[ Changelog ]

What we shipped

The Hypervex shipping record — dated, specific, and honest about scope.

Repository hub, SBOM downloads, and analysis coverage

Every repository now has its own hub

Overview, code scan, dependencies and container images are tabs on a single repository page, with live status and freshness metadata showing exactly when the repo was last analysed.

Download your SBOM

The CycloneDX software bill of materials generated at index time is now browsable and downloadable from the Dependencies tab, with a searchable component inventory.

Analysis coverage on every review

Pull request pages now show which analysis layers contributed findings — the AI review, Semgrep, Gitleaks and OSV-Scanner — so you can see what ran, not just what was found.

Repo-wide scanning, container images, and fewer false positives

Full codebase scan

Scan an entire repository on demand rather than waiting for a pull request — Semgrep with IaC rule packs, Gitleaks, and OSV-Scanner across every lockfile. No AI calls in this pipeline, so cost and runtime stay bounded.

Container image scanning

Scan any publicly accessible, already-built image by reference with Trivy. Hypervex never builds images from your code.

Infrastructure-as-code review

Terraform, Kubernetes manifests and Dockerfiles are now reviewed as code, covering permissive network exposure, public storage, privileged containers and wildcard IAM policies.

Real secrets detection and dependency scanning

Gitleaks now backs secret detection, and OSV-Scanner matches lockfile dependencies against real advisories. Detected secret values are never echoed into pull request comments.

Quieter reviews

Low-confidence findings are now filtered out before a review is posted. The threshold was derived from recorded benchmark data rather than picked by feel — it removes false positives without dropping a single verified true positive in that dataset.

The Trace, verified on real code

Exploitability verification across files

The Trace — the second-pass agent that decides whether a high-severity finding is actually exploitable — was validated on a real public pull request where the answer depended on an authentication file the diff never touched. It confirmed the vulnerability and cited the file correctly.

Reviews no longer fail silently on sensitive code

When the AI declines to analyse security-sensitive content, Hypervex now retries on a second model and, failing that, falls back to deterministic scanner findings with an honest banner — instead of posting a generic error.

Claude Sonnet 5 and Opus 5

New model stack

Reviews now run on Claude Sonnet 5, with Claude Opus 5 powering the Trace. Beyond raw detection, the change made confidence scores meaningful: findings on already-fixed code now score visibly lower than findings on genuinely exploitable paths, which is what lets the Trace escalate selectively instead of investigating everything.

Hypervex

New name, new interface

CodeArmor became Hypervex, with a rebuilt dashboard, a new repositories flow, and pull request findings that surface confidence, certainty and the Trace's verdict directly on each finding.

Try Hypervex free