Changelog

Executive scan one-pager, QA hardening, and Solana program spike

• Executive 1-pager: console users can download a standalone HTML summary after a scan or from History—security score, verdict, strict finding counts, compliance overview, non-info threat intel hits, verification line vs a prior run, and top findings—then print to PDF in the browser.
• History & home: each saved scan row offers JSON plus a one-click 1-pager; recent scans table columns aligned for export actions.
• Quality & security tests: documented full product QA pass in the product repo; API security regression script updated for alternate ports (macOS AirPlay on 5000) and trusted-proxy rate-limit isolation so checks stay green in real dev environments.
• Solana roadmap note: short feasibility spike on program upgrade authority and immutability to guide future investigation depth—no change required to public scan flows today.
• Validation: automated test suite green on shipping commit in the product repository.

Console security hardening, scan verification UX, and site watchlist

• Security posture: HTTPS-aware HSTS, tighter Content-Security-Policy on the console (base URI, form targets, object embeds, upgrade-insecure-requests in production), expanded Permissions-Policy, and optional proxy-trust handling for correct TLS and client IP behind reverse proxies.
• Session hygiene: expired or invalid JWTs now clear cached profile state and return operators to sign-in with a clear “session expired” message instead of failing mid-flow (including Phantom wallet link on the Credits page).
• Scan diff & verification: baselines prefer the same target URL and scan profile; scan results expose a short verification summary for strict findings and recheck guidance.
• Site watchlist: save web URLs on the Scanner page; after each completed scan, Diverg updates last score, verdict, and critical/high counts. Optional “alert stub” records an audit event when delivery channels are not yet wired.
• Console discovery: login and main console pages use noindex and an explicit referrer policy to reduce accidental indexing and referrer leakage.
• Validation: full automated test suite green in the product repository before release notes publication.

Solana protocol-depth security shipped

• Token-2022 depth: token bundle investigations now detect Token Program vs Token-2022 and parse extension-linked risk indicators, including transfer-fee, permanent delegate, default account state, close authority, and metadata pointer controls.
• Authority misuse signals: added conservative authority-risk heuristics for mutable mint/freeze/delegate/close states with explicit review-oriented rationale, confidence labels, and remediation guidance.
• Correlated drainer model: wallet-abuse detection now uses multi-signal correlation (approvals, signing RPC, provider hijack, obfuscation, origin context) to improve precision over single-pattern triggers.
• Blind-spot transparency: allowlisted third-party wallet hosts still suppress direct drainer alerts by design, but now emit explicit blind-spot diagnostics for analyst awareness.
• Strict evidence gating: Solana depth and wallet-abuse categories are now aligned with stricter proof contracts so low-evidence heuristics do not surface as strong findings.
• UI coverage: dashboard and extension now render concise Solana depth output (token program context, extension risk hints, authority misuse summary) alongside existing coordination and holder analysis.
• Validation: targeted Solana-depth tests passed, followed by full regression run in product repo (166 passed, 6 skipped).

Privy wallet authentication and daily credit system

• Wallet sign-in: added Privy SIWS (Sign-In With Solana) as a primary authentication path via Phantom wallet, with hybrid email/password fallback.
• Username setup: new Privy wallet users are prompted to choose a display name on first sign-in before entering the dashboard.
• Credit system: daily scan credits are now live — 5 free credits per day for all users, plus 20 bonus credits per 100,000 DIVERG tokens held (reset every 24 hours UTC).
• Wallet auto-link: users who sign up with a wallet have it automatically connected to their credit account; DIVERG token balance is fetched on signup when Helius API key is available.
• Credits page: redesigned with connected/disconnected wallet state, live token balance, scan cost table, grant rules, and a live HH:MM:SS countdown timer until the next daily credit reset.
• Wallet connect (email users): email/password users can connect a Phantom wallet from the Credits page via signed nonce challenge to unlock token-holder bonus credits.
• Signature hardening: wallet signature verification now has a cryptography-based Ed25519 fallback and pure-Python base58 decoder, ensuring verification works across all server environments.
• Token verification: Privy access token verification uses a two-path strategy — SDK first, then PyJWT + JWKS fallback — with structured error codes for faster debugging.
• Cluster accuracy: Solana bundle holder clustering now groups by direct first funder instead of multi-hop terminal address for more accurate results.

Solana mint watchlist

• Persistence: added per-account SPL mint watchlist storage with optional self-reported TVL (USD) on add for tier-aware bundle context.
• Dashboard: new Mint watchlist panel on the Tokens page with load, re-scan, remove, and add-from-scan actions.
• Snapshot refresh: re-running a bundle scan on a watched mint updates stored verdict, risk score, and last-scan time.
• Tier context: bundle scans reuse saved watchlist TVL automatically when you scan a mint on your list; results note when that TVL was applied.
• Transparency: watchlist rows show last scan time and clearer methodology notes (bundle heuristics, not a full protocol audit).
• Validation: stricter Solana mint format checks on console and API; mint format tests added in the product repo.
• API: authenticated watchlist list, upsert, snapshot patch, and delete endpoints for console clients.
• Docs: integrations page updated for live watchlist behavior and automatic TVL on re-scan.

Solana ecosystem security integration shipped across product surfaces

• Security model: released a shared solana_security_profile structure to keep Solana framework interpretation consistent across dashboard and scanner outputs.
• Investigation flow: token bundle investigation now presents Solana Security Program context including tiering, pillar status, incident readiness, and recommended actions.
• Scanner analytics: added a Solana Security Program card for crypto-relevant scans with eligibility context and triage-oriented next steps.
• Dashboard-first messaging: CTA and role-mode guidance were prioritized in-product so users take action before reading supporting docs.
• Docs rollout: published public-facing Solana program documentation in Blockchain and Integrations docs, plus a direct Resources entry point.
• Validation: backend test checks and frontend syntax/lint validation completed before release notes publication.

Scanner focus pass shipped (same-day update)

• Focused scan flow: added a streamlined scanner presentation pass so core findings and scan-diff interpretation stay primary in the results experience.
• Focused token flow: added a simplified token investigation presentation layer to keep holder and funding-risk analysis direct and readable.
• Analytics alignment: added dashboard analytics cleanup so product telemetry surfaces stay aligned with core scan workflow signals.
• Validation: syntax and lint checks were re-run after the focus pass and completed cleanly on edited dashboard files.

Solana security system integration (framework + product surfaces)

• API model: introduced a structured solana_security_profile schema with framework references, tiering, pillars, incident workflow checklist, tooling coverage, and prioritized actions.
• Investigation flow: Solana bundle investigation now returns security-program guidance and supports optional tvl_usd context for eligibility interpretation.
• Scanner surface: shipped a Solana Security Program card in scan analytics for crypto-relevant scans, showing tier label, monitoring/formal-verification eligibility, incident priority, and action lists.
• Consistency: scanner and investigation now consume the same profile model to keep interpretation aligned across workflows.
• Resources docs: published Solana program documentation updates in Blockchain and Integrations docs, plus a direct card entry in Resources.

Scanner quality, diff tracking, and docs operations updates

• Scanner UX: completed guided onboarding, richer finding trust details, and false-positive feedback flow.
• UI cleanup: removed the Scanner Readiness panel from scanner view by product direction.
• Diff tracking: shipped recheck and scan diff flow with new, fixed, regressed, and improved states.
• Diff UX pass: Scan Diff now appears before the first run with a comparison explainer, first-run recheck CTA, and inline hints for each diff state.
• Readability: baseline comparison time is now shown in human-readable format; Fixed/Regressed/Improved values are visually emphasized for faster triage.
• Workflow focus: removed GitHub issue integration controls to keep scanner output and remediation flow streamlined in-console.
• API: scan responses now include structured diff payloads for same-target historical comparison.
• Hardening: tightened same-target diff matching and added safer UI handling for malformed diff sections.
• Validation: scan-diff test suite passed and same-target repeat scans validated baseline/diff behavior.
• Docs ops: launched this daily changelog format and added a direct changelog entry point under Resources.

Detailed release notes

• Discoverability: users no longer need to finish an initial scan to discover the diff feature; comparison mechanics are visible at scan setup time.
• First-run behavior: explicit baseline guidance now explains why diff buckets may be empty before same-target rechecks.
• Interpretation speed: added inline state definitions and stronger visual emphasis so triage intent is clearer at a glance.
• Data continuity: backend diff payload format remains stable while UI clarity was improved on top of it.
• Product scope: GitHub issue handoff controls were intentionally removed to keep remediation workflow focused inside Diverg Console.
• Closeout: a full internal before/after wrap-up was published to consolidate the complete two-week improvement cycle.

Documentation site launch

• Published complete docs structure: Getting Started, Core Concepts, Features, and Reference.
• Added whitepaper, API reference, integrations pages, and initial changelog page.
• Shipped responsive docs layout and dark/light theme support.