Product Updates

Changelog

What's new in Pullminder. Follow our progress as we build the verification layer for AI-assisted code.

System Map (Phase 1)

Feature
  • Pullminder now builds a code-derived dependency map of your repository: modules, datastores, queues, external APIs, and services — all from repository analysis and connection-string heuristics.
  • When Collective Memory is enabled, incident counts overlay onto the graph as heat, so you can see which parts of your architecture have been most trouble-prone.
  • Per-PR blast radius shows which downstream modules are affected by a change, surfaced in the analysis output alongside the risk score.
  • New pullminder map CLI command outputs the local working-tree graph in text, JSON, or DOT format. No backend needed.
  • Opt-in per repository, off by default. Code is fetched transiently and deleted; only derived metadata persists. Secrets are never stored.

System Map (Phase 2): Org-wide aggregation

Feature
  • Org-wide stitching merges opted-in repositories into a single dependency graph. Shared datastores and queues collapse into one node visible across the org.
  • Org dashboard view shows the stitched graph with repo-clustered layout. Click a shared node to see which repos touch it.
  • Cross-repo blast radius in PR comments lists downstream repos that depend on changed shared infrastructure alongside the existing per-repo blast radius.
  • Privacy-safe identity matching uses HMAC-SHA256 with a per-org salt. Raw internal hostnames are never stored or transmitted.
  • Per-repo consent: a repo appears in the org map only when its System Map toggle is enabled independently. No org-level toggle.

Red-Flagging: recurrence signals

Feature
  • Risk now rises when a change repeats the kind of problem a file had before, for example touching SQL in a file whose past incidents were SQL injection.
  • On paid plans, Pullminder asks a model whether a change risks repeating a specific prior incident on a troubled file, and shows the reason in the Red-Flag block.

Risk Red-Flagging

Feature
  • Pullminder now raises a pull request’s risk score when it touches files that have broken before, weighted by how recently the last incident happened.
  • Author context adds a flag when someone changes a fragile file for the first time, or when a large change ships from a single author with no second reviewer.
  • A new Red-Flag section on the PR comment lists the top reasons with links to the prior incidents. High risk can fail the check, tuned per repository, with a pullminder-risk-ack label override recorded in your audit log.

Collective Memory

Feature
  • Pullminder now remembers a file’s troubled past, reverts, hotfixes, churn, and recurring findings, and surfaces it in the PR comment so reviewers see what broke before in the same files.
  • A dashboard analytics page adds per-repo trend charts and an org-wide troubled-files view.
  • Opt-in per repository, display-only, and minimal-data: file-path metadata and aggregate counts only, no source code or diff content stored.

Editor LSP Server

Feature
  • New pullminder lsp command brings the CLI to 13 top-level commands. Starts a stdio Language Server that any LSP-capable editor can attach to — VS Code, Neovim, Helix, Zed, and JetBrains via plugin.
  • Findings appear as inline diagnostics, with rule descriptions on hover and a “disable rule for this line” quick fix.
  • Reads .pullminder.yml from the workspace folder advertised by the editor, with the current working directory as a fallback — the same configuration the rest of the CLI uses.

CLI Launch & Rule Pack Registry

Feature
  • Full CLI with 12 top-level commands: init, auth, check, ci, diff, score, brief, hooks, packs, rules, registry, and config.
  • Offline local scanning with pullminder check — run 25 rule packs with 210+ detection rules locally without sending code to any server.
  • CI-optimized analysis with pullminder ci — auto-detects GitHub Actions, GitLab CI, CircleCI, Jenkins, and Bitbucket Pipelines.
  • Multiple output formats: JSON, SARIF v2.1.0, JUnit XML, GitHub annotations, and AI-agent optimized output via the --agent flag.
  • 11 language security packs: Go, Python, React, Ruby, PHP, Rust, Java, C#, Kotlin, Swift, and Shell.
  • Git hook installation via pullminder hooks with Husky and Lefthook detection for pre-push and pre-commit workflows.
  • Community pack publishing with pullminder rules publish — validate, test, and submit packs to the public registry via GitHub PR.
  • OpenTelemetry integration for CLI telemetry with opt-out consent manager.

Dashboard Improvements

Enhancement
  • Premium rule gating with source badges, lock indicators, and tier upgrade flow from community to premium packs.
  • App version display in the sidebar footer for easier support and debugging.
  • Refreshed UI copy across onboarding, empty states, tooltips, and error messages.

PR Comment Redesign

Feature
  • New PR comment format with progressive disclosure: risk score badge, findings summary, coverage delta, and reviewer brief — all in a single structured GitHub comment.
  • HMAC-signed badge URLs for tamper-proof inline SVG badges (risk score, findings, coverage, policies).

Framework Detection & Rule Packs

Feature
  • Automatic framework detection for repositories (Go, React, Node.js, Python, etc.).
  • Pre-built rule packs per framework with one-click enable/disable.
  • Deep tree scanning for monorepo framework detection.

Baseline Scanning

Feature
  • Scan all repos for baseline risk assessment.
  • Risk trend recording against baseline.
  • Paginated baseline reports in dashboard.

Analytics & Coverage

Enhancement
  • Risk trend charts (7-day / 30-day configurable).
  • Top risk categories breakdown.
  • Reviewer activity leaderboard.
  • Coverage trend tracking with delta analysis.

Security Hardening

Security
  • Field-level encryption for sensitive data (webhook URLs, tokens).
  • Session inactivity timeout (30 minutes).
  • Rate limiting with Redis backend.
  • /metrics endpoint bearer token auth.

Dashboard Quality

Enhancement
  • TanStack Query migration for server state.
  • Unit test suite with MSW mocks.
  • Code splitting with lazy routes.
  • Mobile-responsive navigation with bottom nav.

Stay updated — follow our progress

Get started with Pullminder and see how AI-powered PR verification works for your team.

Start Free Trial