// changelog · release notes

Changelog

Versioned release notes. We ship small and often.

2026-06-16 · v0.4.0

Custom domain + supply-chain hardening

Live on revert.pro: apex + www over HTTPS, HTTP→HTTPS redirect
Scoring engine locked down: the droplet now requires a shared secret, so all scans must pass through the metered API gateway (no direct bypass)
Supabase SDK pinned + self-hosted: sign-in library moved off the CDN to a self-hosted, exact-version bundle with Subresource Integrity (SRI) and an SRI-verified CDN fallback — closes a supply-chain risk on dashboard and control panel
API docs canonicalized to the revert.pro domain

2026-05-29 · v0.3.0

Live scan API + persistence

Public scan API: POST /api/scan returns real XGBoost score (no more mockup)
Supabase backend: Postgres in Frankfurt, scan history table with row-level security
Legal pages: privacy, terms, security policy, about
/.well-known/security.txt per RFC 9116
Fixed rate-limiter token-bucket initialization bug (every first request returned 429)

2026-05-28 · v0.2.0

deep_analyze pipeline + Wintermute investigation

A+B sandbox tool: Heimdall decompile + Anvil mutation tests on flagged contracts
Investigation archive: first manually-cleared high-complexity case (Wintermute MM bot — high attack-surface score but sound on manual review, illustrating that a high score flags review priority, not a confirmed vulnerability)
Foundry + Heimdall installed permanently on infra droplet
Adversarial calibration set seeded for the next retrain

2026-05-27 · v0.1.0

Initial public launch

Landing page goes live (early preview deployment)
FastAPI service on infra droplet
XGBoost model (xgb-2025-12-28): F1 ≈ 0.92–0.95 (95% CI 0.918–0.948; RandomForest and XGBoost statistically indistinguishable) for agreement with Slither's static-analysis labels on 11,670 held-out, source-verified contracts — i.e. how well it reproduces an attack-surface/complexity signal, not real-exploit detection; 70 features, 117,091 training contracts
ICICPE 2026 paper public on GitHub