Changelog

1.35.0 1 November 2026

The phone forgets on a 30/60/90-day schedule, eleven digital-asset security sources, and two server repairs

• CySec forgets by how much an item concerned you: an item you never touched is kept 30 days when it never named anything you run, 60 days when it might have, 90 days when it did. Anything you read, triaged, noted, raised, muted or snoozed stays. Look up still answers for older items from the server.
• Eleven digital-asset security sources in the Crypto category, ten on by default: Halborn, SlowMist, Chainalysis, TRM Labs, Elliptic, BlockThreat weekly, Zellic, Immunefi, Crystal Intelligence and Cointelegraph's hacks tag. CertiK's blog is in Settings, Sources, off by default.
• Server: CISA's two advisory feeds had grown past the size limit and had not been read since October 22; a feed over the limit is now read up to the limit, newest items first. The NVD poll had been stuck on an impossible date range since October 26 and now recovers on its own.

1.34.4 31 October 2026

A launch in the background draws its first screen before it syncs

• When a silent push or a background refresh starts the app while it is not on screen, iOS allows ten seconds for the first screen to be drawn. On 2026-10-30 the sync those launches run, and the Radar rebuild every launch runs, got in ahead of that first screen and iOS ended the app. Both now wait for the first screen, which takes well under a second, and run inside the thirty seconds the push itself is allowed.
• Nothing changes when you open the app yourself.

1.34.3 30 October 2026

The Feed stops re-reading the store after every save

• Opening the Feed, and every save behind the scenes, used to make the Feed re-read its rows from the database on the main thread, up to ten thousand of them for the widest window. On 2026-10-29 that happened while the app was in the background and iOS ended it for taking too long. The Feed now reads its rows once each time the content changes, off the main thread where it can, and never while the app is in the background.
• Settings → About → Diagnostics shows the cost of each Feed load as "Feed load".

1.34.2 30 October 2026

Pull to refresh lets go as soon as the new items are in

• Pulling down on the Feed or the Radar now ends the moment the new items are on screen. It used to hold the list down for up to sixteen seconds while the app re-scored, rebuilt the Radar and checked three more things behind the scenes; all of that still happens, just not in front of you.
• The Patch Tuesday count, the morning brief and the Watch's items no longer re-read the whole store after every sync; each remembers what it already knows and reads only what arrived since.
• Settings → About → Diagnostics now shows what the launch spent its time on, step by step, so a slow start can be named.

1.34.1 30 October 2026

Faster first screen, and tabs that stay put

• Opening CySec and switching to the Radar no longer re-reads the whole store on the main thread. The Patch Tuesday count behind the Radar did exactly that, on every visit to the tab; it now reads two columns in the background and asks the server for the month at most once an hour.
• The Radar is built once at launch instead of twice, the Feed no longer re-filters itself every time you return to it, and the thin "Updating relevance" line only appears when an update has lasted most of a second.
• Housekeeping that ran at every launch now runs once.

1.34.0 30 October 2026

Crypto gets its own place: a Feed filter, Molly White's feeds, and the names you run

• Crypto is a category of its own. Filter the Feed by Crypto, find it as a section in Sources, and tap the Crypto chip when the Feed shows the full set.
• Two new feeds, both on: Web3 is Going Just Great, Molly White's running log of crypto thefts and collapses, and her Citation Needed newsletter. Her Mastodon account and Catalin Cimpanu's (Risky Business News) now count in the Pulse and can send an Unconfirmed alert when they name something you run or watch.
• What you run has a new section, Crypto & digital assets: Binance, Coinbase, Kraken, Ledger, MetaMask, Ethereum and more, so incidents naming them count as yours.
• Crypto items that reached the phone before this update were filed under News; the first launch after updating moves them to Crypto.

1.33.0 29 October 2026

Background wakes no longer end the app, and the phone forgets what never concerned you

• The app no longer stops in the background. Every hour CySec wakes briefly to fetch new items; since the store grew past sixty thousand items, that wake re-scored all of them on the spot and iOS ended the app for taking too long. The re-score now runs only when your products or alert settings actually change, in small steps, and never during a background wake.
• CySec now forgets. Items older than two months that never concerned what you run, and items older than a year, are removed from the phone unless you read, triaged, noted, muted or snoozed them. Look up still answers for older items from the server.
• Opening the app no longer re-registers your device with the server every time.

1.32.3 21 October 2026

A subscriber is never shown the paywall because the App Store went quiet

• If the App Store answers with nothing for a moment, CySec remembers your last confirmed subscription and keeps the door open for the week Apple itself allows, instead of putting the paywall over the app. A refund or a lapsed subscription still closes it.
• Store errors are now explained in plain words, and say when your access is not in question.

1.32.2 21 October 2026

IFIN joins the sources

• Sources: IFIN, the Independent Federated Intelligence Network at ifin.network, a community of practitioners writing up what they see. Its threat intelligence and vulnerabilities feeds are on by default; a vulnerability post lands on its CVE's page as evidence. Cyber news is there to switch on.
• Signing in with your IFIN account is coming: it uses IFIN's own approval screen, never your password, and needs one setting on IFIN's side first.

1.32.1 8 October 2026

Removing a product can no longer trip the list

• Swiping a product off What you run or Your estate: the 'Updating relevance' line no longer appears inside the list while a row is still sliding away, and a product you removed from the estate table leaves it at once instead of flickering back. Both were the shape of change that could crash the screen.

1.32.0 27 September 2026

Watches by name, chatter that may speak, the landscape line, and Bluesky

• Watches: type a name in Look up, or tap Watch on an item, and CySec tells you the moment anything names it — a new report, an advisory, or an unconfirmed post from a source it trusts — each push labelled by what it is. Manage them in Settings → Watches.
• Look up now shows the last three days of chatter about a name, in the posters' own words, under "Chatter, unconfirmed".
• The landscape line: once a day at most, quietly, something being attacked with no fix yet, whether or not you run it. Settings → Alerts turns it off.
• Sources: Bluesky named accounts (Huntress, GreyNoise, Rapid7, MalwareTech) join the early-signal layer; GreyNoise Labs and Citrix security updates join the catalogue; a vendor's advisory feed switches itself on when you add one of its products.

1.31.4 27 September 2026

Add a product to what you run straight from an item

• On an item that is not yours, one tap adds the product it names to what you run, and the page re-scores itself. No more hunting for it in the list.
• The Detail menu's Full view now switches the page at once, and Track shows that it is tracking.

1.31.3 26 September 2026

DoublePulsar joins the sources

• Sources: Kevin Beaumont's DoublePulsar, plain-language write-ups of incidents as they unfold, is in the catalogue and on by default. His day-by-day posts also feed the early-signal layer.
• Behind the scenes: the server now records that it has read a feed only after the feed's items are safely stored, so a run that is cut short can never lose a poll.

1.31.2 22 September 2026

Ask CySec: the keyboard no longer covers the question or the Send button

• The floating keyboard button that sat over the Send arrow, and in yesterday's fix over the start of your question, is gone. A small hide-keyboard button now sits inside the input bar while you type, and Send is always clear.

1.31.1 22 September 2026

Ask CySec: Send is no longer covered by the keyboard button

• On the Ask CySec screen the Send arrow could not be tapped while the keyboard was up, because iPhone's floating "hide keyboard" button sat on top of it. The button now sits at the left, and Send is always reachable.

1.31.0 22 September 2026

Search in Settings, and 'What you run'

• Settings has a search field. Type what you are looking for in your own words: "android" finds the product you run, with Remove right there; "dark mode" finds the appearance switch; "notifications", "report a problem", "claude" find their screens.
• The row that used to say "Environment" now says "What you run", with "add or remove" on it, and the screen has an Edit button as well as the swipe. Your estate rows can be swiped to remove a product too. The walkthrough, the setup and the Radar say "what you run" as well.

1.30.0 20 September 2026

The CySec Pulse Index

• Pulse opens with the CySec Pulse Index: one number a day, 0 to 100, for how busy the published security landscape is compared with its own last ninety days. It describes the world, not you; the Radar is still your number, and it is not a forecast.
• Tap the number for how it is calculated: each of the seven components (exploitation, vulnerability pressure, ransomware and extortion, threat-actor activity, breaches, supply chain, government and CERTs) with today's count, its usual value and its share of the total; what is not in the number; the last thirty days; and, as a second opinion, the Internet Cyber Health Index by Joe Bernik, shown with his permission and never blended in. The full method is at cysec.grcsac.com/pulse-index.
• In the first weeks the comparison is against a short history, and the page says how many days each component has behind it.

1.29.2 20 September 2026

Larger text sizes, JPCERT in English, and a few things for the soak

• At the accessibility text sizes the item's priority header, the Radar's counters and the Settings rows lay out properly instead of squeezing, and the walkthrough's page dots no longer sit on the text.
• Sources: "JPCERT/CC alerts (English)" replaces the Japanese list as the default JPCERT source; the Japanese list stays available under Sources for readers of Japanese, off by default.
• Behind the scenes: performance samples are logged for Console; a public changelog at cysec.grcsac.com/changelog; the server keeps a daily backup and tells the owner when a run or a source fails for a day.

1.29.1 19 September 2026

Store screenshots for every screen, and three small things from Paul's screenshots

• Your estate: a product's third line now says only what you set. Until you rate it, it reads "Not yet rated · tap to set criticality and exposure" instead of repeating "Medium criticality · Exposure unknown" on every row. Counts group their thousands ("3,599"), and a product is never named twice ("Linux kernel", not "Linux kernel Linux kernel").
• Companies you rely on no longer repeats its title as a section header.
• Look up: items from custom feeds stay out of the results; another device's feed is not yours, and a leak-site feed is a victim list by another route. "1 leak-site claim" is singular.
• A feed you add under Sources is yours: the server now sends a custom feed's items only to the phone that added it, and a phone drops any it received from another phone's feed. Until now every phone got every custom feed, so a fresh install could read someone else's leak-site feed.
• The priority line keeps its acronyms: "Driven by CVSS severity", not "cvss severity".
• Behind the scenes: the App Store screenshot set was recaptured with the new screens (docs/store/screenshots-1.29.1).

1.29.0 19 September 2026

Look up anything, confirmed breaches, and the actor catalogue grows

• Look up: a search row at the top of Pulse. Type a company, a threat actor, a product or a CVE and CySec shows what it knows, in four labelled groups: threat actors from its catalogue, confirmed breaches from Have I Been Pwned (with how many records and which kinds of data), leak-site claims (marked as claims, unverified), and the stories and advisories its sources published. One tap adds a company as one you rely on, and "Ask CySec" explains it.
• Confirmed breaches: a company you rely on that appears in Have I Been Pwned's record gets a banner when the breach was listed in the last thirty days, and a line on the company's page when it is older. The words keep a verified breach apart from a leak-site claim everywhere they appear.
• Threat actors: about five hundred intrusion crews from ETDA's threat-group encyclopedia join the leak-site groups, with their other names and country, so an actor you hear about is usually there to follow.

1.28.1 19 September 2026

Ask CySec no longer stops at Apple's guardrails

• The on-device model is told first that you are defending your own systems. If it still refuses, CySec asks again with a plain version of the item, and only then tells you, in its own words, with Claude as the way round. Apple's raw "safety guardrails" message is gone.

1.28.0 19 September 2026

Your estate, a ten-minute setup, and Simple or Full

• Your estate: under Settings, and behind the card at the top of the Radar. One row per product you run, worst first: what is open against it, what is under attack, what has a fix, when it last moved, and what you resolved this month. Tap a product for its open items and its record.
• Set up in ten minutes: after the walkthrough, say what kind of organisation this is and CySec starts with the products that usually go with it. Untick what you do not use, name the companies you rely on, done. Also under About → Set up what you run.
• Simple or Full: item pages now start Simple — what it is, whether it is yours, what is happening, what to do. Flip to Full for the evidence, the technical record and the score. The Feed's chip bar follows.
• Syncs finish faster: the environment index is built once and kept until your products change.

1.27.0 19 September 2026

Faster between screens

• Tab switches, opening an item and leaving one no longer wait on the app's own bookkeeping: the Radar is rebuilt in the background and shown when ready, the app does not re-sync when you reopen it within three minutes, and the work that follows a sync runs after the screen has settled.
• About → Advanced → Diagnostics now shows how long each tab switch, item open and sync stage took on your iPhone, and a problem report carries the same figures.

1.26.0 19 September 2026

Companies and threat actors, each on their own screen

• Settings now has two rows: Companies you rely on, and Threat actors. A tester pointed out that the bad guys should not sit under the companies you care about. Each screen keeps what it had; nothing you entered moves.

1.25.1 19 September 2026

Settings row counts every actor

• Settings → Companies & actors said "1 actor" with Follow every actor on, because it counted only the groups picked by hand. It now says "every actor" with the catalogue's size.

1.25.0 19 September 2026

Followed actors and your companies, marked on the lists

• Feed and Radar rows now show the actors you follow that an item names, and the company an incident is about, so you can spot them while scanning.
• The Feed's chip bar gains Followed: only items naming an actor you follow or a company you rely on.

1.24.0 18 September 2026

Follow every actor

• Settings → Companies & actors → Follow every actor: be told whenever something CySec reads names any group in the catalogue, including groups added later. Your own picks stay listed. One banner per item, naming the actors it carries.

1.23.1 18 September 2026

Far fewer disk writes; the launch that waited on the phone

• CySec no longer rewrites every stored item when you edit your environment or when a sync brings back items you already have; only what actually changed is written. On one phone this was a gigabyte of writes in eighty minutes, and the load behind a launch that iOS cut off after ten seconds.
• Report a problem now includes how much the last pass wrote, so a slow phone can be diagnosed from the report.

1.23.0 18 September 2026

Companies you rely on, and threat actors

• Settings → Companies & actors: name the companies you are a customer of — your bank, your insurer, the services your data sits in. If one appears on a criminal leak site or in breach news, you are told, and the incident at the top of the Radar walks you through what to do.
• Follow threat actors such as ShinyHunters or Qilin: tap a group on the Pulse, or an actor's name on any item. You are told when something new names them; their page shows how busy they are this month and what CySec has read.
• These names never leave your iPhone. Leak-site postings are always called what they are: claims, not confirmed breaches.

1.22.0 17 September 2026

The Worker checks the subscription itself; a blocked source says so

• CySec now shows the Worker Apple's own signed record of your subscription, so alerts and syncing follow the subscription without trusting the phone. Nothing changes for you: the trial and the plans work as before.
• Settings → Sources: a source whose publisher blocks automated readers (BleepingComputer, for now) is shown with the reason and cannot be switched on.

1.21.0 16 September 2026

Subscription: 7-day free trial, then $4.99 a month or $39.99 a year

• The whole app now sits behind a subscription. The first launch after the walkthrough shows the plans; Start free trial begins 7 days at no charge, then the plan you picked renews through your Apple Account.
• About → Your subscription shows your plan, opens Apple's Manage subscription sheet, and Restore Purchases brings an existing subscription to a new phone.
• On TestFlight the App Store sandbox is used: the trial starts, nothing is charged, and sandbox renewals run on a compressed clock.

1.20.3 16 September 2026

Appearance applies on the first tap

• Light and Dark now apply the moment you tap them, and the switch shows what you chose.

1.20.2 16 September 2026

Appearance switch fixed

• Choosing Light or Dark now changes the whole app immediately; in 1.20.1 the control moved but the screen did not.

1.20.1 16 September 2026

Day, night, or the phone's own

• Settings → Appearance: System, Light or Dark. System follows your iPhone; Light and Dark keep CySec that way whatever the phone does.

1.20.0 16 September 2026

Walkthrough, About, and a way to reach us

• A first-use walkthrough explains the app feature by feature, with Skip and Done; replay it any time from Settings → About.
• About is new: what CySec is for, where it reads, links to the website, privacy policy, terms and support, and two buttons — Request a feed and Report a problem — that reach us from inside the app.
• Diagnostics moved to About → Advanced.

1.19.0 16 September 2026

Every phone now proves it is CySec

• The app no longer carries a shared password for its server. On first launch it has Apple vouch for it (App Attest) and receives its own credential, which it keeps in the Keychain and uses for every request; changes to what the server fetches for you are signed by your phone's Secure Enclave.
• Nothing to do: the switch happens silently the first time 1.19.0 opens.

1.18.2 16 September 2026

Smoother screen changes

• Switching tabs and opening or leaving an item no longer waits for the Radar to rebuild: it rebuilds only when something changed, and never in the middle of a transition.

1.18.1 16 September 2026

Notifications follow the Radar

• The default notification preset is now "Follows the Radar": something you run that is under attack interrupts, something you run that CySec ranks urgent is a banner, everything else that touches you waits for the 07:00 brief, and items that are not yours no longer ring the phone.

1.18.0 16 September 2026

Built with the iOS 27 SDK

• CySec is now built with Xcode 27 and the iOS 27 / watchOS 27 SDKs, which Apple requires for every upload from April 2027. Nothing changes on iOS 26; the app still runs on iOS 26.0 and later.
• No new iOS 27 features yet; this build is the compatibility step. Every test passes on both iOS 26 and iOS 27.

1.17.1 15 September 2026

The crash: the Radar rebuild no longer freezes the app on the way to the background

• CySec was killed by iOS on 15 September for spending more than ten seconds rebuilding the Radar while it was being sent to the background. Each item's data is now decoded once instead of several times per pass, so the rebuild is many times faster.
• Settings → This device shows how long the last Radar rebuild took.

1.17.0 15 September 2026

Now means now: the live incident ends when you have looked, and only a recent attack is an incident

• "Immediate action" now needs attack evidence from the last 14 days. Older exploited items you run and have not patched sit in "Review today" instead of on your Lock Screen. The Island no longer says "58 now".
• The live incident on the Lock Screen, in the Dynamic Island and on CarPlay ends once you have opened the Radar or tapped it, and comes back only when something new joins.
• On CarPlay and the Watch, the incident names what is affected first, not just a count.
• The threat level is judged on the dates your sources put on items, not on when CySec first stored them.

1.16.1 14 September 2026

Radar lists match their counters

• Tapping a Radar counter now lists every item that counter counted. "Changed since last view: 1" no longer opens onto an empty screen, and "Review today" lists all of them rather than the first twenty.

1.16.0 14 September 2026

Patch Tuesday, read properly

• CySec now reads Microsoft's full monthly release, not just the headlines. Every Microsoft fix carries its severity, whether it is already being attacked, which products it affects and where the patch is.
• A new Radar section for the month's release: how many fixes Microsoft shipped, how many it rates critical, how many are being attacked, and then how many affect something you run. Zero is a real answer and reads like one.
• One notification on Patch Tuesday with that summary. It never interrupts, because anything in it that is both yours and under attack already does on its own.

1.15.4 14 September 2026

A custom feed you can see, edit and switch off

• A feed you add now appears in the list straight away. Before, it was saved and working but the screen did not refresh until you left and came back.
• Swipe right on a feed, or press and hold, to edit its name or address. Swipe left to remove it.
• Each feed has a switch. Off keeps it in the list and stops CySec reading it.

1.15.3 14 September 2026

A leaked tool call is removed and admitted, and the keyboard goes away

• If the on-device model writes its own internal instructions into an answer, that text is removed and the answer says part of it came out garbled, with Ask again one tap away. Ordinary braces in an answer are left alone.
• In Ask CySec, the keyboard now goes away when you send a question, when you drag the answer, and with a Hide keyboard button above the keys.

1.15.2 14 September 2026

Scoped npm packages in a bill of materials

• Importing a bill of materials that contains scoped npm packages, the ones whose names start with an @ such as @angular/cdk, now reads them correctly. Before this they were silently filed as Java packages and never matched anything.

1.15.1 14 September 2026

Add something the catalogue does not know, and DigiCert

• Searching the catalogue for something CySec has never heard of now offers to add it anyway, by the name you typed. CySec says plainly that it will match on exactly those words and nothing else.
• DigiCert is in the catalogue properly, so it is matched on every name DigiCert publishes rather than on a typed word.

1.15.0 14 September 2026

Replace an environment from a list

• You can now hand CySec a list of what you run and have it replace your whole environment in one go, instead of adding each thing by hand.
• Nothing is written until you have seen exactly what will happen. Everything being removed is listed by name, not counted.
• CySec tells you which things it already knows, and which it will only match on the exact words you gave, so you know where it might miss something.

1.14.0 14 September 2026

Live incidents on the Lock Screen, and Spotlight search

• When something you run is confirmed under attack, it now appears on your Lock Screen and in the Dynamic Island and stays there until you deal with it, without buzzing you again. It shows on your watch too.
• Only ever one at a time. A second thing updates the first to say how many there are, rather than stacking up.
• Seen and Track buttons are right there. They save your decision and say so until CySec next opens, because that is what actually happens.
• Type an advisory number into Home Screen search and CySec finds it. Only what the source published is indexed, never whether it affects you. Settings has a one-tap way to remove it all.

1.13.0 14 September 2026

Widgets, complications, Siri and a Focus filter

• CySec now lives on your Lock Screen, Home Screen, StandBy and your watch face. All of them answer one question: how much of what CySec is watching actually needs you.
• Calm looks deliberate. "Nothing needs you" is a finished sentence, not a blank. If CySec has not checked yet it shows a dash rather than a zero, because those are different things.
• Ask Siri "what needs me in CySec". The answer is written to make sense with no screen, so it works through AirPods and in the car.
• Widget buttons let you mark the top item seen or track it without opening the app. The widget says the decision is saved until CySec next opens, because that is what actually happened.
• A Focus filter raises the bar for what interrupts you. It hides nothing, it says so on the Radar the whole time it is on, and it switches itself off after a day in case you forget.

1.12.0 13 September 2026

The product improvement review, finished

• Your brief now opens with what CySec took off your plate: "CySec reviewed 1,142 security reports in the last 24 hours. 3 matter to you. One thing you run needs action from you now." Then what to act on, what changed, and everything it monitored and set aside.
• A new "Since you last looked" section on the Radar and in the brief, counting only what actually moved.
• CySec now notices when something becomes yours. An item it had counted as somebody else's problem that turns out to name something you run is now called out rather than quietly reclassified.
• Ask CySec answers are laid out in sections instead of one wall of text, with the bottom line first and the detail one tap away. Copy and Share still give you the whole answer.
• Saved filters on the Feed. Name a combination, and one tap puts the feed back the way you had it. Your existing filters are untouched.
• New under Settings: "How you use CySec". It counts alerts, what you opened, what you decided, and how quickly. All of it is counted on this iPhone, none of it is ever sent anywhere, and one switch deletes the lot.

1.11.0 13 September 2026

Notification tiering: an interruption has to mean something happened

• A notification only breaks through Focus when something you actually run is confirmed to be under attack. A high score no longer interrupts you on its own, and neither does a product named only in an advisory's text.
• Nothing stopped notifying. Everything that reached your phone still reaches it. What changed is that a score arrives as a banner rather than as an interruption.
• When CySec tells you about something a second time, it now leads with what changed: "Attacks using this are now confirmed" rather than repeating the summary you already read.

1.10.0 13 September 2026

Pulse is the world, and CySec can ask what it does not know

• Pulse is now about the industry and nothing else. It opens with what is happening out there, and whether any of it touches you is one line underneath. It no longer tells you to go and clear a backlog: that is the Radar's job and the Radar does it better.
• "Unusually busy" is hard to reach on purpose. A screen that calls every day unusual has no way left to tell you when a day really is.
• New on any item you run: Help CySec work out if this affects you. Five plain questions, all skippable, asked only when CySec does not already know the answer. Everything you answer stays on this iPhone.
• Answering tells you what it settled. Either the flaw does reach your version, or it does not, or CySec says plainly that it still cannot tell and why.

1.9.0 13 September 2026

Applicability, and four action tiers

• The Radar now has four groups instead of three, and only the first says a decision is needed. "Immediate action" requires all of: you run it, somebody credible says it is being attacked now, CySec ranks it urgent, and you have not dealt with it. Everything else that used to sit under "Action now" is now "Review today".
• Running a product and being affected by a flaw in it are no longer the same answer. An item can say you run it while being honest that whether this particular problem reaches your version is not known.
• How sure CySec is that something is yours is now shown separately from how bad it is. A critical flaw matched on a product name alone is not presented like one confirmed in your environment.
• If you told CySec a version that sits outside the affected range, that item no longer counts as urgent.
• Where CySec knows the product but not your version, the item now offers to be told, instead of guessing.

1.8.1 13 September 2026

The front door explains itself too

• The welcome screen was the last one written for somebody who already knew the field. It now says what CySec does in ordinary words, and points at the "Dumb this down" answer for anyone who wants more.

1.8.0 13 September 2026

The plain-language pass reaches the Feed and the Radar

• Every screen now says what a thing means before it shows the notation. A feed row leads with the source's own headline and one plain sentence: "The US government has confirmed this is being attacked right now. It can be reached over the internet without a password."
• Identifiers and scores are still there, last and smallest, and now say what scale they are on: "severity 9.8 out of 10" rather than "CVSS 9.8".
• The Radar groups its cards under three headings, and only the first says a decision is needed. The other two say plainly that nothing is being asked of you.
• The threat level says what it means, not only what it is called.
• "Today" reads as one sentence: "CySec read 412 things today. 9 touched something you run, and 2 of those are urgent."
• Filter labels are in ordinary words. Your saved filters are unaffected.

1.7.0 13 September 2026

The early-signal layer: rumour, counted rather than believed

• Pulse gains an "Unconfirmed chatter" section at the bottom: security mailing lists, Hacker News, Lobsters, six subreddits and two Mastodon tag feeds, watched for one thing only — several unrelated places starting to say the same thing at once, far more than they normally do.
• Nothing in that section will ever alert you, change how urgent CySec thinks anything is, or put anything on your Radar. It shows the posts themselves and links to them, so you judge them rather than CySec's wording.
• CySec never records who wrote a post, and never repeats what a post says in its own words.
• A cluster needs at least two unrelated platforms to agree, so no single community can manufacture one.

1.6.3 13 September 2026

One button on the Pulse brief, not two

• "Explain this simply" and "Ask CySec" did the same thing: the first sent the first of the suggested questions that already live inside the second. There is now one button, captioned with the question behind it.

1.6.2 13 September 2026

The assistant is told what each Pulse row affects, and whose it is

• "Explain this simply" and "Ask CySec" on Pulse can now answer whether any of what is happening is yours. Each row tells the analyst what it affects and, when you allow environment context, whether you run it. The match happens on this iPhone.

1.6.1 13 September 2026

The brief stops over-claiming, and says every reason in words

• A long list of unread items is described as a backlog, not as an attack. It also tells you that marking something as seen takes it off the count.
• Every reason CySec gives for something becoming more urgent is now in ordinary words. "CVSS published (was unscored)" reads as "a published severity rating was given to it for the first time".
• Reasons are joined with "and" rather than "or": they all happened, they are not alternatives.
• The buttons on Pulse are centred.

1.6.0 13 September 2026

Pulse answers the question before it shows the working

• Pulse now opens with a plain-English brief: whether today matters to you, what is actually happening, and what to do — or that there is nothing to do. No acronym reaches you without being explained in the same sentence.
• "Explain this simply" and "Ask CySec" sit at the top of Pulse, so the whole picture can be asked about, not just one item.
• Every Pulse row says what is affected and whether you run it, then what happened in ordinary words. The advisory filing number and the score arithmetic are still there, last.
• Tapping a Pulse row no longer dead-ends at "Item not available": the item is fetched on demand.
• "First sighted" no longer admits things that name nothing. It was led by an AI industry opinion piece and five weekly digests, each captioned as early research nobody had acted on.
• Attacker activity stops inventing a comparison when the previous week was never measured.

1.5.0 13 September 2026

Pulse: a global lens on what is happening, and a simpler tab bar

• New Pulse tab: the industry's own threat dial, stories several independent sources are converging on right now, what moved fastest today, what was sighted before anyone published an advisory, and what is scheduled next.
• Every developing story shows its own numbers and its sources, so you can judge it rather than trust it. Pulse does not read social media and does not predict, and says so.
• Tabs are now Radar, Feed, Pulse and Settings. Sources and Environment moved into Settings, and Environment is still one tap from the Radar.

1.4.2 13 September 2026

Clearer environment matches and honest wording on how widely software is used

• A vendor match now reads once, naming the vendor, instead of repeating itself for every product you watch from that vendor.
• How widely used now says plainly what it measured, and stays out of the way on news items where there is no named product to measure.

1.4.1 13 September 2026

The background crash, properly fixed

• The crash that kept appearing overnight is fixed at its real cause. The code iOS calls in the background was itself marked as main-thread-only, and the check that stops the app fired the instant it was called, before any of the code I had been changing could run.
• Alerts no longer say Relevant when your watchlist word merely appears in a sentence. An advisory about other software running on Windows is not a Windows advisory.
• Alert titles name the affected product rather than the vendor code.

1.4.0 13 September 2026

Software components, plain-English prevalence, and copy or share any answer

• Your Environment can hold software components now, not just vendors and products. Pick from a catalogue of 416 verified components, or import an SBOM or lockfile from Files: CycloneDX, SPDX, package-lock, yarn.lock, requirements.txt, go.sum, Gemfile.lock, Cargo.lock, composer.lock and pom.xml. Everything is parsed on the phone and nothing about your components leaves it.
• Matching is exact: an advisory saying a package is affected below a version, against the version you actually have.
• How widely used something is now reads in plain English rather than as a raw number, with the measured figures and their sources a tap away.
• Copy or share any assistant answer, on its own or with the source link, straight into Messages or Mail.

1.3.0 12 September 2026

Answers that lead with the point, and conversations that stay

• Every answer now opens with the bottom line, then a short plain-words summary, then the detail below it.
• Ask CySec remembers: reopening an item continues the last conversation instead of starting blank. New starts a fresh one.
• Preset buttons show their name in the conversation rather than the whole hidden instruction.
• A first cut at how widely used the affected software is, under Exploitation.

1.2.5 12 September 2026

Really fixes the background crash

• The background-refresh crash is fixed properly this time. 1.2.4 moved the problem one line rather than removing it; the code iOS runs in the background now touches nothing that belongs to the main thread, and two tests fail loudly if that ever regresses.

1.2.4 12 September 2026

Fixes the background crash testers were seeing

• CySec no longer crashes when iOS wakes it in the background to refresh. The crash happened while the phone was locked, so it appeared as an unexplained crash report rather than something you did.

1.2.3 12 September 2026

Dumb this down, and a launch that cannot crash on a bad database

• Dumb this down in Ask CySec: explains an item to someone with no technical background, with no jargon or acronyms. Swiping Explain on a feed row uses it too.
• If the saved database cannot be opened, CySec now keeps the old file, starts fresh and tells you in Diagnostics, instead of crashing on launch.

1.2.2 12 September 2026

Readable button colour and a centred Ask CySec label

• Filled buttons now meet the 4.5:1 contrast standard for text, in light and dark, with stronger colours again when Increase Contrast is on.
• The Ask CySec label sits centred; it was pushed right by an empty icon slot.

1.2.1 12 September 2026

Source health reports unwatched feeds correctly; an empty search now explains itself

• Source health separates the 22 feeds CySec watches from the 48 that are simply not enabled, instead of calling them all delayed.
• Searching or filtering to nothing now says what was searched and over what window, with buttons to widen the window or clear the filters.

1.2.0 12 September 2026

Assistant history, detection and campaign context, Source Health, and better search

• Ask CySec answers are kept on the phone: a Previous answers section on each item, a history list for the global assistant, and a stale badge with Ask again when the item has changed since you asked. Retention is 90 days by default, with forever and don't-keep options, and a Delete all button in Privacy.
• Detection guidance appears when a source published it, with the links and where they came from, plus a clearly-labelled prompt for hunting questions. Nothing is invented.
• Patch and verification: fixed versions, workaround and a plain how-to-verify line; unknown says unknown.
• Campaign and actor context with the evidence behind it, and a Campaign activity row on the Radar.
• Source Health under Settings, Diagnostics: which feeds are operational, delayed or deferred, and how fresh they are.
• Search now matches summaries, source names and advisory ids, so searching a publisher by name works.

1.1.0 12 September 2026

Radar home, Action Card, private environment model, alert policy, Watch triage, and a large performance fix

• Radar is the new home: your threat level, Action Now, Changed since last view, Watching, and today's totals.
• Action Card replaces the item screen: priority with the reasons behind it, environment relevance, exploitation status, recommended action, patch and workaround, What Changed since your last view, the Evidence Ledger with primary sources, and the score breakdown. Ask CySec sits at the top.
• Environment replaces the flat watchlist: record the version, whether it is internet-facing, production and business criticality. Versions and notes never leave the phone.
• Alerts: four presets (Quiet unless critical, Executive, Security analyst, Everything), notification privacy levels, a daily brief hour, and an advanced rule editor.
• Assistant: a global Ask CySec on the Radar, six tools that read your local data, a payload preview before anything reaches Claude, and the full model list from your API key.
• Watch: a triage dashboard with threat level and counts; acknowledge, raise, or remind later from the wrist.
• Performance: selecting watchlist items and typing in settings no longer lags; relevance is recomputed off the main thread and only changed rows are written.
• Your settings, watchlist, triage, notes and Claude API key all carry over from 1.0.1.

1.0.1 12 September 2026

Feed filters persist across launches

• The severity, category, triage, relevant, unread and KEV filters are remembered between launches.

1.0.0 12 September 2026

First complete build for Paul and the internal TestFlight group.

• Feed: filter chips under the search field (All, Relevant, Unread, KEV, Critical, High+, categories, Open, Raised); swipe right or long-press a row to ask the assistant ("Explain simply" and the other presets); placeholder rows during the first sync.
• Launch: static launch logo and a short splash (logo + wordmark) fading into the feed.
• Settings: sectioned root (Alerts, Assistant, Privacy, Diagnostics, About).
• Icons: Paul's shield-and-radar artwork for iPhone and Watch.
• Worker: Workers Paid plan, subrequest budget 950, per-run source rotation kept as a safety net, Anthropic page watch, BleepingComputer off by default (blocks Workers), scheduled runs every five minutes.

0.1.0 12 September 2026

Initial build: Worker (71 verified sources, D1, APNs), iPhone app (feed, detail, share, sources, watchlist, settings, push), on-device and Claude assistant, Watch app, App Store Connect record and TestFlight internal group.