Skip to main content

What's New

The latest release focuses on two themes: a hardened, roll-out-friendly CI/CD gate, and evidence-based threat modeling that proves and enforces risk instead of just describing it.

Threat modeling, grounded in evidence​

The threat model is now a multi-source, provable artifact rather than an LLM sketch. See Threat Models for the full guide.

  • IaC-grounded architecture - Terraform, CloudFormation, Kubernetes, Helm and docker-compose are parsed into typed components, trust zones and proven public exposure (security groups open to 0.0.0.0/0, publicly_accessible databases, public S3 buckets, LoadBalancer/Ingress). Each component carries its source evidence; trust boundaries are facts, not guesses.
  • Evidence & confidence - every threat is labelled proven (a real DAST finding backs it), likely (source/IaC-grounded) or inferred (hypothesis). The model can never self-declare "proven".
  • Attack paths - per-component threats are chained into reachability-weighted routes (public entry → datastore), surfacing the shortest real path to your data.
  • Blind spots - threats with no assurance (untested, unverified, unmitigated) are surfaced and fed back into scanning and the CI gate.
  • Compliance mapping - each threat maps to OWASP / PCI-DSS / ISO 27001 / NIST 800-53 / SOC 2 / HIPAA / GDPR controls.
  • Interactive diagram - a drag/pan/zoom data-flow diagram with trust-zone columns; public nodes flagged; click a node to focus its threats.
  • Import & export - round-trips with Mermaid and OWASP Threat Dragon; import a diagram and apPosture refines it with code, IaC and findings.
  • Versioning & diff - diff any two versions (threats/components added, removed, or changed - including inferred → proven).
  • IaC drift - re-parse infrastructure and detect new attack surface (a newly public bucket, a new component) since the model was built.

CI/CD gate: hardened and safe to roll out​

See Gates & Policies and Setup.

  • Monitor → Block enforcement - run the gate in Monitor (record, never break the build) during onboarding, then flip to Block from the UI, with no pipeline edit.
  • Fail-closed - if the gate can't be evaluated, the build fails (and is audited) rather than passing silently.
  • New-vs-baseline - PRs are diffed against the default branch so the gate fails on new risk only; feature-branch findings never pollute the posture.
  • Supply-chain-safe agent - the pipeline agent is downloaded and checksum-verified (no blind curl | sh).
  • Zero-pipeline webhook scanning - signature-verified, replay-protected, secure-by-default GitHub/GitLab webhooks, with optional per-repo secrets.
  • Scale & resilience - an opt-in distributed queue runs CI on workers (survives restarts, scales out, re-delivers on failure) with a stuck-run reaper; per-actor rate limits and SARIF size limits guard the pipeline.
  • Threat-model feedback - unverified critical/high threats raise a gate warning, closing the model → test loop.

Where to start​

Last updated on