What's new

Shipped features and fixes, newest first.

August 7, 2026

  • The optional "decode obfuscated encodings before analysis" setting (Dashboard → Settings) now also covers Morse code, alongside ROT13, Base64, hex, and URL-encoding. Fixed a bug where a single malformed or unrecognized character partway through an encoded message could cause the whole message to skip decoding instead of just that character.
  • Agentic session protection now covers Google Gemini too, alongside Claude Code, Grok, and OpenAI. Save your Gemini key in Dashboard → Settings, point `OPENAI_BASE_URL` at the new `/v1/gemini` endpoint (Gemini's OpenAI-compatibility mode), and tool results get the same automatic scanning as every other provider. Documented in the integration docs' Grok, OpenAI & Gemini agentic session protection section.

August 6, 2026

  • Published a new Security & Trust page (linked in the footer) describing our actual security and privacy practices in plain language — encryption in transit and at rest, security headers, rate limiting, automated backups, and how we handle your data. We're upfront that we haven't completed a formal third-party compliance certification yet, and that independent penetration testing is on our roadmap.
  • Added a way to book a direct consultation call about Enterprise setup, SLAs, or dedicated infrastructure — available from the Support page.
  • Cleaned up the footer: Privacy Policy, Terms of Service, Refund Policy, Accessibility, and the new Security page are now grouped under a single "Legal" menu instead of crowding the page.
  • Fixed a display bug where the dashboard's left sidebar could overlap the footer, making the copyright text hard to read.

August 5, 2026

  • Updated our Terms of Service to add a Dispute Resolution section (binding arbitration and a class action waiver) and clearer API key rules (keys are non-transferable, and the registered owner is responsible for all activity under a key — rotate immediately from Dashboard → API Keys if one is ever exposed). Because this is a material change, you'll see a one-time prompt to review and accept the updated terms the next time you sign in.
  • Deleting your account from Settings → Danger Zone now permanently erases your data immediately — API keys, usage history, and everything else tied to your account — instead of just deactivating it. Added a confirmation step (type "I understand") since this can no longer be undone.
  • Fixed the updated-terms review prompt above: clicking through to actually read the Terms of Service showed the same prompt on top of the terms themselves, making them unreadable before you'd already agreed. The prompt now steps aside on the Terms of Service page so you can read before accepting.

August 4, 2026

  • Agentic session protection now covers Grok (xAI) and OpenAI, not just Claude Code. The same automatic tool-call scanning — scrubbing tool results before your model sees them, never hard-blocking your session — is now available for any OpenAI-SDK-compatible client. Save your xAI or OpenAI key in Dashboard → Settings, point `OPENAI_BASE_URL` at the new `/v1/grok` or `/v1/openai` endpoint, and you're covered. Documented in a new Grok & OpenAI agentic session protection section of the integration docs.
  • Expanded internal request telemetry across every endpoint — embedding time, vector-search time, upstream time-to-first-byte, and more, broken out individually instead of folded into one opaque latency number. Lets our team pin down exactly where a slow or failed request spent its time when you reach out for support, instead of guessing.
  • Added a Discord server as a new way to reach us for support, alongside email and Slack — find the link on the Support page.
  • Published a Refund Policy and an Accessibility Statement, linked in the site footer alongside our existing Terms of Service and Privacy Policy.

August 3, 2026

  • Added a Reliability setting (Dashboard → Settings) letting you choose Fail Open (default) or Fail Closed for the rare case a scan can't complete in time. Responses now also carry a `degraded` flag and `degraded_reason` so you can tell "blocked because of a real threat" apart from "blocked because the scan itself failed." Documented in a new Reliability & fail-open behavior section of the integration docs.

August 1, 2026

  • Added a new opt-in Settings toggle, Log Neutralized & Blocked Requests, so you can review — and CSV-export — the content Sentinel rewrote or withheld on your behalf. Off by default, and entries auto-delete after 30 days.
  • Fixed a scope bug where Community Training could pick up neutralized and blocked tool results from agentic proxy traffic, not just the uncertain "flagged" ones the feature is meant for. Only flagged content has ever been used to review new detection signatures; the extra captured rows have been deleted.
  • Corrected a few inaccuracies in the Support FAQ: the self-hosted answer now reflects the actual Enterprise dedicated/on-prem offering rather than implying a public download, the coding-agent question now links to the Clawhub skill, and the storage and response-modification answers now match actual behavior.

July 31, 2026

  • Added a dedicated Support page with two ways to reach us — email or Slack — linked from the footer and dashboard. The header's Slack link was removed in favor of this single Support entry point.
  • The Support page now has a searchable FAQ covering getting started, detection behavior, billing, integrations, privacy, and troubleshooting, with the same sidebar navigation as the Integration Guide.
  • Corrected the rate limits shown on the pricing page, which had been showing outdated numbers for every plan.

July 30, 2026

  • Tuned detection to stop flagging ordinary technical content — file listings, log output, and similar structured text — that was occasionally scoring as suspicious purely from having a lot of varied characters packed together, not from anything actually resembling an attack.

July 29, 2026

  • Sentinel's secret detector now recognizes a much wider range of credential formats in prompts and outputs: PEM and SSH keys, database connection strings, the rest of the GitHub token family, JWTs, Basic Auth headers, and several vendor-specific token shapes it used to miss entirely.

July 28, 2026

  • Closed a gap where files inside vendored or dependency directories (node_modules, vendor, and similar) were getting an unwarranted trust discount in risk scoring, the kind of blind spot that let last year's Axios supply-chain compromise slip past similar tools.

July 27, 2026

  • Sentinel moved to its own dedicated home at sentinelaifirewall.com, dashboard and all. If anyone hit a broken dashboard right after the move, that's fixed, a one-time migration hiccup with no data ever at risk.

July 25, 2026

  • Neutralize now does what the docs always said it should: redact the risky part and let the rest of the request through, instead of blocking the whole thing outright.

July 24, 2026

  • SlopScan (package-hallucination detection) is live as a Pro+ add-on.
  • A round of detection-accuracy tuning based on real incident research went out across the board.