Security visibility, clearer costs, and a smoother platform

This release gives your team more to see and more to trust: clearer visibility into security findings and delivery cadence, billing that leaves nothing out, and a raft of fixes that smooth over the rough edges in everyday workflows.

Vulnerability Dashboard

Security findings across your projects now live in one place. The new Vulnerability Dashboard, built on a dedicated data layer, gives your team a single view of where the risks are so nothing slips through the cracks. We’re rolling it out behind a feature flag for a controlled release — reach out if you’d like it turned on for your organisation.

Deployment Frequency panel

A new Deployment Frequency panel surfaces how often you’re shipping, so you can see your delivery cadence at a glance. It’s a simple, honest signal of momentum — and a useful input when you’re tracking how your team’s flow changes over time.

Honest pipeline status: completed with warnings

Pipelines can now finish with a “completed with warnings” status, distinct from an outright failure. Advisory, non-blocking steps that raise a flag no longer make a healthy deploy look broken. You get a truthful picture of what actually happened: what succeeded, what needs a look, and what genuinely failed.

Relatedly, when a security scan is configured to block deployment, a passing scan now correctly allows the deploy to proceed — passing checks no longer inadvertently skipped deployment when enforcement was on.

Database password rotation

You can now rotate database passwords, so keeping credentials fresh is a routine, self-service step rather than a support request. To make that safer, newly generated passwords are now restricted to characters that are always safe inside a connection string — no more surprises from a stray character breaking your config.

Complete billing for deleted databases

Your billing view now includes databases you’ve since deleted, each clearly marked as “Deleted.” Usage that happened before deletion is still accounted for, so your costs reconcile cleanly and there are no mystery gaps in the record.

Environment variable transparency

A new API endpoint exposes the full environment variable hierarchy, making overrides visible across levels. When a value is set in more than one place, you can now see exactly which one wins and where it came from — no more guessing why a variable resolved the way it did.

Fixes that smooth the everyday

We closed out a batch of reliability and usability issues:

• Custom domains now work reliably — adding and managing custom domains no longer loses your changes, and the network access settings are clearer and easier to use.
• Smoother project creation — creating a project, selecting a repository, and setting up build configuration now flow through without unexpected errors.
• Easier navigation — moving between spaces and projects is more dependable, and a new breadcrumb makes it easy to see where you are and jump straight into creating a project.
• Safer instance naming — underscores are no longer allowed in instance names, closing a silent hostname collision.
• Polished invite and input flows — the PillInput experience is cleaner and the invite deletion dialog is now consistent across the product.

We also refreshed the in-product documentation to reflect these latest features.

---

As always, these changes are live now and require no action on your part. We’d love to hear what you think. Your feedback shapes what we build next.