Devzy v2.12.0 Release Notes

This release adds downloadable compliance evidence packages for audit workflows, LinkedIn authentication and badge sharing, a new India BFSI compliance ruleset, and significant improvements to security analysis precision and compliance reporting.

New Features

Compliance evidence downloads

Compliance scans now produce two downloadable artifacts alongside the report.

• Evidence bundle: a self-contained package that lets a third party re-derive what was scanned and how controls were evaluated
• OSCAL Assessment Results: a machine-readable export compatible with GRC platforms and compliance automation tools
• Both are available on completed scans via the compliance report; delegated and direct scan paths produce the same artifacts

LinkedIn authentication and badge sharing

You can now sign up as a defender using your LinkedIn acocunt. Users who have earned badges can post them directly to their LinkedIn profile from within the platform.

India BFSI compliance ruleset

A new compliance pack covers India's Banking, Financial Services, and Insurance sector requirements.

• CERT-In clock synchronization: flags services that do not configure a compliant time source
• Log retention (180 days): identifies configurations that fall short of the CERT-In 180-day retention direction
• Payment data residency: detects configurations that may place payment system data outside permitted regions

All three rules ship disabled by default. Enable the ones that apply to your repositories in compliance settings.

Pull request compliance delta

Compliance attestations now show what a pull request introduced relative to the baseline scan, making it easier to see whether a PR added new compliance gaps or carried forward existing ones.

• Violations are compared against the baseline by rule and file path
• A second violation in an already-flagged file is reported rather than treated as known
• When no comparable baseline exists, findings are presented without classification

Compliance dashboard driven by live rule catalog

The compliance dashboard now reflects the rules actually active in the scan engine rather than a static list, so the controls shown always match what was evaluated.

Improvements

Sharper security analysis

The security scan engine produces fewer false positives and surfaces higher-confidence findings.

• Related findings that share a root cause are grouped so a single fix covers the cluster
• Cross-cutting analysis passes identify issues that span multiple files or components
• Each finding goes through an independent confirmation step before reaching the report
• Differential analysis tracks what changed between scans so recurring findings are distinguished from newly introduced ones

Scan reliability

• Scans no longer silently drop batches under load; recovery is automatic
• Scan coverage settings are now applied consistently across both direct and delegated scan paths
• A finding whose line reference fell outside the diff range is now included in the summary rather than discarded

Clearer compliance gating messages

When a compliance scan cannot start because a required setting or framework is missing, the message names the specific missing piece.

Delegated scans respect repository settings

Scans triggered by an external event now use the repository's own compliance configuration rather than a global default.

Scan report themes

Scan reports now respect the light and dark theme selection consistently across all sections.

Bug Fixes

• Fixed: Per-repository settings leaking between repositories in some configurations
• Fixed: Compliance scan gating showing a generic message instead of naming the missing setting
• Fixed: Delegated scans applying global compliance settings instead of the repository's own
• Fixed: Attestation sections missing from hosted compliance reports
• Fixed: Organization health UI component ordering and scaling on the dashboard
• Fixed: Memory layer stability: wiki entries preserved after lesson updates, embedding ID type mismatch

Infrastructure

• Security dependency update: addressed a YAML parsing vulnerability in a bundled library
• Deploy stability: database migrations now run reliably on service start
• API reference documentation is now available for integrators
• Container and dependency updates for platform stability