Notable changes to the scanner, the dashboard, and the receipt trust chain. Dates are when the change reached production.
Benchmark, trust, and the guides now render at real, indexable URLs with per-page metadata and localized alternates — not hash routes.
Attestation-key rotation, an evidence hash-chain with a fork guard, and fail-closed policy enforcement across the scanner.
Credit deduction refunds on any scan failure, idempotent credit purchases, and live-registry retries — the service never silently under-delivers.
Level-1 SAST → reachability → Level-2 LLM triage, with cross-file taint stitching and a fail-safe contract: a stage that can't run reports ERROR, never a silent “clean”.
The account-less MCP server that catches AI-hallucinated packages and hardcoded secrets at generation time — published as @graneth/mcp-server.