Release Notes

​

July 2026

​

Dashboard

• Role-based access: dashboard navigation and pages now follow your role. Members no longer see admin-only surfaces (Session Replay, Agents, Team, API Keys, Registration Keys, Audit), admin pages are guarded at the route level so deep links and refreshes can’t flash restricted content, and the organization owner is now surfaced in Team settings with a Transfer Ownership action.
• Domain verification: team domains are now verified with a _turen.<domain> TXT record before they’re used for automatic org join. The Domains panel shows the exact record to create.
• Simpler first run: removed the “Get Started” onboarding flow. New users land directly on the dashboard, and navigation waits for permissions to load so you only see pages you can access.

​

Agent

See the full agent release notes for per-version detail. July highlights:

• Turen desktop app: the agent now ships with a desktop app on macOS, Windows, and Linux for viewing agent status, code-scan stats, and security settings, and for browsing and searching session transcripts locally. Sign in through the app to register a developer machine, with no registration key needed. Includes a privacy mode to pause the agent. Shipped in v0.3.0.
• New install formats: drag-to-Applications DMG on macOS, a separate Enterprise .pkg for MDM deployment, and Linux AppImage builds for x86_64 and aarch64. Shipped in v0.3.0.
• Durable Batou suppressions: batou:ignore suppressions now sync to the platform, survive agent reinstalls, and appear in the dashboard’s org-wide Ignored view. Shipped in v0.3.0.
• Dual-mode Agent Security: org-managed devices follow the org baseline with admin-controlled overridability per rule; solo devices keep full local control. Shipped in v0.3.0.
• Linux install fix: the installer now waits for the agent service to finish starting, fixing intermittent failures on fresh .deb/.rpm installs. Shipped in v0.3.1.
• Linux packaging polish: the .rpm now installs cleanly on RHEL/Fedora (no longer requires a Debian-only library), keyless Linux installs register correctly, the shell installer includes the desktop app, and the Linux app ships its real icon. Shipped in v0.3.2 and v0.3.3.
• Reliable Linux auto-updates and accurate counts: auto-updates now apply on script-installed Linux machines, Batou SAST finding counts are deduplicated in the desktop app, and the package inventory view lists your project’s own dependencies instead of your language’s global cache. Shipped in v0.3.4 and v0.3.5.
• Desktop app improvements: multi-factor (TOTP) sign-in (v0.3.2), plus a Claude Code usage and estimated-cost card and collapsible subagent threads in session replay (v0.3.6).

​

June 2026

​

Dashboard

• Skill security scanning: every custom skill now shows a security-scan verdict, with capabilities and findings explained in plain language in the skill detail view and a re-scan action. Skills that bundle executable scripts get a prominent warning, and enabling a skill with a malicious verdict requires an explicit “enable anyway” override.
• Agent Security authoring: admins can author an org-wide security baseline and choose per rule whether devices can override it locally. Solo organizations keep direct control of their own settings.
• Ignored findings view: a new org-wide view of Batou batou:ignore suppressions under Code Security, filterable by machine, scope, and category, so suppression decisions are auditable across the fleet. (Shown as a view toggle within the SAST dashboard.)
• Team domains: configure email domains for automatic org join from the new Domains panel, now located at Settings > Domains (the old /sso URL redirects).
• Fleet filter: a new “My agents / All agents” filter on the fleet page.
• LLM analytics cleanup: removed zeroed-out proxy telemetry and the defunct LLM Proxy toggle, fixed duplicate per-model bars in Requests by Model, and fixed long SAST category titles overflowing their counts.
• Removed the “Complete your setup” checklist from the dashboard.

​

Billing

• Per-agent pricing: plans are now priced per agent, at $5/agent/month or$40/agent/year. Seat changes show a cost confirmation with Stripe-previewed amounts, and make clear whether you’re charged immediately or at renewal.

​

Agent

• v0.2.1: a small compatibility update that lets 0.2.x agents auto-update cleanly to v0.3.0.

​

May 2026

​

Dashboard

• Windows (Beta) install path: the unified install flow now includes Windows with a tabbed OS switcher, offering .msi downloads for amd64 and arm64 alongside the existing macOS and Linux options.

​

April 2026

​

Dashboard

• Unified install flow with Linux beta: A new shared install component across onboarding, the Getting Started page, and the Agents page. Linux users now get a first-class path with a shell installer plus .deb, .rpm, and tarball downloads per architecture (labelled Linux (Beta)). macOS keeps the .dmg as the primary CTA. The shell snippet is pre-filled with TUREN_REGISTRATION_KEY=… when a key is available, so it’s one paste to install and register. A new “all platforms” disclosure lists every binary format the platform ships.
• Code Quality Trend replaces Detection Confidence card: The SAST dashboard’s “Detection Confidence” card conflated finding volume with confidence distribution and was easy to misread. It’s been replaced with a clearer trend view of blocked vs. warned findings over time.
• Removed entropy-detection UI: Entropy detection is no longer a live secret-scanning mode in the agent, so the related toggles and indicators have been removed from the dashboard. Pattern-based detection for AWS keys, Stripe, GitHub PATs, private keys, and other high-confidence formats remains fully active.

​

API

• Slowloris protection: API server now enforces IdleTimeout and ReadHeaderTimeout on incoming requests, closing slow-header and slow-read attack vectors against customer-facing endpoints.
• Trial auto-cancel when no payment method: If a free-trial subscription reaches its end date with no payment method on file, the subscription is now cancelled cleanly instead of attempting a failing charge. You retain read-only access and can upgrade at any time.
• GET /api/v1/agent-versions supports ?limit=N: The agent-versions list endpoint now accepts an optional limit query param (clamped to a max of 100), combinable with the existing channel filter. Existing callers without a limit are unaffected.

​

Agent

See the full agent release notes for per-version detail. April highlights:

• Linux support (GA): Turen agent now runs on Ubuntu/Debian and RHEL/CentOS/Fedora on both x86_64 and arm64, with auto-updates and rollback matching macOS. Shipped in v0.1.44.
• Windows 11 support (GA): Turen agent now runs on Windows 11 on both amd64 and arm64, installed via an Authenticode-signed .msi and registered as a Windows Service. Claude Code hooks fire on both Bash and PowerShell, and auto-updates work in place with rollback. Shipped in v0.2.0.
• Self-correcting Batou suppressions: AI coding agents can resolve Batou false positives inline with a batou:ignore <RULE> -- <reason> comment instead of pausing to ask. Bare directives (no reason) still flag for human review. Shipped in v0.1.45.
• Fewer Batou false positives: Multi-line Python suppressions match the correct line, trailing inline directives no longer extend suppression to unrelated code, and Python CLI scripts are downgraded from blocking to hint-level. Shipped in v0.1.45.
• Broader Batou taint coverage: New sinks and sources across 13 languages, including HTTP-client SSRF (Java), GraphQL resolver contexts (Java, Rust), async SQL drivers (Python), archive extraction / Zip Slip (JavaScript), SSH command exec (C++), and more.

​

March 2026

​

Batou SAST

• Real-time code scanning: Batou, Turen’s static analysis engine, scans code in real time as agents write it. Findings are surfaced inline with confidence scores and CWE classification.
• Confidence-based blocking: Blocking presets now use confidence tiers instead of severity, giving you clearer control over what gets blocked vs. warned. Configure presets from the SAST tab in Software Security.
• Finding lifecycle tracking: Every finding now tracks its lifecycle status: Active, Fixed, Suppressed, or Blocked. The Issue Resolution view shows how findings are resolved over time.
• Redesigned SAST dashboard: Scan Activity (lines scanned, avg scan time), Detection Confidence distribution, Top Active Risks, Vulnerability Categories (CWE breakdown), and Issue Resolution charts.
• Inline suppression: Developers can suppress false positives with // batou:ignore RULE-ID comments. Suppressed findings are tracked in the dashboard with their reason.
• Rule management: Disable individual SAST rules per-org from the dashboard.

​

Security

• Malware detection: PIA now identifies malware advisories (MAL-*) and automatically escalates them to CRITICAL severity (CVSS 10.0). Malware status is surfaced in the API response and dashboard.
• Password reset: Users can now reset their password via email from the sign-in page. MFA-enabled users are prompted for their TOTP code during the reset flow.
• Multiple security hardening fixes across session replay, skill uploads, policy management, and invitation handling.

​

Billing & Subscriptions

• Free trial at signup: New organizations automatically start with a 14-day free trial of the Teams plan. No credit card required to get started.
• Billing enforcement: Organizations with expired trials or canceled subscriptions are prompted to upgrade. Active trials and paid subscriptions continue uninterrupted.
• Promo codes: Promotion codes can now be applied during Stripe checkout.
• Plan upgrades: Solo plan users can upgrade to Teams directly from the billing page.
• Trial fix: New organizations on the free trial now correctly have SAST and custom skills enabled from the start.

​

Dashboard

• Feature gating by plan: SAST, custom skills, and custom rules are now gated by billing tier. Teams plan users get full access; Solo plan users see upgrade prompts.
• Package allowlist & blocklist: Manage allowed and blocked packages directly from the Events page. Block suspicious packages with one click.
• Interactive LLM analytics: The LLM dashboard is now fully interactive with clickable charts and deep-linked filters.
• Activity heatmap: Redesigned activity-by-hour heatmap with dynamic labels and a stats summary row.
• Improved onboarding: Redesigned onboarding page with trial-aware flow showing days remaining and clear upgrade paths. Onboarding completion is now persisted server-side.
• Better policy validation: Scorecard score inputs now validate properly, and the Save button is disabled when values are invalid.
• Invite flow: Redesigned authentication pages to support team invitation workflows.
• GitHub skill import: Import custom skills directly from a GitHub repository URL.
• Agent download from dashboard: The Devices page now shows a download button with the latest agent version, always pointing to the current release.
• Blocked scan visibility: Blocked scans now show all findings including any that were later suppressed, so you can see exactly what triggered the block.
• Documentation links: Quick links to documentation and help are now available in the sidebar.
• Cleaner SAST findings: Removed redundant severity badges from individual findings. Lifecycle labels (Fixed, Suppressed) are still shown.
• Multi-platform agent downloads: The agent download button now supports per-platform download links (macOS DMG, Linux tarballs).

​

Session Replay

• Faster session loading: Session content now streams with parallel chunk fetching, ETag caching, and content tickets for reduced latency on large sessions.
• Session reconciliation: Agents now reconcile session upload state on checkin, ensuring no sessions are lost if uploads are interrupted.
• Time range filter fix: Dashboard charts and session stats now correctly respect the selected time range. Previously, some views could show all-time data regardless of the filter.
• Date range filter: Filter sessions by a specific date range using the new “Between” filter with start and end date pickers.
• Subagent visibility: Subagent sessions now appear in the replay list. You can expand a parent session to see its subagents, and hour filters match across both parent and subagent sessions.
• Heatmap improvements: Clicking an hour on the activity heatmap now filters in place instead of navigating away, preserving your other active filters.

​

Agent & CLI

• Automatic updates with rollback: The agent now updates itself automatically when a new version is available. If an update fails, it rolls back to the previous working version: no manual reinstall required.
• Update channel settings: Admins can choose a release channel (production, beta, alpha), set a version offset to stay a few versions behind latest, or pin to a specific version. Configure from Platform Settings > Device Settings.
• Curated skills: Agents now receive curated skill manifests alongside custom skills during sync.
• Faster event ingestion: CLI and security events now use batch inserts for improved throughput.
• Better UTF-8 handling: Session first-prompt previews are now safely truncated at character boundaries, preventing garbled text.
• Billing enforcement for agents: Registration and session uploads now respect organization plan limits.

​

Package Intelligence (PIA)

• Malware detection: Packages with known malware advisories are flagged with has_malware: true and escalated to CRITICAL severity.
• Version range support: PIA now resolves version range specifiers (e.g., ^1.2.0, >=2.0) to concrete versions via deps.dev, improving vulnerability and license accuracy.
• Reduced log noise: Expected not-found responses from upstream APIs are no longer logged as warnings.