Release Notes

v1.1.103 — October 2026

New

  • Cloud Analyzer — Scan live cloud infrastructure for quantum-vulnerable cryptography across AWS (S3, RDS, EBS, Secrets Manager, CloudHSM), Azure (App Gateway, Key Vault, Managed HSM), and GCP (Cloud KMS). Saved connections, scan history, and dashboard integration included. Also available via CLI and MCP server.
  • Ed25519/X25519 detection — Code analyzer now detects Ed25519 and X25519 usage across 11 languages.
  • Framework-specific PQC rules — New detection rules for Spring Security, Express, FastAPI, Django, Ktor, and Rails.
  • rivet doctor / rivet diagnose — Built-in diagnostics with error codes, build info, and log redaction.
  • rivet config — View and manage all scan settings from the CLI. Scoring weights, timeouts, and thresholds are now configurable.
  • rivet enroll / rivet license — License key stored in the OS credential store (Windows Credential Manager, macOS Keychain, Linux Secret Service) — no more plain-text key files.
  • --cert-file for scan-cert — Scan local PEM files directly without a network target.
  • Scan cache — File-based scan cache reduces redundant re-scans on unchanged files.

Security

  • Bumped litellm ≥ 1.88.6 (CVE-2026-84377), urllib3 ≥ 2.8.0 (CVE-2026-97687/88/89), and 7 additional dependencies with disclosed CVEs.
  • SBOM and dependency vulnerability audit generated on all three platforms at build time.
  • Cython obfuscation extended to core detection and scoring logic.

v1.1.92 — September 2026

New: Key Management Analyzer (Beta)

Rivet now scans live key and certificate infrastructure for quantum-vulnerable algorithms across HashiCorp Vault, AWS KMS, AWS Certificate Manager, Azure Key Vault, Azure Managed HSM, GCP Cloud KMS, Kubernetes Certificate Manager, and Microsoft AD CS. This is metadata-only, read-only scanning: Rivet can list and analyze algorithms, but never decrypt, sign, or export anything. Credentials you provide are stored only in your machine's own OS credential manager (Windows Credential Manager, macOS Keychain, or Linux Secret Service), never in Rivet's database and never transmitted to Cerebion.

Expanded Automation Support

New integration points let you trigger Certificate, Network, Binary, and Key Management scans programmatically through Rivet's MCP server, making it easier to fold Rivet into existing automation and AI assisted workflows.

Code Analyzer Improvements

  • Expanded Vue.js support to also cover code written directly inside .vue component files
  • Refined TLS version and elliptic curve detection accuracy for PowerShell scripts

Documentation

Updated User Guide and Quick Reference with full Key Management Analyzer coverage.

v1.1.85 — July 2026

Bug Fixes

  • Dashboard risk scoring accuracy. Certificate and network scan results on the dashboard now consistently reflect their full computed quantum risk score.
  • Export reliability. Improved single scan export reliability across CSV, JSON, and SARIF formats, including more complete SARIF output for port scan findings.
  • Reports and CBOM completeness. AI-generated executive reports and CBOM exports now include findings from certificate and network scans alongside code and binary analysis.
  • Binary Analyzer — macOS universal binary support. Improved detection accuracy for universal (multi-architecture) Mach-O binaries, the standard format for modern macOS applications. Also added clearer diagnostics for scan engine initialization status.

New

  • Product icon refresh. The application icon now carries a small distinguishing mark to differentiate the Rivet product icon from the Cerebion company logo, across Windows, macOS, and Linux.

v1.1.73 — June 2026

New

  • Quantum risk score in code analysis. Code analysis findings now include a quantum risk score (0-100), consistent with binary and certificate analyzers. The dashboard factors code analysis scores into the overall risk picture.
  • Risk score column in Network Analyzer history. The network scan history table now shows the quantum risk score alongside each result.
  • Audit logging. All API endpoints now emit structured audit log entries for security review and compliance purposes.
  • Ctrl+F find-in-page. Native browser-style find-in-page search is now available across the app.
  • PDF export for reports. Report history entries can now be exported directly to PDF.

Bug Fixes

  • Network scanner — improved TLS detection reliability across common ports.
  • Binary scan — detection count showing 0 in history. The history table was reading a key that no longer existed in the stored scan structure. Fixed to use matches_found with correct fallbacks.
  • Binary scan — false-positive Q5 scores when OpenSSL is linked but not used. YARA Q5 matches are now suppressed when OpenSSL is detected as a linked library without direct algorithm usage.
  • Certificate analyzer — cert expiry now factored into risk score. Short-lived certificates were previously scored CRITICAL regardless of algorithm. Expiry is now correctly weighted.
  • Risk scoring — refined quantum risk calculation. Improved accuracy across algorithm scoring, timeline weighting, and cipher suite matching.
  • userData path normalized on Windows and Linux. App data was written to inconsistent paths across platforms. Normalized to CerebionRivet on both.
  • License guard — hardened license validation error handling.
  • Code Analyzer — cancelled scan badge no longer shown on client disconnect. If the client disconnected mid-scan, the scan was marked CANCELLED incorrectly. Fixed.
  • Code Analyzer — expanded file coverage to include dotfiles. Files such as .golangci.yml are now included in scans.
  • Code Analyzer — bash false positives on $1 and 0. The bash weak random generation rule was matching shell positional parameters and the literal 0. Fixed.

Performance

  • File tree now loads on demand — large repositories no longer freeze on initial load.
  • Switching away from Code Analyzer mid-scan no longer causes a navigation freeze.

Security

  • License keys are now obfuscated in all log output.
  • LiteLLM telemetry disabled — no usage data leaves the machine via the AI integration.
  • All Python and Node.js dependencies audited: 0 known vulnerabilities in shipped code.
  • Windows installer signed with EV code signing certificate (DigiCert). macOS installer signed and notarized by Apple.