Release Notes

v1.1.106 (November 2026)

New

  • A redesigned desktop app. A new look and one consistent layout across every page. Home is now a workspace with an overall quantum risk gauge, the factors behind the score, findings charts and your recent scans. The Dashboard is built from charts, and a new Recent Activity page lists scans from every analyzer in one place.
  • Code Analyzer file view. A project explorer, severity filters and findings charts. Each file opens with its findings and suggested fixes inline, with next and previous issue navigation, always on your latest results.
  • Unified results. Certificate, Network and Binary results open with a shared risk score panel and summary. Network results add a port table with expandable details.
  • Business context for binaries. The Business Criticality setting shapes the binary risk score. From the CLI and the MCP server you can also specify compliance requirements: rivet scan-binary app.exe --business-criticality critical --compliance fips_140,fedramp.
  • MCP server for every license. Trial users can use the MCP server, like every other feature during the trial.

Improvements

  • Each analyzer page lists your recent targets for one-click rescans.
  • Scan times are shown in your local time zone.
  • AWS access key IDs are masked in the Cloud Analyzer connection list.
  • Clearer guidance when a GCP service account key cannot be used.

Security

  • Updated dependencies. SBOM and dependency vulnerability audit generated on all three platforms at build time.

v1.1.105 (October 2026)

New

  • Identity provider analysis. The Certificate Analyzer has a third mode, Identity Provider, alongside domain and certificate file scans. Give it an OIDC issuer or discovery URL, a JWKS URL, or a SAML / WS-Federation metadata URL, and Rivet assesses the signing keys your single sign-on provider publishes, together with its TLS certificate. Also available from the CLI and the MCP server.
  • Post-quantum key exchange detection. Certificate and network scans now report the TLS key exchange a server negotiates, and recognize hybrid post-quantum key exchange (X25519MLKEM768), so you can see which endpoints already protect today's traffic against future decryption. The result flows into the dashboard, reports, CBOM and exports.
  • SSH key exchange. The Network Analyzer reads the key exchange algorithms SSH servers offer, including post-quantum options.
  • More services covered. Certificates are now read from mail (SMTP, POP3, IMAP), FTP, LDAP, XMPP, PostgreSQL and MySQL servers that upgrade to TLS on connection.
  • Identity and key files in code scans. The Code Analyzer now finds quantum-vulnerable keys in SAML metadata, JWKS files, SSH keys, authorized_keys and known_hosts, private keys and CSRs, PuTTY keys, Java keystores, PKCS#12 bundles and kubeconfig files, including key files without an extension.
  • Cloud KMS SDK detection. New rules find quantum-vulnerable key specifications in AWS KMS, Azure Key Vault and Google Cloud KMS SDK code for Java, JavaScript and Go, plus import-level detection for mbedTLS, wolfSSL and Apple's Security framework.
  • Scan coverage states. Key Management, Cloud and Binary scans now report whether they read everything (Complete), part of the target (Partial) or none of it (Incomplete), with the reason, across the app, history, dashboard, reports, CBOM and exports. The Cloud Analyzer can now export CSV, HTML and SARIF.
  • Consistent exit codes. Every scan command uses the same exit codes: 0 clean, 1 findings, 2 error, and 3 incomplete. Use --allow-incomplete to accept partial coverage in CI.

Improvements

  • One set of risk levels. Every screen, report and command now uses the same bands: Critical 80+, High 60 to 79, Medium 40 to 59, Low 15 to 39, Minimal under 15. Custom thresholds apply everywhere. Some scores may show a different color or label than before.
  • Remediation guidance. Algorithm-specific recommendations for Key Management and Cloud findings, and clearer migration guidance for EdDSA, AES-128, SSH and RSA findings.
  • Binary Analyzer. More thorough string analysis for Android, .NET and Java files, more precise algorithm labeling for Windows key generation, and clear reporting when a file or archive cannot be fully analyzed.
  • Cloud and Key Management Analyzers. Recognition of the latest AWS CloudFront and API Gateway TLS policies, including post-quantum ones, more key types across AWS, GCP and certificate keys, and per-request timeouts for every provider.
  • Reports. A search box on the Reports page for picking scans to include in an AI-generated report.

Security

  • The AI provider key is now kept in the operating system's credential store, alongside the license key.
  • Additional hardening of the local backend, the desktop window and report exports.
  • Updated dependencies. SBOM and dependency vulnerability audit generated on all three platforms at build time.

v1.1.103 — October 2026

New

  • Cloud Analyzer — Scan live cloud infrastructure for quantum-vulnerable cryptography across AWS (S3, RDS, EBS, Secrets Manager, CloudHSM), Azure (Application Gateway, Storage, SQL), and GCP (load balancers, Cloud Storage, Cloud SQL, Secret Manager). Saved connections, scan history, and dashboard integration included. Also available via CLI and MCP server.
  • Ed25519/X25519 detection — Code analyzer now detects Ed25519 and X25519 usage across 11 languages.
  • Framework-specific PQC rules — New detection rules for Spring Security, Express, FastAPI, Django, Ktor, and Rails.
  • rivet doctor / rivet diagnose — Built-in diagnostics with error codes, build info, and log redaction.
  • rivet config — View and manage all scan settings from the CLI. Scoring weights, timeouts, and thresholds are now configurable.
  • rivet enroll / rivet license — License key stored in the OS credential store (Windows Credential Manager, macOS Keychain, Linux Secret Service) — no more plain-text key files.
  • --cert-file for scan-cert — Scan local PEM files directly without a network target.
  • Scan cache — File-based scan cache reduces redundant re-scans on unchanged files.

Security

  • Bumped litellm ≥ 1.88.6 (CVE-2026-84377), urllib3 ≥ 2.8.0 (CVE-2026-97687/88/89), and 7 additional dependencies with disclosed CVEs.
  • SBOM and dependency vulnerability audit generated on all three platforms at build time.
  • Cython obfuscation extended to core detection and scoring logic.

v1.1.92 — September 2026

New: Key Management Analyzer (Beta)

Rivet now scans live key and certificate infrastructure for quantum-vulnerable algorithms across HashiCorp Vault, AWS KMS, AWS Certificate Manager, Azure Key Vault, Azure Managed HSM, GCP Cloud KMS, Kubernetes Certificate Manager, and Microsoft AD CS. This is metadata-only, read-only scanning: Rivet can list and analyze algorithms, but never decrypt, sign, or export anything. Credentials you provide are stored only in your machine's own OS credential manager (Windows Credential Manager, macOS Keychain, or Linux Secret Service), never in Rivet's database and never transmitted to Cerebion.

Expanded Automation Support

New integration points let you trigger Certificate, Network, Binary, and Key Management scans programmatically through Rivet's MCP server, making it easier to fold Rivet into existing automation and AI assisted workflows.

Code Analyzer Improvements

  • Expanded Vue.js support to also cover code written directly inside .vue component files
  • Refined TLS version and elliptic curve detection accuracy for PowerShell scripts

Documentation

Updated User Guide and Quick Reference with full Key Management Analyzer coverage.

v1.1.85 — July 2026

Bug Fixes

  • Dashboard risk scoring accuracy. Certificate and network scan results on the dashboard now consistently reflect their full computed quantum risk score.
  • Export reliability. Improved single scan export reliability across CSV, JSON, and SARIF formats, including more complete SARIF output for port scan findings.
  • Reports and CBOM completeness. AI-generated executive reports and CBOM exports now include findings from certificate and network scans alongside code and binary analysis.
  • Binary Analyzer — macOS universal binary support. Improved detection accuracy for universal (multi-architecture) Mach-O binaries, the standard format for modern macOS applications. Also added clearer diagnostics for scan engine initialization status.

New

  • Product icon refresh. The application icon now carries a small distinguishing mark to differentiate the Rivet product icon from the Cerebion company logo, across Windows, macOS, and Linux.

v1.1.73 — June 2026

New

  • Quantum risk score in code analysis. Code analysis findings now include a quantum risk score (0-100), consistent with binary and certificate analyzers. The dashboard factors code analysis scores into the overall risk picture.
  • Risk score column in Network Analyzer history. The network scan history table now shows the quantum risk score alongside each result.
  • Audit logging. All API endpoints now emit structured audit log entries for security review and compliance purposes.
  • Ctrl+F find-in-page. Native browser-style find-in-page search is now available across the app.
  • PDF export for reports. Report history entries can now be exported directly to PDF.

Bug Fixes

  • Network scanner — improved TLS detection reliability across common ports.
  • Binary scan — detection count showing 0 in history. The history table was reading a key that no longer existed in the stored scan structure. Fixed to use matches_found with correct fallbacks.
  • Binary scan — false-positive Q5 scores when OpenSSL is linked but not used. YARA Q5 matches are now suppressed when OpenSSL is detected as a linked library without direct algorithm usage.
  • Certificate analyzer — cert expiry now factored into risk score. Short-lived certificates were previously scored CRITICAL regardless of algorithm. Expiry is now correctly weighted.
  • Risk scoring — refined quantum risk calculation. Improved accuracy across algorithm scoring, timeline weighting, and cipher suite matching.
  • userData path normalized on Windows and Linux. App data was written to inconsistent paths across platforms. Normalized to CerebionRivet on both.
  • License guard — hardened license validation error handling.
  • Code Analyzer — cancelled scan badge no longer shown on client disconnect. If the client disconnected mid-scan, the scan was marked CANCELLED incorrectly. Fixed.
  • Code Analyzer — expanded file coverage to include dotfiles. Files such as .golangci.yml are now included in scans.
  • Code Analyzer — bash false positives on $1 and 0. The bash weak random generation rule was matching shell positional parameters and the literal 0. Fixed.

Performance

  • File tree now loads on demand — large repositories no longer freeze on initial load.
  • Switching away from Code Analyzer mid-scan no longer causes a navigation freeze.

Security

  • License keys are now obfuscated in all log output.
  • LiteLLM telemetry disabled — no usage data leaves the machine via the AI integration.
  • All Python and Node.js dependencies audited: 0 known vulnerabilities in shipped code.
  • Windows installer signed with EV code signing certificate (DigiCert). macOS installer signed and notarized by Apple.