> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/changelog.md). # Changelog What's new in DevArmor, month by month. This page tracks what's new in DevArmor — new capabilities, meaningful improvements, and notable fixes. It doesn't cover every internal change, just what affects your day-to-day experience. ## September 2026 **New** * You can now connect DevArmor's AI assistant integration to the ChatGPT desktop app, in addition to other supported AI assistants. Combined with the guided threat-modeling workflow and full threat-model browsing added over the summer, you can now create a threat model, check its architecture and findings, and get a summary of remaining action items — all from your assistant of choice. * AI Guardrails rules can now be scoped to a specific threat model, threat-model version, or design review, and filtered accordingly — and you can open a pull request directly from a guardrail rule run without leaving DevArmor. *Related: Security policies, Code Review.* * You can import GitHub Wiki pages as a documentation source for threat models and design reviews, alongside Confluence, Google Docs, and Jira. *Related: Confluence integration, Google Drive integration.* * You can scope a scan to a specific subfolder of a connected repository instead of always importing or reviewing the whole codebase. * Jira tasks and epics can now be pulled in directly as a data source when setting up a threat model or design review, and "Push to Jira" now shows your organization's custom Jira fields and issue types that require them, so pushes no longer fail on missing custom fields. **Improved** * Jira and Confluence linking got faster: type-ahead search when linking issues, project search by name or key, and clearer errors on mismatched or missing permissions. ## August 2026 **New** * Added support for signing in with OneLogin single sign-on (SSO), joining Okta, Microsoft, and Google. *Related: Okta SSO, Microsoft sign-in.* * You can now attach memory sources — Confluence pages, Google Docs, Jira issues — to a project the moment you create it, and manage a project's connected memory sources directly from project settings, including turning memory use on or off per threat model or design review. *Related: Organizational Memory (July 2026), Confluence integration.* * Confluence pages can now be added as a document source, and admins are alerted when a Confluence connection is missing required permissions so they can reapprove access in time. * DevArmor now shows whether a project's memory will actually be used for a given build, with an explanation when it won't — so there are no surprises about what context went into a result. * Diagram uploads now accept PDF files, and architecture generation from documents now takes diagrams and visuals in the file into account, not just the text. **Improved** * Security design reviews started from a Jira epic now automatically pull in its related sub-tasks and child issues, not just the top-level ticket. * Tasks now show a clear status (to-do, in progress, done) and a priority aligned with Jira's scale, and stay in sync automatically when the linked Jira issue's title, priority, status, or labels change. * Only organization admins can install or remove integrations, and any team member — not just admins — can now view the org's user list. * Repositories linked to a project are now shared across threat-model versions instead of duplicated per version. ## July 2026 **New** * Launched AI Guardrails — generate and manage AI coding-assistant rule files (for tools like Cursor and Augment Code) directly from your security policies, and browse a repository's files and folders when setting up a rule. *Related: Security policies, Code Review.* * Launched DevArmor's AI assistant / MCP integration — create a threat model and check its architecture, findings, and progress directly from your AI assistant, with a guided end-to-end workflow that summarizes remaining action items. * Introduced Organizational Memory — DevArmor now retains and reuses your organization's accumulated context (shared notes, business context) across projects and threat models, with a browsable version history. *Related: memory controls added in August.* * Added an API Tokens section in Settings so you can generate and manage tokens for programmatic access to DevArmor. *Related: MCP / AI assistant integration.* * Added a Version Diff view to compare two versions of a threat model side-by-side, showing exactly which threats, controls, and risks changed. * You can now re-run a pull request's security review at any time by commenting "@devarmor review" on it, and DevArmor reacts with an emoji to acknowledge a review request before starting. **Improved** * Pull request review comments got a significant readability upgrade: a plain-English summary of the changes, clearer impact explanations, fix guidance that includes a code example, and each control's status/impact/remediation shown together (with irrelevant checks hidden). * Architecture generation from code can now cover multiple linked repositories at once, modeling how they connect as a single system. * Threats and attack patterns now show related MITRE ATT\&CK techniques and tactics for deeper context. *Related: STRIDE categorization, Attack Surface Analysis report.* * Suggested penetration tests now specify exactly which system component they target. * Pull requests now show a DevArmor status check directly in GitHub reflecting the review result, and results post as a single consolidated comment. ## June 2026 **New** * Organizations can now upload, replace, and remove their own logo in DevArmor. * Security controls can now be mapped to multiple relevant compliance requirements, and you can browse the complete list of supported compliance controls and frameworks when mapping — not just ones already in use. *Related: Attack Surface Analysis report.* * You can generate architecture diagrams at the project level, not just within a single threat model, and choose to reuse the architecture from a version's base when creating a new version. **Improved** * The threat-model analysis report was redesigned with a reorganized structure, new charts, updated styling, and a system architecture diagram included directly in the report. * DevArmor now requests read-only, reduced-scope access to Google Drive when you connect your account, instead of full read-write access — fewer permissions requested for the same functionality. * GitHub integration setup no longer requires manually typing your organization name; it's detected automatically during installation. Removing the GitHub integration now also cleanly uninstalls the DevArmor app from your GitHub organization. * Code review now only applies security controls from officially active policies, ignoring drafts. **Improved / Trust & Safety** * Uploaded files that could run as active web content (like HTML or SVG) are no longer accepted, to keep uploads safe. * Documents imported from Google Docs now keep a link back to the original source document. ## May 2026 **New** * Design reviews can now automatically interpret uploaded architecture and data-flow diagrams, and take previously uploaded diagrams into account when generating recommendations. *Related: diagram-to-architecture conversion (March 2026).* * Design reviews can now be created and viewed directly from within the Google Docs add-on, matching the existing threat-model workflow. *Related: Google Drive integration.* * Threat-model reports can now be generated and downloaded as a PDF, and exported directly from a project without needing to reference a specific version. * Diagrams uploaded to a project now automatically generate the architecture's trust boundaries. **Improved** * Recommended tasks and controls now clearly identify the single security control that justifies them, and show which related components and threats they connect to — instead of a long, unfocused list. * Deactivated users are now consistently blocked from taking any action in the product, closing a gap in access control. * Improved the layout and readability of the Attack Surface Analysis report, including clearer category names. * Creating a new threat-model version now automatically carries over its description from the version it's based on. ## April 2026 **New** * Launched Attack Surface Analysis — a report that translates identified threats into a prioritized, ready-to-work set of engineering tasks. *Related: MITRE ATT\&CK mapping, compliance control mapping.* * Reports can now be exported directly to Google Docs, with control over which Google Drive folder they're saved to. * You can now create a security policy that spans multiple threat-model versions, and delete an entire threat model (not just a single version of it). **Improved** * Connecting a Google account now happens through a pop-up window instead of a full-page redirect. * Trying to delete a resource that other items depend on now tells you exactly what those dependent items are, across the product. * Architecture information gathered from code, uploaded diagrams, and documents is now combined automatically into one coherent, consistent view everywhere it's shown. * A threat model's information now includes a list of all its versions, and you can manage which code repositories are linked to a specific version. * Diagrams generated from architecture images are now more accurate and complete. ## March 2026 **New** * You can now upload an image of an architecture diagram — including a photo or scan — and have it automatically converted into an editable digital diagram, processed in the background. *Related: automatic trust-boundary generation (May 2026).* * Every identified threat is now categorized using the industry-standard STRIDE framework. *Related: MITRE ATT\&CK mapping (July 2026).* * Projects can now contain multiple threat models, instead of just one, and creating the first version of a threat model no longer requires specifying a base version to copy from. * Rule files for AI coding assistants can now be generated for a specific design review, in addition to an overall policy. *Related: AI Guardrails.* * Added user roles, including a safeguard that prevents the last remaining admin from removing their own admin access. * Added a Report gallery for browsing generated report artifacts, and a dedicated Settings page with tabs including Reports. **Improved** * You can now create and manage custom rules that guide DevArmor's automated design reviews. * Risk scores and severity levels for findings are now calculated consistently using a defined formula. * The Members page now shows your organization's real user data. * Added a Mermaid diagram editor for directly editing a diagram's underlying code, with zoom, pan, and click-to-navigate between a diagram and its related table rows. ## February 2026 **New** * Threat-model reports now include an AI-generated executive summary, summary statistics (documents and diagrams reviewed, threats/controls/risks identified), and can include a generated Privacy Impact Assessment. * Diagrams now display trust-zone information for their elements, with clickable references to related items — and threat findings now indicate which architecture components each threat affects. * Added a dedicated Policies page, with each policy showing its current status. * Policies can now be given a status and snoozed until a future date. **Improved** * GitHub integration error handling throughout the connection flow now shows clear, specific messages (invalid organization, insufficient permissions, reconnection issues) instead of generic failures. * The Report page now has a collapsible summary with a copy-to-clipboard button, and lets you show or hide individual sections. Report tables let you show, hide, reorder, and resize columns and rows. * Redesigned the Threat detail view. ## January 2026 **New** * Added dashboard tiles and charts summarizing your organization's threat models and design reviews. * Introduced the foundation for AI Guardrails: generate rule files for AI coding assistants like Cursor and Augment Code directly from a security policy. *Related: AI Guardrails (launched July 2026).* * Added a built-in Customer Support portal, plus "Contact Support" and "Share Feedback" links in the navigation. * Added support for signing in with your Microsoft account, alongside existing sign-in options. *Related: Okta SSO, OneLogin SSO (2026).* * Threat-model architecture can now be automatically generated by analyzing uploaded documents, and works even for repositories without a GitHub integration installed, by falling back to public access. **Improved** * Design reviews can now be linked to their associated documents and code repositories, and pushing a task to Jira now includes a link back to view it directly in Jira. * Jira and Atlassian integrations now show a "stale" status if they stop receiving updates for more than 15 minutes. * Increased the size of code and documents that can be analyzed without hitting input limits. * Added pagination, filtering, and sorting to tables throughout the app, and made the Data Sources table fully drag-and-drop enabled.