the Pending tab with a "Last review attempt failed — retry" badge so nothing gets silently lost
• Security headers: X-Frame-Options: DENY + Content-Security-Policy: frame-ancestors 'none' on both looksgoodtomeow.in and app.looksgoodtomeow.in — clickjacking disclosure fixed same day
• /.well-known/security.txt published (RFC 9116) so researchers know where to reach us

• CSRF guard on DELETE /auth/account — requires an X-Confirm-Delete: yes custom header, which browsers can't send cross-origin without triggering a CORS preflight (our allowlist rejects non-LGTM origins). Defence-in-depth on top of Bearer auth
• Rate limits added: consent writes 20/min/user, account deletion 3/hour/user — bounds the blast radius of a stolen JWT
• Dodo subscription auto-cancel on account deletion. Previously deleting your account left an active subscription on Dodo's side — you'd keep being charged. We now call Dodo's cancel API before anonymising, and return 502 to the user if Dodo rejects so they retry rather than ending up deleted-but-still-paid
• Dodo webhook handlers now ignore soft-deleted users so a late renewal event can't update the billing fields on an anonymised record
• POST /auth/refresh rejects soft-deleted accounts so a stale refresh token can't keep issuing fresh JWTs for the remainder of the 7-day refresh expiry
• Reactivation: Mongoose $set: {} doesn't actually clear nested subdoc fields — it merges. Switched to $unset per-field so /consent properly re-shows after a delete-and-resignup
• Reactivation billing fix: if the user's last subscription state was anything other than "active", we now reset billing.plan to "free" — fixes a UI/state mismatch where a deleted Pro account would reactivate showing Pro but the quota check still treated them as Free
• Auth middleware now async — checks deletedAt on every authenticated request so a JWT issued before deletion can't survive the 24-hour access-token expiry

• DELETE /auth/account endpoint — anonymises PII (username → deleted-<id>, email/avatar cleared, GitHub access token cleared, BYOK keys dropped, consents removed), revokes refresh tokens, clears subdomain cookies, sets deletedAt
• Type-DELETE confirmation modal with role="dialog", aria-modal, ESC handler, focus trap on the input. No accidental deletes
• Anti-abuse reactivation: deletion keeps githubId on the record so when the same GitHub identity OAuths back in, we reactivate the same _id rather than creating a fresh user. billing.reviewsUsedThisMonth carries over — you cannot delete-and-resignup to reset the Free 20/month quota
• On reactivation, consents are cleared so the user must re-accept ToS + Privacy on the /consent screen before doing anything
• Server-side consent enforcement — new requireConsent middleware on /repos/* /ai/* /api/prs/:id/review /security/* returns 412 consent_required when the user's recorded consents don't match the current policy versions. The SPA axios interceptor catches the 412 and routes to /consent
• Email fallback preserved for users who can't sign in (account lockout, lost access)

• New /consent screen after first OAuth — three unchecked-by-default checkboxes: Terms of Service (required), Privacy Policy (required), Marketing communications (optional)
• Server records each consent as a full audit entry: { version, acceptedAt, IP, userAgent } so we can prove what was accepted, when, and from where if it ever matters
• Settings → Privacy & Consents panel: view your recorded consent versions and dates, toggle marketing on/off with a proper switch (role="switch", loading spinner in the thumb during the in-flight save, 44px tap target per Apple HIG)
• OAuthCallback redirects to /consent automatically when the recorded versions don't match the current ones — covers both first-time signups AND existing users on the next material policy bump
• Backfill: 11 existing testers were marked accepted at v1.0 with marketing opted-out. We never auto opt-in
• Withdrawal: standalone PATCH /auth/consents/marketing endpoint lets users flip marketing without re-accepting the legal docs — same effort as opt-in

Terms of Service v1.0

• Indian-law-grounded: Indian Contract Act 1872 (§11 18+ eligibility), IT Act 2000 §79 (intermediary safe-harbour) + IT Rules 2021 Rule 3(2) (grievance officer), Consumer Protection Act 2019 (refund-clarity requirement), DPDP Act 2023 (privacy interplay), GST on OIDAR for the Pro tier
• 20 sections including a prominent AI-output disclaimer ("reviews can be wrong, you remain responsible for every merge"), explicit sole-proprietor liability disclosure, BYOK responsibility clauses, refund-policy clarity (no pro-rated refund for partial months — disclosed up front), Bangalore civil-court jurisdiction
• TermsOfService JSON-LD schema and sticky sidebar TOC with IntersectionObserver active-section highlight

Responsible Disclosure v1.0

• /security page covering scope (every LGTM-controlled surface listed by name), out-of-scope (third-party platforms with their own VDPs), rules of engagement, safe-harbour commitment under IT Act §43, severity-tiered SLA (Critical 14d / High 30d / Medium 60d / Low best-effort), 90-day coordinated-disclosure window
• Honest no-bounty disclosure: no cash today (we're a small Indian team at DevsBazaar, would rather under-promise than over-commit), but 1 year of Pro + swag + recognition for any valid Medium-or-higher report
• CERT-In (incident@cert-in.org.in) listed as the final escalation if we ever fail to respond
• /.well-known/security.txt RFC 9116 compliant with proper Contact / Expires / Acknowledgments / Policy / Preferred-Languages / Canonical fields

• 16 sections covering all 9 DPDP §5 mandatory notice elements: data categories, processing purposes, retention, Data Principal rights, Grievance Officer contact, complaint route to the Data Protection Board, processing methods, third-party sharing, cross-border transfers
• Sub-processor table: GitHub (US), OpenAI / Anthropic (US, BYOK), Dodo Payments (India), MongoDB Atlas, Fly.io (Singapore — we wanted Mumbai but capacity is blocked), Sentry (US), SMTP, npm — each with what data goes to them, why, and where they're based
• Retention table — per-field, with the 7-year Indian tax-compliance window flagged for billing invoices
• Grievance Officer published: DevsBazaar, 48-hour ack + 30-day resolve windows, escalation path to the DPB once it's accepting complaints
• Cookie inventory: lgtm_session / lgtm_refresh (HttpOnly, Secure, SameSite=Lax, Domain=.looksgoodtomeow.in, 24h / 7d), plus the localStorage entries for legacy Bearer flow
• Honest cross-border map: India users → Atlas → Fly Singapore → US (for GitHub API, BYOK LLM calls, Sentry, SMTP). "If you require all your data to stay in India, you cannot meaningfully use LGTM today"
• PrivacyPolicy JSON-LD schema; sticky sidebar TOC with IntersectionObserver-driven active highlight; lives on every subdomain

• Labels now fade via synchronised max-width + opacity transitions instead of conditional render — the text width shrinks in lockstep with the rail
• Compact left-accent indicator for the active row when collapsed (3px primary bar flush against the rail's edge) instead of the heavy full-row pressed background
• Hover state strengthened slightly when collapsed (icon needs visible feedback since the label isn't there to indicate)
• Logo resized to 32px when collapsed so it lives in the same visual rhythm as the 16px nav icons and the 28px user avatar — fixed the proportional mismatch on the 68px rail
• Same pattern applied to the Beta pill, Notifications counter, Collapse toggle, and Go-to-Dashboard CTA so the whole rail moves together

• TechArticle JSON-LD schema covering 11 article sections — search engines can surface the docs as a structured developer reference
• 16-detector security table verified line-by-line against the rule library (no more loose paraphrasing — rule IDs, default actions, severities all match code)
• CLI command reference expanded 12 → 50+, grouped into Auth & diagnostics · Repo management · Reviews · Configuration (BYOK) · LGTM Security · Notifications & analytics · Open shortcuts
• FAQ section with 18 long-form answers + FAQPage JSON-LD — google now renders these in 'People Also Ask' rich results
• Stale URLs replaced — example output now references app.looksgoodtomeow.in/review/<id> instead of the old apex placeholder

• SEO foundation: new title under 60 chars + comprehensive description, OpenGraph tags for cross-platform link previews, canonical URL, robots directive with max-snippet, SoftwareApplication JSON-LD schema with INR pricing and the full feature list
• 12-question FAQ section grounded in code reality (correct timeouts, file caps, real model strings, BYOK encryption details, GitHub App permissions) + FAQPage JSON-LD for rich results
• Honest timing claims — replaced "<3 min" with "Minutes, not hours". The 30-second figure was an aspirational best case; production diffs realistically land in 1-3 min for typical PRs
• Real model names — agent registry now shows the actual gpt-5.4 / gpt-5.4-pro / gpt-5.4-mini / gpt-5.3-codex strings the code uses, not marketing placeholders
• Specialist agent cards expanded with concrete finding examples per agent (Security catches "SQL injection, hardcoded secrets, IDOR" instead of generic "OWASP Top 10")
• Footer: SEO-rich tagline + India-built credit + Free 20/mo · Pro ₹399/mo · BYOK · No code stored summary

• @tarin/lgtm-cli v2.0.1 live on npm — install with npm i -g @tarin/lgtm-cli
• Default API URL points at api.looksgoodtomeow.in; localhost override (--api-url or LGTM_API_URL env) still works for dev
• Command surface now ~50 commands grouped into 8 categories: Auth & diagnostics, Repo management, Reviews, Configuration (BYOK), LGTM Security, Notifications & analytics, Open shortcuts, Shell completion
• New: lgtm doctor (Node + git + auth + API reachability + AI provider checks), lgtm completion (bash/zsh/fish completion script)
• api. → app. URL heuristic — when the CLI tells you where to view a review, the link points at the dashboard subdomain instead of stripping the subdomain entirely (which would have landed on the marketing apex)
• 91 unit tests now pass; new tests cover the URL-rewrite heuristic specifically

• Four custom domains live: looksgoodtomeow.in (marketing apex), app.looksgoodtomeow.in (dashboard), docs.looksgoodtomeow.in (docs), api.looksgoodtomeow.in (API). Let's Encrypt certs issued and verified
• DNS records (A + AAAA + an apex ACME-challenge CNAME for Fly's DNS-01 path) plus the apex ownership TXT — the apex cert was the tricky one
• Multi-origin CORS — the API now accepts requests from all three LGTM origins and explicitly rejects everything else
• Cross-subdomain session cookies: Domain=.looksgoodtomeow.in, HttpOnly, Secure, SameSite=Lax. Sign in on app.* and a fetch from apex carries the session automatically — so the apex Landing nav can show "Dashboard" instead of "Sign in" without a re-auth round trip
• SubdomainGuard component locks docs.* to just /docs, /privacy, /terms, /security, /changelog, /review/:id — anything else hard-redirects to apex or app
• Hostname-aware SPA routing: apex serves Landing on /, app.* redirects / to /dashboard, docs.* redirects / to /docs
• Production bundle no longer references *.fly.dev anywhere — VITE_API_URL baked in at build time
• External integrations updated: GitHub App webhook + OAuth callback now point at api.looksgoodtomeow.in, Dodo Payments webhook updated, Sentry DSN unchanged

• lgtm-server now runs five process groups: api · review-worker · security-worker · index-incremental · index-backfill. Each scales independently via flyctl scale count <process>=N
• index-backfill gets 2GB / shared-cpu-2x because tree-sitter parsing + dependency graph + PageRank on a 5000-file monorepo is memory-heavy; the rest run on 1GB / shared-cpu-1x
• Self-hosted lgtm-redis (256MB shared-cpu-1x + 1GB persistent volume for RDB snapshots) — Singapore region. BullMQ-friendly noeviction policy
• WORKER_TYPE inlined per process via sh -c wrappers — Fly's docker-entrypoint exec's args verbatim so env-var prefixes only work inside a shell
• Singapore (sin) region — Mumbai (bom) preferred for India proximity but Fly's capacity is currently blocked; flyctl scale to bom when capacity returns
• lgtm-client (Vite SPA → nginx:alpine) on shared-cpu-1x / 256MB with auto-stop when idle

• Job locking to prevent concurrent security scans on the same monitor — double-fires under load were occasionally creating duplicate audit-log entries
• Failure notifications + retry queuing — failed scans now emit a Notification, get reported to Sentry, and retry with exponential backoff instead of silently dying
• Startup cleanup — orphaned PRs, RepoContexts, and SecurityScans left in mid-state by a previous container's hard kill are reset to a clean state on boot
• Rate-limit hardening across security routes — separate limiters for write operations (enroll/unenroll/pause/policy edits) vs read operations
• Socket.IO config overhaul — Redis adapter wired so progress events fan out across multiple API instances instead of being trapped on one Fly Machine
• Global failure-toast UI — every worker error now surfaces a user-friendly toast in the dashboard instead of failing silently
• Synthesizer threshold + BullMQ lockDuration grace tuned for stability under load