Everything we ship,the day we ship it.

CLI sign-in and account setup

The old flow had too many steps and not enough guardrails. The new one uses secure authentication by default, cuts the setup path in half, and gets you into a working environment faster.

Secure CLI sign-in

No more plaintext credentials or manual config files.

Streamlined account setup

Fewer steps from signup to first scan.

Personal access tokens

Connect developer tools without sharing org-wide secrets.

AI authorship insights

autter now tracks how code was created. Every pull request shows whether a change was human-written, AI-assisted, or AI-generated. This is not a judgement. It is context. Reviewers see provenance. Leads see patterns. Nobody has to guess.

Code review

More accurate findings

Fewer false positives reaching reviewers.

Clearer comments

Suggested fixes are easier to understand and apply.

Faster fix suggestions

Less time between finding and resolution.

Infra and config security checks

Catches misconfigurations before they ship.

Improved dependency reporting

Vulnerability notifications with actionable detail.

Analytics

Pull request and repository activity metrics are now clearer and more complete. You can see what is actually happening across your codebase without building your own dashboards.

GitHub integration

• Reviewer assignment works correctly across team configurations.
• Error messaging tells you what went wrong and what to do about it.
• Code indexing is more reliable for large projects: no more silent failures on big repos.

Interactive demo workspaces

Explore a real environment without creating an account.

Smoother demo signup

Fewer steps, fewer dropoffs, faster time-to-value.

Faster org creation

New organizations spin up quicker and more reliably.

Progress notifications with direct links

Go straight to the result instead of searching for it.

Complete audit trail

Every important account and billing change is logged and traceable.

Improved deployment reliability

Fewer incidents, faster recovery.

PR review: broader, sharper, quieter

Dependency impact analysis

Reviews understand what a dependency change actually touches downstream.

Typosquatting detection

Packages that look like popular libraries but aren't get flagged before they land.

Cross-file consumer checks

Changing an API? autter checks who's calling it before approving the change.

False positive reduction

Fewer findings that waste your time. The ones that remain are the ones that matter.

Infrastructure-as-code scanning

IaC scanning is live. Terraform plans, CloudFormation templates, and Kubernetes manifests are now checked for misconfigurations before they ship. Three engines run independently, so coverage gaps from any single scanner get caught by the others. If you have ever deployed a security group that was wider than you intended, this is for that.

Finding detail modals

Every finding opens into a full explanation, not a one-line summary.

AI fix suggestions

Ask autter for a recommended fix directly from any finding.

Business logic invariant views

The specific rule, the specific violation, and the specific evidence.

Content-shaped loading states

Scan results load progressively instead of appearing all at once.

Plan tiers and subscriptions

Pick a plan, upgrade or downgrade, and usage adjusts automatically.

Hosted checkout

Pay without leaving autter, with UPI and B2B invoicing included.

Invoice generation and backfill

Current and historical invoices available on demand.

Usage visibility

Your current usage is always visible in the sidebar and billing settings.

PR review engine

Chapter generation

PRs are broken into reviewable chapters, not treated as a single diff.

Inline comments

Review findings appear exactly where the code changed.

Summary utilities

Every PR gets a structured overview before a reviewer opens a file.

Gate panels and overview UI

Merge-blocking status is visible, not buried in a check run.

Local and Fargate runners

Review runs wherever your infrastructure already lives.

Fifteen review checks

Static security. CI/CD security. API contract validation. Dependency and license compliance. Typosquatting detection. Secret scanning. Infrastructure-as-code misconfiguration. Race condition analysis. Logging hygiene. Privacy surface detection. Rate limiting coverage. Architectural conformance. Policy engine evaluation. AI slop detection. Each check writes to its own findings surface, and policy violations get deterministic hashes so repeated findings are tracked, not duplicated.

PR review UI

Monaco-based diff viewer

Diffs render with the same engine your editor uses.

Conversation timeline

Comments, suggestions, and gate decisions in chronological order.

Keyboard shortcuts

Navigate reviews without reaching for a mouse.

Activity feed styling

Review events are scannable instead of a raw log.

Comments, mentions, and GIFs

Inline comments now support full Markdown. Mentions are wired in. The GIF picker is live. This is the kind of feature that makes review conversations feel like conversations instead of form submissions.

Delivery logging

PR events are logged with enough detail to debug routing.

Writeback detection

autter's own comments no longer trigger recursive review processing.

Gate-skip tracking

See what bypassed enforcement and when.

Automatic schema bootstrapping

New repos need no manual setup before gates start working.

PR review pipeline

Diff parsing and summaries

Every PR gets a structured breakdown before review agents run.

Merge-blocking review gates

Review output is evaluated before a pull request is allowed to merge.

Durable PR tracking

Revisions, metadata, and migration safeguards for org databases.

GitHub-native webhooks

PR, review, and comment events route through rebuilt handlers.

Secret scanning, rebuilt on TruffleHog

Detection runs across full git history, not just the current state. The previous version found secrets. This one tells you which ones are live, which ones rotated, and where in history they first appeared. Semgrep rule coverage also expanded across auth bypass, injection, cryptographic misuse, SSRF, XSS, and more.

Scan sharing and reports

Public share tokens

Generate a link anyone can view without an autter account.

Branded report pages

Shared reports look like they came from your security team, not a raw tool.

PDF export

Structured sections with branded cover and closing pages.

Supply chain and dependency risk

Deterministic risk scoring

Severity and risk factors are reproducible, not model-dependent.

Lockfile-aware resolution

autter resolves what you actually installed, not what your manifest says.

Exploit chain tracking

Critical CVEs with no published fix get chain cards, detail views, and narratives.

Also in this release

• The codebase-scan chat experience is now powered by AI SDK.
• Documentation generation uses task-specific model routing: each writer gets the model best suited to its job.
• Fullscreen viewing and copy support across architecture-map surfaces.

Scan infrastructure

Agent pipeline tables

Every agent's output is tracked, counted, and attributed.

Runtime preflight checks

Agents verify the environment before executing, not midway through.

strace runtime tracking

Runtime behavior is observed and stored alongside static findings.

The scanners

• Secret scanning with live validation, allowlists, rotation mapping, and direct issue creation.
• CodeQL is live as a fourth scanning engine; SAST findings include enrichment and suggestions.
• Trivy container scanning, unified dependency audits, and richer license findings.
• AI slop detection: hallucinated imports, placeholder logic, and low-confidence outputs.
• Per-organization SBOM artifacts with CycloneDX support and file risk history through commits.

Bidirectional sync

Issues created in autter stay in sync with your issue tracker.

External issue creation

Push a finding to your tracker directly from autter.

Sync logs

Every sync event is recorded and auditable.

Backfill support

Historical findings can be synced, not just new ones.

EPSS + CVSS scoring

Exploit probability and standardized severity attached to each CVE.

OSV and Exa enrichment

Vulnerability databases and external intelligence feed into findings.

Complexity scoring

Findings are ranked by how hard they are to exploit.

Exploit chain tracing

Connected vulnerability paths are tracked as chains, not isolated findings.

Documentation engine

Manual generation trigger

Teams can regenerate docs on demand, not just on scan.

Job status tracking

Generation progress is visible, not a black box.

Type-safe modular internals

A pipeline we can extend without breaking things.

Wiki and architecture

• Wiki search powered by proper full-text indexing, with better navigation, zoom, and typography.
• Architecture visualization inside generated documentation.
• File content surfaced directly in search results.

Agent execution improvements

Batch inserts + parallelism

Findings write in bulk and agents run concurrently without contention.

Team context

Agents know which team owns a scope before they score it.

Calibrated risk scoring

Scoring is tuned against actual severity signals.

Also in this release

• Custom teams and member assignment, managed directly from settings.
• A dedicated repository issues tab.

Codebase graph construction

autter maps the structure of your repo before generating any docs.

Dependency edge tracking

Relationships between modules are first-class inputs to generation.

Module clustering

Related code is grouped before documentation is written.

Risk flag integration

High-risk areas surface in the docs, not just in findings.

Recurring background checks

Your dependencies are checked on a schedule, not on request.

Concurrency controls

Multiple repos can be scanned without stepping on each other.

Graceful shutdown handling

Long-running checks no longer leave findings half-written.

First-class findings schema

Vulnerabilities and upgrade suggestions are data, not log lines.

• The repository page rebuilt around dedicated tabs: activity, dependencies, API data, health, onboarding.
• Org-wide search with suggestions, page-visit awareness, and an animated header trigger with rotating prompts.
• Deeper dependency intelligence with automatic registry and version enrichment.
• AI response caching, Vercel AI Gateway migration, and loading skeletons across the repo experience.

Also in this release

• Richer treatment for third-party packages: classification, docs resolution, usage insights.
• Endpoint indexing across multiple frameworks, connected to test coverage.

Also in this release

• Configurable event-based notifications, weekly digests, and Slack/webhook test flows.
• Shipped agentic-sales, a small open-source AI sales toolkit, as a side project.

Reverse dependency analysis

autter knows what depends on what, in both directions.

Call graph analysis

Function-level relationships are tracked across the codebase.

Scope dependency graphs

Coupling and layering between scopes are visible, not implied.

AI-augmented health and risk

Structural issues, hotspots, and tech-debt signals surface per scope.

Repository context detection

autter identifies what kind of codebase it is looking at before scanning.

Scope profiling

The indexer understands which parts of the repo relate to which others.

Full dependency resolution

The whole graph gets traced, not just top-level packages.

Scope health metrics

A health signal per scope, not just per file.

• Guided onboarding: autter asks about your setup upfront and walks you through the first scan.
• Webhook testing directly from organization settings.
• More resilient database provisioning with better retry logic.
• Stronger backend logging, health check visibility, and AI pipeline instrumentation.

What changed

• Guided organization setup: each step comes with actual context, not just a progress bar and a prayer.
• Cleaner motion and transitions across the dashboard and login experience.
• Meaningful hardening for secrets management, host configuration, and deployment setup.
• Dynamic database migrations: provisioning handles schema changes gracefully during setup.
• Better observability: improved route logging, health checks, and Slack integration.

Why it matters

First impressions compound. If setup is confusing, people assume the product is confusing. The goal is for setup to feel so unremarkable that you forget it happened. We are getting there.

What you can do now

• Start a scan from the dashboard or onboarding flow. No manual handoff required.
• Get notified when it is done, via email and Slack.
• See full dependency coverage: every package tracked, cross-referenced, and auditable over time.
• Branch-aware scanning: scans run against the right branch, not whatever was last pushed.

What gets scanned

Security vulnerabilities

Known CVEs, exposed secrets, injection patterns.

Dependencies

Every package, version, and license in your repo.

AI-generated code quality

Hallucinated imports, placeholder logic, low-signal patterns.

Blast radius

Which parts of the codebase a change touches and how far it reaches.

• Streaming progress during setup: watch organization creation happen step by step instead of waiting on a static loading state and hoping it finishes.
• The organization creation dialog now opens from the right place in the dashboard flow automatically.

Not every changelog is dramatic. Sometimes you just fix the thing that was quietly annoying everyone.

What the scan engine covers

• Security vulnerabilities in your code and dependencies.
• Open source licenses across every package you are using.
• Supply chain risk from third-party dependencies.
• Configuration problems in infrastructure definitions.
• Container security across your Docker setup.
• Policy compliance against your org's own rules.
• Business logic issues that static analysis typically misses.
• Runtime behavior signals that show how code behaves under real conditions.

• GitHub PR automation: comments, check runs, and flagged issues without leaving your workflow.
• The first analytics dashboard, with date-range filters and multiple tabs.
• Expanded codebase intelligence: hotspot detection, dependency mapping, legacy code signals.

What shipped

Authentication

Email login with one-time codes and passkeys. Trusted devices. Welcome flows.

Organization management

Teams, billing, source control, review preferences, custom agents, AI config.

GitHub integration

App installation, pull request views, and the first repository insights.

Codebase intelligence

Architecture graphs, hotspot metrics, and learning signals over time.

Dashboard and navigation

Loaders, toasts, responsive layouts, sidebars, search, and the branding system.

Captain Patch is officially on duty.