Release notes

• MSP / reseller self-service: per-tenant provisioning, custom domains with automated SSL, reseller pricing and a TOTP-secured console
• Security hardening: multi-factor authentication (available to all users, required for administrators), first-login password rotation, session token-version revocation and idle logout
• Advanced exploitation gated behind a self-service e-signed authorization agreement (bruteforce / RCE / credential-extraction / destructive)
• Operator-controlled one-click scanner upgrades with zero-downtime canary rollout

• Fleet-wide marketing counters on the public site - real scan / finding totals aggregated across every tenant (counts only, full tenant isolation preserved)
• Scanner spin-down now removes every workload it created, leaving no orphaned resources and no errors after teardown
• Platform credentials are injected from a dedicated secrets vault at runtime rather than held in configuration
• Hardening: refresh-token rotation, timeouts on long-running internal operations, and improved background-job resilience

• AI Remediation + Exploitation audit pass - per-tenant LLM budget gate, fair-use limits, and scope re-verification on every generate
• Exploitation pipeline is kind-aware (Audit / Validation / Exploit) with accurate per-run status callbacks
• External-scan findings default to command suggestions - no SSH playbook path to internet-facing targets

• Remediation workflow production-ready - approve loading states, SSE reconnect, retry + verify actions, editable playbooks
• Rescan-to-confirm endpoint closes the loop - re-run the exact finding to verify a fix landed
• Stale-task janitors keep the operator dashboard accurate across pod restarts

• Asset Inventory (8 phases) - bulk import, AI classification, agent-based LAN discovery, cloud sync, re-verification lifecycle, drift detection
• Rules-of-Engagement enforcement - legal scope + asset verification + freshness gate + audit log on every scan
• MSP multi-tenancy (Path B) - per-MSP namespace isolation, GitOps onboarding, 3-tier pricing

The current pentest agent release. Provisioning, installation and updates are handled from your PentestOps dashboard - there is nothing to pull or configure by hand.