Skip to main content

Changelog

User-facing changes to Hyrax — things you'd notice in the product.

August 16, 2026​

  • Your remaining credit is in the top bar, on every plan. Free workspaces hold real spending credit — a one-time signup credit plus a monthly one — but the top-bar figure only ever appeared for paid workspaces, and Free's Settings → Plan showed the plan picker with no balance on it. Both now show what you have left ("$29.04 credit left", or "No credit left" when it runs out). It's a remaining balance rather than the paid plan's "$12 of $30" ratio: your signup credit and your monthly credit are one pool, not a countdown to a renewal date. See Plans & pricing.
  • Connecting a GitHub organization drops you straight into your new workspace. Finishing the connect could land on a "Hyrax is not configured" screen for a workspace that had just been created successfully — a refresh fixed it, but nothing said so. It doesn't happen any more, and if a workspace ever can't be loaded the screen now re-checks by itself and offers a retry instead of a dead end. Accepting an invitation had the same rough edge and is fixed with it. Connecting also shows a proper progress indicator now — setting up a workspace takes a few seconds and the button used to look inert while it worked.

August 11, 2026​

  • Two plans: Free and Paid, and Paid is priced per seat. Hyrax used to have three plans — Free, Pro, and Team — at a flat price each. It now has two, Free and Paid, and Paid costs $30 per seat, per month, with every dollar of the subscription coming back as spending credit for that month. No feature is withheld by plan: every workflow, the workspace audit log, Virtual Patches, the Todo list and notifications feed, and programmatic access through the REST API and the MCP server run on both, and repositories are unlimited on both. Anything earlier on this page described as a Pro or Team feature is now on every plan. Members are unlimited on Free; on Paid each member occupies a purchased seat, which you can add to or reduce yourself from Settings → Plan. Pro and Team are no longer offered; workspaces already on one keep everything they had, on the terms they signed up under. See Plans & pricing and Seats.

August 8, 2026​

  • Every plan now gets both audit depths, and the Mini audit is gone. The audit used to come in three depths that followed your plan. It now comes in two — the Standard audit and the Full audit — and both run on every plan, including Free. The Mini audit, a capped quick pass that only existed as Free's substitute, has been retired: with the real audits available to everyone there was nothing it was better at. What bounds your usage is your workspace's credit, not your tier. See Workflows and Audit depth.
  • Connecting a repo starts PR review, not an audit. New repositories arrive with pull request review switched on, so Hyrax starts working on the pull requests you open without you configuring anything. Your first repository still runs Discovery automatically to learn the codebase; audits are now always something you choose to run. Repositories you add later don't run Discovery on their own — start it from the repo's Discovery tab when you're ready (an audit needs it first). Public repositories added by URL are the exception: they always run Discovery, because without the GitHub App there are no pull requests for Hyrax to review.
  • API note. mini_audit is no longer a valid workflow value and returns 422. Use standard_audit or audit. See the API reference.

July 23, 2026​

  • Findings Hyrax can't fix now wait for your review — nothing is silently dropped. When automatic fix attempts are exhausted, a finding no longer disappears as "abandoned"; it stays open and moves into a needs-review lane on the Findings tab with clear next steps — dismiss it, mark it addressed, or try one more attempt. Cancelled fixes and infrastructure hiccups (a build/CI blip on our side) no longer count against a finding's attempt limit, so a finding whose only failures were noise stays freely retryable. See Findings.

  • When Hyrax thinks a finding is a false positive, it tells you. If the fix agent repeatedly concludes there's nothing to change, the finding is flagged as a suspected false positive — with the agent's reasoning shown inline — and you decide: Confirm false positive (dismiss it), Keep open (you disagree; it stays a real issue), or Try one more attempt. Hyrax never auto-dismisses it for you.

  • Notifications in the top bar. Pro and Team workspaces get an in-app notifications feed: the bell in the top bar now shows what happened in your workspace — a finished audit, a merged fix pull request — with an unread badge and a quick preview of recent items; opening an item marks it read. The Todo list moved to its own button beside the bell, which shows your open count and takes you straight to the Todo page. (This supersedes the July 10 note below about what the bell shows.) See Todo & notifications.

July 10, 2026​

  • A Todo for your workspace. Pro and Team workspaces get a Todo page — a prioritized list of what needs attention across your repos, from onboarding gaps and stale audits to unaddressed critical findings and stale fix PRs — each item with a one-click action. A Todo button in the top bar shows your open count and takes you to the list from anywhere in the app. See Todo & notifications.
  • Every resolution in one place. Each repository's Completed tab is now the full resolution record: fix pull requests in one lane, and a new Resolved lane listing everything closed without a pull request — findings you marked addressed or dismissed — with filters and the time each item was resolved.
  • Virtual Patches, on by default. Team workspaces now get Virtual Patches automatically: Hyrax studies what each audit found — and what you dismissed — and mines learned scanner patterns, scoped to your workspace, that apply at audit time without modifying any of your files. Each repository's Virtual Patches page lists every learned pattern and how it has performed, so you can turn any of them off (or back on) at any time — or switch the whole feature off in Settings. See Plans & pricing.

July 9, 2026​

  • See who changed what. Team workspaces get a Workspace changes log under Settings — a timeline of changes made in your workspace (role changes, invites, API keys, settings edits, repository changes) and who made each one. See Plans & pricing.

July 8, 2026​

  • Inactive Free workspaces pause after 90 days. A Free workspace with no activity for 90 days is now paused instead of staying live indefinitely: it becomes read-only and nothing is deleted. We email you about a week before the pause and again when it happens, and you can restore the workspace yourself with one click. Paid plans are unaffected. See Plans & pricing.

July 1, 2026​

  • See why to trust a finding. Each finding's detail page now has a Trust section: how the finding was detected, the evidence behind it, a Citation verified ✓ badge when the finding's detection query matched code in the repository at the time the finding was created, and a copyable check you can run yourself to confirm it. The findings list also gains a Category filter, so you can narrow the list to just security, performance, or any other category.

June 17, 2026​

  • New sign-in. Hyrax now uses hosted, password-free single sign-on — continue with GitHub, Google, or a one-time code sent to your email. There's no Hyrax password to set or remember, and connecting GitHub is now only about repository access, separate from how you log in. See Members & roles.
  • Two-factor by default. Every account is protected by a two-factor security floor, satisfied automatically by your verified login email — nothing to set up. You can additionally add an authenticator app or a passkey for stronger protection. See Security.

June 5, 2026​

  • Three audit depths, one per plan. The audit now scales with your plan: Free runs the Mini audit (a quick pass, up to 5 findings), Pro runs the new Standard audit (a focused 24-tool sweep across security, correctness, maintainability, performance, and dependencies), and Team adds the Full audit (the complete ~39-tool catalog, adding architecture analysis). The Run Audit button runs your plan's everyday audit — the Mini audit on Free, the Standard audit on Pro and Team; Team also gets a separate Full audit button for the complete catalog. See Plans & pricing and Workflows.

June 1, 2026​

  • First release. Connect a GitHub repository and Hyrax profiles it, audits it for prioritized findings, ships fixes as pull requests, reviews your incoming pull requests, and publishes your repo's context for AI coding tools. See How Hyrax works to get started.