Changelog

Recent updates. Newest first.

October 15, 2026

Bigger evidence sets: Folder uploads now process up to 50,000 files, and each source keeps up to 50,000 indicators. If a source goes over the limit, the upload page tells you how many were not saved. Large uploads pause briefly between batches so the browser stays responsive.
PDF text extraction: Text inside PDFs, including compressed streams, is now read in your browser. File contents still never leave your browser.
Folder drop fix: Dropping large folders in Chrome now picks up every file, not just the first batch.
IP location lookup (Alpha Access): A "Look up IP location" button in the indicator details shows the registry country and network name. It's off unless you click it. Only that IP is sent to public registry (RDAP) servers. Private and reserved addresses are never sent, and results are cached.
Drag-and-drop folders: Drop a directory onto the evidence page to analyze all files inside (not just ZIP archives). A "Choose folder" button also appears next to the file picker.
Case delete UX: Deleting a case now redirects to the dashboard with a confirmation message instead of staying on the empty case page.

In-app notifications: Bell icon in the header shows unread notifications. Get notified when someone replies to your forum thread, and when security events happen (login, lockout, MFA changes). Preferences at /notifications.
Homepage demo: "Try it now" section on the homepage lets you drop a file and see extracted indicators without signing up. Nothing leaves your browser.
Timestamp display fix: Missing or invalid timestamps now show "no timestamp" instead of nonsense dates.
Unique indicator counts: Per-type indicator counts now show unique values, not duplicates across sources.
Extraction improvements: Version numbers inside user-agent strings are no longer extracted as IPs. Empty-file hashes are suppressed.

Scheduled backups: Daily encrypted backups run automatically. Data is encrypted with a public key before upload; the private key is held offline. Supports compliance retention requirements (CP-9, AU-9).

Audit review (admins): Weekly audit summary with security flags, anomaly alerts for suspicious activity (failed logins, MFA resets, new admin fingerprints), and a review workflow for compliance (AU-6).
Error monitoring: Sentry integration for both API and frontend. Errors are tracked without sending user data.

User content terms: Terms of Use updated with community rules for forum posts (content license, prohibited content, moderation, reporting).

Indicator browser: Full-page indicator browser with filters (type, common/private, notable, date range, flags), sorts, and bulk "mark common" actions. Access via "Browse all indicators" on any case.
Hide common indicators: Mail-server IPs, CDN hosts, and common platform domains are hidden by default. Toggle in the case view or manage your list at /common-indicators.
Cross-case links: See which indicators appear in multiple cases. The case page shows "Also seen in N other cases" and /link-analysis has a cross-case graph.
First/last seen timestamps: Each indicator shows when it was first and last seen across your sources.
Detail panel: Click any indicator row for enrichment (IP geolocation hints, email/domain flags, user-agent parsing, MAC vendor lookup).
Context snippets (opt-in): Check "Also save short context snippets" when uploading to store a few characters around each indicator. Helps remember why something was flagged.
Archive unpacking: ZIP, TAR, and GZIP archives are unpacked recursively in your browser. Nested files become separate sources linked to their parent archive.
Photo GPS extraction: JPEG/TIFF EXIF GPS coordinates are extracted as geo indicators. Skip with the checkbox if you prefer.
Gumshoe Terminal: Three interactive detective stories (noir, cyberpunk, fantasy) playable at /games/. Progress saves when signed in.

v2 launch: Complete rebuild. Static Pages frontend, Worker API, D1 database storing identifiers only. Documents you analyze never leave your browser; only extracted identifiers are saved.
MFA support: TOTP-based two-factor authentication. Enable it in /security.
Session policy: Idle timeout warnings, per-session revoke, system-use banner at sign-in.
Indicator encryption: Indicator values encrypted at rest with AES-256-GCM. Search uses blind indexes.
Honest labels: Every tool now carries a maturity label (Stable, Beta, Demo, Planned). See the /roadmap for what is not built yet.

For the full technical log, see CHANGELOG.md in the repository. Earlier changes are in PROGRESS.md.