Product Changelog
A running log of notable features, improvements, and fixes across the Sentry platform.
Recent updates
Takedown cases record the exact finding and who filed Feature
A takedown case now records the finding it came from, freezes its evidence at filing and records who filed it. Filing is refused against a subject's own declared account or a declared official host, even when the match looks perfect.
Reports are stored as immutable runs with a verifiable hash Feature
Every exported or scheduled report is now stored as a run with its SHA-256, the inputs it was rendered from and the sources it drew on. Delivery sends the stored run rather than re-rendering, retrieval re-checks your current access to each source, a tampered file is detected rather than served, and a redacted copy is a separate run. Scheduled reports carry their attachment and record the outcome. Nothing is deleted automatically.
Search monitors report what actually happened Feature
A monitor run now records its true outcome (success, empty, partial, failed, limited or interrupted) instead of looking healthy when it was not, with a bounded number of retries and recovery for an interrupted run. Alerts are raised per finding, a monitor holds one slot while its executions hold none, and due monitors run every 15 minutes.
Supplier events keep a name match apart from confirmed impact Security
A news item that merely names a supplier used to read as confirmed impact. Name match, geography, analyst confirmation and confirmed impact are now four separate facts, and only an analyst can state the last two. Existing rows are not rewritten.
IOC registry filters and matching for every indicator type Feature
The IOC registry has filters, paging and an always-live History control. Every stored indicator type is matched against content, not only CVEs, bulk imports go through the same writer as manual entry, threat actors refuse duplicate registration and keep edits on re-import, and campaigns have a detail view with edit, unlink and delete.
Brand protection and physical asset alerts are more precise Feature
Brand marks report an honest watermark and re-evaluate hosts, app store declarations re-score stored listings, and takedown paths now cover brand, job fraud and items. A hazard near a declared facility notifies you once per event, facilities added after a notice are announced, and a hazard feed that cannot be read is shown instead of hidden.
Notification delivery, digests, phone verification and escalation fixes Fix
Fixed notification delivery, per-account digest scoping, phone verification (which now fails closed), escalation, and dashboards that reported a count or a failure inaccurately. Alerts honour a feed state and its per-feed channels, and events check that their evidence belongs to the viewer and that the viewer is on an active team.
Billing: one subscription per account, with honest periods Fix
An account now has exactly one subscription, billing periods are reported as they are, and the admin billing actions do what their labels say.
Data export and erasure cover every user-owned table Security
Subject access exports and erasure now cover every table that holds user data, with self-service controls from the account menu. Dossier attachments are stored on a volume outside the web root.
Hardening of sign-in, email change, password reset and logout Security
Changing an account email, resetting a password, MFA steps and logout were tightened. Machine credentials stop when their owner does, the tenant IP allowlist now also covers OAuth and pull keys, there is a dedicated STIX pull key, and webhook endpoints can be managed from the interface.
Images from feeds are now analysed for every account Feature
Images in collected feed items are hashed and read for EXIF data and text for every account, not only accounts with a registered brand mark, so image and OCR search has something to search. The analysis runs on the local analysis service and calls no external AI provider, and image search is scoped to your team.
A faster intelligence dashboard with reviewable evidence Performance
Dashboard sections load in parallel, content association runs once, and each feed item is counted once on the map. The evidence list now shows every associated row with why it counted, and lets you confirm or reject it, with a control to score only identifier-confirmed content or all name matches. The network graph has readable labels, zoom, focus and search.
Feed items re-checked against the full page Fix
An item that matched a feed on a short search snippet is checked again once its page text is available. If the page names none of the feed terms the item is marked as a false positive with the reason, and it can be restored. The Mark read, Save, Flag and False+ buttons on the overview page also work again.
Old items keep their real dates Fix
Items collected without a date used to look brand new. Dates are now read from the page itself and from LinkedIn post identifiers, undated historical items no longer appear as fresh or raise alerts, and existing undated items can be repaired.
Exclusion rules and False+ marks now clear what is already stored Fix
Adding an exclusion rule now marks matching stored items as false positives, and deleting the rule restores exactly those. Rules apply on every collection path, keywords match whole words, and False+ learning only picks up distinctive names and brands, never ordinary words, so marking one item no longer removes real coverage.
Want to know when something ships? Watch this page, or talk to us about release notifications for your team.