Changelog #0007 · July 7, 2026

# Security visibility, clearer costs, and a smoother platform

-   security
-   observability
-   billing
-   reliability

This release gives your team more to see and more to trust: clearer visibility into security findings and delivery cadence, billing that leaves nothing out, and a raft of fixes that smooth over the rough edges in everyday workflows.

## Vulnerability Dashboard

Security findings across your projects now live in one place. The new Vulnerability Dashboard, built on a dedicated data layer, gives your team a single view of where the risks are so nothing slips through the cracks. We’re rolling it out behind a feature flag for a controlled release — reach out if you’d like it turned on for your organisation.

## Deployment Frequency panel

A new Deployment Frequency panel surfaces how often you’re shipping, so you can see your delivery cadence at a glance. It’s a simple, honest signal of momentum — and a useful input when you’re tracking how your team’s flow changes over time.

## Honest pipeline status: completed with warnings

Pipelines can now finish with a **“completed with warnings”** status, distinct from an outright failure. Advisory, non-blocking steps that raise a flag no longer make a healthy deploy look broken. You get a truthful picture of what actually happened: what succeeded, what needs a look, and what genuinely failed.

Relatedly, when a security scan is configured to block deployment, a **passing** scan now correctly allows the deploy to proceed — passing checks no longer inadvertently skipped deployment when enforcement was on.

## Database password rotation

You can now rotate database passwords, so keeping credentials fresh is a routine, self-service step rather than a support request. To make that safer, newly generated passwords are now restricted to characters that are always safe inside a connection string — no more surprises from a stray character breaking your config.

## Complete billing for deleted databases

Your billing view now includes databases you’ve since deleted, each clearly marked as **“Deleted.”** Usage that happened before deletion is still accounted for, so your costs reconcile cleanly and there are no mystery gaps in the record.

## Environment variable transparency

A new API endpoint exposes the full environment variable hierarchy, making overrides visible across levels. When a value is set in more than one place, you can now see exactly which one wins and where it came from — no more guessing why a variable resolved the way it did.

## Fixes that smooth the everyday

We closed out a batch of reliability and usability issues:

-   **Custom domains now work reliably** — adding and managing custom domains no longer loses your changes, and the network access settings are clearer and easier to use.
-   **Smoother project creation** — creating a project, selecting a repository, and setting up build configuration now flow through without unexpected errors.
-   **Easier navigation** — moving between spaces and projects is more dependable, and a new breadcrumb makes it easy to see where you are and jump straight into creating a project.
-   **Safer instance naming** — underscores are no longer allowed in instance names, closing a silent hostname collision.
-   **Polished invite and input flows** — the `PillInput` experience is cleaner and the invite deletion dialog is now consistent across the product.

We also refreshed the in-product documentation to reflect these latest features.

* * *

As always, these changes are live now and require no action on your part. We’d love to hear what you think. Your feedback shapes what we build next.