{"releases":[{"date":"2026-10-15","items":["Launch a scan of any connected tenant from RedKit, Microsoft 365. One scan uses one RedKit credit.","The first rules cover tenant-wide settings: app registration, tenant creation, user consent, the admin consent workflow, guest access and invitations, and app credential policies.","The report lists each failing rule with the setting found and the value expected, the rules that pass, and the ones that could not be evaluated, with the reason.","Microsoft Secure Score is shown next to it, overall and by category, for comparison.","Each scan is compared with the previous one: new and fixed findings, and how findings and Secure Score move over time.","Tenant scans appear in RedKit history with the other audits.","This is a beta: more rules arrive with each version."],"summary":"A connected Microsoft 365 / Entra ID tenant can now be scanned from RedKit, with a report against the CIS Microsoft 365 Foundations Benchmark v7.0.","tag":"RedKit","title":"Microsoft 365 tenant scans (beta)","version":"1.23.0"},{"date":"2026-10-11","items":["DNSSEC is validated along the whole chain, not only detected.","SPF and DMARC are evaluated the way receiving mail servers apply them, with spoofing protection rated as a whole.","Every subdomain reachable on the web gets its own grade, with the known CVEs of the software it exposes.","The AI and MCP surface of a domain is mapped, and security.txt is checked against the standard.","Findings from every check are gathered in one list with an overall score, worst first.","A report made by the earlier scanner says so and offers a new scan to fill in the missing checks.","The full report is available from the API and the MCP integration; the previous format stays unchanged for existing integrations."],"summary":"The domain scan now checks far more of a domain's surface, and the report reads every subdomain, not only the main site.","tag":"Lookups","title":"Domain scans, second generation","version":"1.22.7"},{"date":"2026-10-11","items":["A tenant administrator grants read-only consent to the mlab-scan app, in one step from Microsoft's own consent page.","The tenant is tied to your organization when one of its verified domains is a domain you already proved on mlab.","A tenant can only belong to one organization.","Consent is checked daily, and the page shows when it has been revoked or a permission is missing.","Owners and Admins can check a tenant on demand or disconnect it.","Scans of a connected tenant are not running yet: connecting now gets you ready for them."],"summary":"Organizations can now connect their Microsoft 365 / Entra ID tenant from the Infrastructure page. Tenant scans come next.","tag":"Organization","title":"Connect Microsoft 365 (beta)","version":"1.22.7"},{"date":"2026-10-10","items":["Every note starts with its method: data set, versions, hardware and how each number was measured.","Notes show raw numbers and say where mlab does worse, not only where it wins.","Charts are interactive, and each one can show the raw numbers behind it.","Search the notes and filter them by tag; a filtered list keeps its own link, ready to share.","The first note replays eleven public supply-chain attacks against postmortem and reads five large open-source projects by hand."],"summary":"mlab.sh/engineering publishes long-form notes from the team: internal studies, benchmarks and the details behind how the platform is built.","tag":"Engineering","title":"The engineering hub","version":"1.22.6"},{"date":"2026-10-10","items":["Each URL gets a band (clean, suspect, high, critical) with every weighted reason listed, so you can see why.","The domain's registration date is now checked live with its registry, even when the domain was never scanned.","A brand-new domain behind a link now counts heavily in the score.","When the registration date cannot be found, the page says the score rests on the URL alone instead of calling it clean.","The same score is returned by the API, the MCP integration and exports."],"summary":"The URL lookup now weighs everything it knows into one score from 0 to 100, and shows the arithmetic behind it.","tag":"Lookups","title":"A risk score for every URL","version":"1.22.5"},{"date":"2026-10-10","items":["YARA matches, remote templates, macros, packers, structural anomalies and high entropy are listed as findings, each with what it means.","A file a reputation feed knows as malicious, or as known-good software, says so at the top.","Identifiers like the imphash and PDB path are grouped apart, ready to pivot on.","Files are now checked against a large, curated set of YARA rules.","Many more checks now run on every file: what an executable can do (with its ATT&CK technique), DDE and Excel 4 macros, remote templates, active PDF content, shortcut command lines, encoded scripts, QR codes in images and phishing forms in HTML.","When nothing was flagged, the report says it is an absence of signal, not a clean result."],"summary":"A file report now opens on what the analysis found, worst first, before the raw output of each tool.","tag":"Lookups","title":"File reports you can read at a glance","version":"1.22.5"},{"date":"2026-10-10","items":["Every reason behind the score is listed: which sanctions authority, which label.","An address that is on none of our lists now reads Not enough data instead of a green 0.","When the chain had to be guessed, the page says so next to the score.","The API, the MCP integration and exports return the same score, with the same bands as email and URL lookups."],"summary":"The crypto lookup now shows why an address scores what it scores, and no longer calls an unknown address safe.","tag":"Lookups","title":"Clearer crypto address risk","version":"1.22.5"},{"date":"2026-10-10","items":["The IOC extraction API now returns the extracted indicators only: the risk and country parameters are gone.","The smishing_risk tool is no longer available in the MCP integration."],"summary":"The SMS threat score has been removed. IOC extraction from text is unchanged and keeps every indicator it found.","tag":"API","title":"SMS risk scoring retired","version":"1.22.5"},{"date":"2026-10-07","items":["Sign in to code.mlab.sh with your mlab.sh account: same organization, same members, same roles.","GitHub and GitLab connections, scans, results, badges, exclusions and alerts all live on code.mlab.sh now.","Your webhooks and activity log stay on mlab.sh.","The Source code page in RedKit now points you to code.mlab.sh."],"summary":"Repository scanning now has its own home at code.mlab.sh, so it can grow at its own pace with more room for new scanners and integrations.","tag":"Code","title":"RedKit Code becomes Code, on code.mlab.sh","version":"1.22.2"},{"date":"2026-10-05","items":["Pages load fewer files, so they show up sooner.","Faster navigation from one page to the next across the whole platform."],"summary":"mlab.sh feels quicker everywhere, from the first page you open to the last report you read.","tag":"Performance","title":"A faster platform","version":"1.22.0"},{"date":"2026-10-05","items":["Redkit now has its own link in the top bar.","Every mlab platform sits in a single Platforms menu, grouped by governance, detection, attack surface and training.","A new About page tells who builds mlab.sh and how we work.","A lighter home page, with straight access to search and file analysis."],"summary":"Tidier navigation and a lighter home page.","tag":"Website","title":"A cleaner look","version":"1.22.0"},{"date":"2026-10-05","items":["Halloween, Christmas, New Year, Valentine's Day and Easter each bring a small animation.","So do the days the security community celebrates: Data Privacy Day, Pi Day, April Fools', World Password Day and Sysadmin Day.","Animations never get in the way of a search, and stay off if your device asks for reduced motion."],"summary":"The search box on the home page dresses up for the right days of the year.","tag":"Website","title":"Seasonal touches","version":"1.22.0"},{"date":"2026-10-04","items":["Path exclusions: drop every result under paths like */tests/* or */fixtures/*, with * matching anything.","Rule exclusions: drop an advisory or a rule you know does not apply, such as GHSA-xxxx or aws-access-key.","Each scan says how many results your exclusions skipped, and links to them.","Alerts: send a finished scan to your webhooks every time, or only when it finds something new at or above a severity you pick."],"summary":"A new Settings tab on every repository page decides what its scans keep and when they reach you.","tag":"RedKit","title":"Settings for each repository","version":"1.21.9"},{"date":"2026-10-04","items":["False positive, accepted risk and review later carry over to the same finding in the next scan, even when its line moved.","An accepted risk is asked again when the finding climbs to high or critical. Fixed never carries over.","New Review later tag on code scans and web audits, in the tag menu, the filters and bulk tagging.","Code scan webhooks now list what is new since the previous scan."],"summary":"Findings you triaged keep their tags from one scan of a repository to the next.","tag":"RedKit","title":"Triage that follows your findings","version":"1.21.9"},{"date":"2026-10-04","items":["Off by default, turned on per repository, with the Markdown to copy.","Shows the date of the latest scan, or an A to F grade if you choose. Never the findings themselves.","Until you turn it on, the badge address reveals nothing about the repository."],"summary":"Show in your README that a repository is scanned by mlab.sh.","tag":"RedKit","title":"README badge","version":"1.21.9"},{"date":"2026-10-04","items":["Scans on push, on connect and on a schedule count like the ones you launch by hand.","Scan on push is now off by default, so a busy repository does not spend your credits on its own. Turn it on in the Automation tab."],"summary":"Every source code scan now uses a RedKit credit, whatever started it.","tag":"RedKit","title":"One credit per code scan","version":"1.21.9"},{"date":"2026-10-04","items":["False positives and accepted risks no longer count in the score, the posture dashboard, comparisons, the PDF or the recap email.","Filter findings by tag, hide dismissed ones, tag a selection in one go, and export what you see as CSV or JSON.","Run again, schedule, cancel or delete an audit from its pages."],"summary":"Findings you tag as false positive or accepted risk now leave the score, and the result page gets the tools to work through a long report.","tag":"RedKit","title":"Triage findings and act on a result","version":"1.21.8"},{"date":"2026-10-04","items":["History: filters by type (code scans included), status and date, the grade of each audit, and a one-click comparison with the previous one.","Posture dashboard: score trend since the last audit, a marker on stale audits, and the verified domains never audited.","Scheduled scans: edit a schedule, run it now, and open its latest result.","Source code: last scan per repository, and filters, tags and export on findings."],"summary":"Every RedKit list is easier to read and to act on.","tag":"RedKit","title":"History, posture and scheduled scans","version":"1.21.8"},{"date":"2026-10-04","items":["Scan history and bookmarks: real paging, type filters, copy, bookmark and add a selection to a case.","IP results show when they were fetched, with a re-check once a day.","Reverse DNS names and resolved addresses on IP pages open their own lookup.","Pasting several indicators into search offers to triage them in batch.","Batch triage: filters, CSV export, file part of the results into a case, and look up every unknown indicator in one go."],"summary":"Your past lookups are paged, searchable and one click away from a case.","tag":"Lookups","title":"History, bookmarks and batch triage","version":"1.21.8"},{"date":"2026-10-04","items":["Search your cases, open ones first, or start a new one without leaving the page.","Case list: search, status filter and sorting. Case page: filter and search indicators, copy them, and see what mlab already knows about each."],"summary":"Adding indicators to a case works the same way everywhere, with a search across your cases.","tag":"Cases","title":"One dialog to add to a case","version":"1.21.8"},{"date":"2026-10-04","items":["API keys: rotate or rename a key, and see when and by whom it was created.","Webhooks: change the URL or format, rotate the signing key, filter deliveries, replay every dead delivery at once, and copy a delivery ID.","Audit log: filter by member and target, with paging and links to what changed.","Team: search, filter by role and see when each member was last active.","Infrastructure: filters, re-check every pending domain at once, and open an asset's lookup.","Usage shows your plan's limits next to what you used."],"summary":"More control over what your organization runs.","tag":"Organization","title":"Keys, webhooks, team and audit log","version":"1.21.8"}]}