Changelog

Added integration tests covering edge cases in the DLP enforcement pipeline, token budget enforcement under concurrent request load, and JWT validation across all provider authentication flows. Contract tests were added for the Outpost sync protocol to catch schema drift before deployment. Total test coverage now exceeds 8,100 cases across unit, integration, and contract layers.

Platform operations runbooks are now available to Enterprise customers covering: Outpost health monitoring and failover procedures, DLP rule deployment and rollback, SCIM provisioning troubleshooting, and audit log retention and export workflows. Runbooks are authored to support both in-house SRE teams and managed service providers operating Arbitex in production environments.

Removed duplicated component styles from six industry and use-case pages. How-it-works component CSS is now loaded once via the shared stylesheet rather than repeated inline per page. This reduces total CSS transferred on first load and simplifies future style updates — a change to the shared component now applies consistently across all pages without per-page edits.

Resolved a WCAG 1.3.1 heading hierarchy issue where several pages skipped from the page title (h1) directly to card headings (h3) without an intervening section heading (h2). Visually hidden h2 elements now anchor each content section in the document outline, allowing screen reader users to navigate by heading level without encountering missing levels. Confirmed across all affected pages including features, industries, and use cases.

A dedicated insurance industry page is now available, covering AI governance for insurance carriers, managing general agents, and third-party administrators. The page maps Arbitex capabilities to GLBA Safeguards Rule, NAIC Insurance Data Security Model Law, CCPA, NY SHIELD Act, SOX Section 404, and NAIC AI guidance — with deployment, compliance activation, and audit documentation workflows.

Redaction and blocking actions in the DLP pipeline now surface clearer indicators in the admin portal and audit logs. Teams can see exactly which detection rule triggered, what enforcement action was taken, and the category of data involved — making it easier to tune policies and investigate flagged requests without exposing the underlying sensitive content.

The admin portal now includes a model risk management view that consolidates model usage metrics, health status, and governance policy coverage into a single dashboard. Teams responsible for model oversight can review which models are active, their error rates, and whether governance policies are enforced — supporting internal model governance reviews and regulatory inquiries.

The DLP detection pipeline has been expanded with additional patterns for financial account identifiers, insurance policy numbers, and healthcare record formats. These additions close coverage gaps identified during industry-specific compliance reviews and improve detection accuracy for mixed-format documents common in claims processing and underwriting workflows.

Resolved a heading hierarchy issue where feature and industry pages skipped from h1 directly to h3, causing screen readers to report missing heading levels. All affected pages now have proper h1, h2, h3 structure with visually hidden section headings where needed. This fix improves navigation for assistive technology users across the site.

Ran a comprehensive self-audit covering secret detection, static analysis, test coverage, provenance signing, PII handling, and open-source license compliance. All findings were triaged and resolved before publication. This sprint is part of our ongoing commitment to shipping software that meets enterprise-grade quality standards.

An internal documentation review identified and resolved 16 accuracy gaps across the API reference, integration guides, and SDK quickstart content. Updates include corrected code examples, clarified authentication flows, and more accurate descriptions of rate limiting and error handling. Docs at docs.arbitex.ai now reflect production behavior.

Completed a full audit of feature cards across the marketing site, reviewing 36 cards for copy accuracy, tone consistency, and visual alignment with brand guidelines. All cards now follow the same structure: outcome-led headline, benefit-focused body copy, and consistent CTA language. No cards carry speculative or roadmap language.

The Arbitex platform now generates a CycloneDX-format software bill of materials as part of every release. The SBOM documents all production dependencies, their versions, and license classifications — supporting enterprise customers with supply chain compliance requirements under SSDF, EO 14028, and NIST SSDF frameworks. SBOM artifacts are available to Enterprise customers on request.

Automated dependency scanning is now part of the deployment pipeline. Every release is checked for newly disclosed CVEs, license compatibility, and dependency health before being promoted to production. Teams receive a pre-flight report with any issues that require attention before the release proceeds. This closes a gap identified in the supply chain risk review.

Following an internal security review (SEC-017), JWT session tokens are no longer stored in browser localStorage. Tokens are now issued as httpOnly, SameSite=Strict cookies — inaccessible to JavaScript and protected against XSS-based token theft. Existing sessions were invalidated as part of the migration. Users who were signed in were prompted to re-authenticate on next visit.