Supply-chain security and tighter login controls

This release is about knowing exactly what you ship and controlling exactly who gets in. Every deploy now produces a verifiable inventory of what’s inside it, builds run with a safer default, and you can restrict access to the people who belong in your organisation.

Know what you shipped: deploy-time SBOM generation

Every deployment now generates a Software Bill of Materials (SBOM) at deploy time — a complete, verifiable inventory of the components that make up what you shipped. When a new vulnerability surfaces in the wild, you no longer have to guess whether it affects you. You can look at exactly what went out, in which release, and respond with confidence rather than speculation.

This is the foundation that security and platform teams need for real supply-chain visibility, and it happens automatically on every deploy — nothing to configure.

Restrict sign-in to your GitHub organisation

You can now require that anyone signing in to Salus is a member of your GitHub organisation, and present a streamlined, GitHub-only login experience to match. Access follows your existing org membership, so people who leave the organisation lose access to Salus at the same time — no separate list to keep in sync, and one less way for stale access to linger.

Reliability under the hood

We also completed an upgrade to the pipeline infrastructure that runs your builds and deployments, moving it onto a current, fully supported foundation. There’s nothing to change on your end — this keeps the platform steady and sets us up to ship pipeline improvements faster.

---

As always, these changes are live now and require no action on your part. We’d love to hear what you think. Your feedback shapes what we build next.