Skip to content
LeavoryLeavory Docs

What's new

Since January 2026 the Leavory team has been building a single engineering governance portal: what exists, who has access, how teams deliver and how much risk each project carries, starting with Azure DevOps.

Milestones

Section titled “Milestones”
When Milestone
Jan–Jul 2026 Foundation: automatic Azure DevOps discovery and the structure for multiple organizations
Aug 2026 Inventory and quality: the Workspace maps engineering and consolidates security and code quality
Sep 2026 Production: registries, Dockerfiles and Kubernetes clusters join the same portal
Oct 2026 Open platform: Workspace subscription, AI assistant, Leavory Hub and the free entry points

October 2026: platform open to the market

Section titled “October 2026: platform open to the market”

Workspace

  • GitHub (Oct 18): connect a GitHub organization alongside Azure DevOps, or on its own. Repositories, branches, technologies, packages and their vulnerabilities land on the same Code & Pipelines screens. See Connect GitHub.
  • Exportable inventory (Oct 9): each project’s repositories and branches as CSV, with a branch filter.
  • Latest run per branch (Oct 11) on repository and project pages.
  • Administration by the organization owner (Oct 13): each owner manages only their own organizations.
  • Workspace subscription (Oct 15): access per organization, with seats defined in the plan and the authenticator asked on every entry.
  • Ask Leavory (Oct 15): an AI assistant that explains vulnerabilities and what to change first.
  • New look (Oct 13–16): every screen on the Leavory Design System.
  • Vulnerabilities screen and runs per branch (Oct 17), showing what came in and went out between runs.
  • Session limits (Oct 17): sessions expire after 30 minutes of inactivity or 8 hours after sign-in.

Entry points

  • Leavory Hub (Oct 14): one account, with a work email and an authenticator, gives access to every product at hub.leavory.com.
  • Free Image Scan (Oct 14): up to 5 images, public or private, scanned daily with no time limit.
  • Keycloak analyzed (Oct 14): a public, up-to-date analysis of the Keycloak images, to see Leavory with real data.

Security Gate: the remediation policy becomes a pipeline rule

  • Exposure Age (Oct 11): the publication date of each CVE and how many days it has been exposed in your code.
  • Leavory Security Gate step (Oct 12): fails the build when a CRITICAL or HIGH CVE is past its deadline, from a public image on Docker Hub.
  • Signed date database (Oct 12), updated daily from NVD, CVE.org, GHSA and OSV.
  • Access token (Oct 13), with a daily limit and rotation without stopping pipelines. See Create the token.

Platform

  • Hardened images (Oct 12): every Leavory service runs on Docker Hardened Images.
  • This guide, Leavory Docs (Oct 17).

September 2026: production in the same portal

Section titled “September 2026: production in the same portal”
  • Kubernetes (Sep 13): each cluster’s findings, sent by the Leavory Deployment Scanner.
  • Container Registry (Sep 23): registry images scanned, with a history of each version (Sep 24) and CSV export (Sep 25).
  • :latest images tracked (Sep 23): when a new version comes out, it is scanned the same day and the previous one stays in the history.
  • Email alerts (Sep 25) with the results of the Container Registry’s automatic scans.
  • AWS ECR (Sep 25) among the accepted registries.
  • Dockerfile tab (Sep 28): each pipeline’s base image is scanned.
  • SBOM-based scanning (Sep 29): images aren’t kept on disk; Leavory scans the package inventory.
  • Exploited vulnerabilities (Sep 30): CVEs in the CISA KEV catalog, with confirmed active exploitation, are highlighted in the Container Registry.

August 2026: inventory and quality

Section titled “August 2026: inventory and quality”
  • Automatic Azure DevOps discovery (Aug 1): projects, repositories and pipelines mapped without manual setup.
  • Isolation between organizations (Aug 2): one organization’s data and load don’t affect the others.
  • Leavory’s own vulnerability database (Aug 2), with NVD, OSV and exploit probability (EPSS).
  • Sonar (Aug 3): static analysis with custom Quality Gates and a results dashboard.
  • OWASP Top 10 (Aug 24) per repository.

January to July 2026: the foundation

Section titled “January to July 2026: the foundation”

The Leavory team started the product in January. In those months it built the base on which everything that came after was delivered:

  • Azure DevOps discovery, which reads an organization’s projects, repositories and pipelines;
  • reading pipeline results, including security scans;
  • the structure to serve multiple organizations in the same product.

That base was in place by August 2026, when the Workspace started gaining new features every week.