Devzy v2.11.0 Release Notes

This release refreshes the product look and makes scan work easier to follow. You can watch scans as they run, get alerts when they finish, and keep an organization-specific vulnerability list so results match how your team treats known issues.

New Features

Visual refresh

The product has a new color scheme, logo, and theme that carry from the landing page through the dashboard and repositories.

• Updated color palette and branding across signed-in screens
• Theme toggle applies the selected theme immediately
• Repositories section rebuilt to match the rest of the dashboard

Localized landing page

The public landing page is available in English, Japanese, and Korean, with language switching and locale-aware routing. Visitors who arrive without a known locale see English.

Live scan activity

A scan activity view in the header shows running and recently finished scans for the current workspace.

• Progress and status update while a scan is in progress
• Quick actions jump to the relevant report
• Timed-out activity loads without blocking the rest of the page

Security and compliance scan alerts

Scan results can be sent on the same channels you already use for review notifications.

• Opt in separately for security scans and compliance scans
• Choose complete-scan alerts, or only critical and high-severity results
• Slack, Microsoft Teams, Google Chat, and email reuse existing routing, quiet hours, and per-repository destinations
• A test send can preview a sample security or compliance card before you go live

Organization CVE list

Administrators can import an organization vulnerability list on Preferences, Security so scans respect the issues your team already tracks.

• Import a list, download an example file, or remove the list entirely
• Import and remove stay disabled when settings are read-only
• Scans use the list when it is present so enrichment matches your organization's known issues

Sensitive data inventory

Compliance dashboards can show what kinds of personal data a repository appears to collect, grouped by privacy tier.

• Tiers follow the frameworks you have enabled
• The card stays hidden when a scan finds nothing to inventory
• Counts stay separate from issue totals; this is an inventory, not a failed control

Actionable scan findings

Security and compliance results are easier to act on.

• Code findings and dependency advisories are listed separately
• Repeated advisories across related packages are grouped so one upgrade is one decision
• Advisories with no published fix sit in a monitor group
• Known-exploited and exploit-likelihood signals surface first when they are available
• Advisory notes appear on both Compliance and Repo Health when a scan found them

Fix in IDE from the compliance dashboard

Compliance issues and advisory notes can open a fix prompt in your editor, using the same launchers as review findings.

• Supported targets include Cursor, VS Code, Codex, and Claude Code
• The action appears only when a fix prompt is available

Training and data-use consent

Preferences now include training-consent controls so organizations and repositories can set how their data may be used for model improvement.

• Organization default with optional per-repository override
• Clear inheritance and a way to revert to the organization default

Broader model catalog

Administrators can add models from additional providers in the model registry.

• Google Vertex AI
• OpenRouter
• Featherless

Improvements

Live organization health

Dashboard health rings now use live metrics from completed scans and review activity instead of placeholder scores.

• Compliance, security, and bug status share the same healthy / at-risk / critical bands
• Rings stay empty when there is not enough data, rather than showing a misleading zero
• Attention items and repo health only include repositories the viewer is allowed to review

Higher-signal reviews

The review engine is stricter about what it posts.

• Findings that cannot be confirmed are more likely to be dropped
• Impact claims are confirmed only when a real consumer of the changed code can be found
• Follow-up reviews keep track of which commits were already covered after the summary is rebuilt
• Claude-based review paths can use deeper reasoning, closer to other providers
• Large reviews are less likely to stall or skip file summaries when a provider is under load

Scan and report polish

• Scan start and finish times include the viewer's time zone
• Web and PDF report download is more reliable
• Slack routing can target a channel for scan reports
• Header, landing-page, and path-filter layouts are cleaner in both themes

Bug Fixes

• Fixed: Company CVE list import missing from the Security tab after a later preferences change
• Fixed: Header flicker on the public changelog
• Fixed: Light-mode contrast on path filters
• Fixed: Docs links opening in the same tab
• Fixed: Preferences page failing to load in some cases
• Fixed: Follow-up review comments looking up threads across the wrong repositories
• Fixed: Compliance setup blocking users when no frameworks were selected
• Fixed: PDF report download failing in some deployment environments
• Fixed: Analytics attention and repo-health totals including repositories the viewer cannot review

Infrastructure

• Hosting can run across multiple major cloud providers
• Hardened workspace isolation and request-boundary protections
• Stronger redaction of secrets in analysis output
• Shared data package updates for notifications, analytics, and scan settings
• Dependency, container, and deploy pipeline updates for platform stability