Versions

Updated September 13, 2026

What changed in each release of Kryptic: the product you sign into and run secrets from. The latest release is 1.7.1. Platform and Management Client share the same vX.Y.Z tag (or vX.Y.Z-NN on a support hotfix). The self-host chart versions on its own. KRYPTIC_VERSION selects the product images.

Language SDKs, the daemon, the Kubernetes operator, and the encryption libraries version on their own. Their notes live with each of those products.

1.7.1

Invitation MFA setup stays on the accept page. Daemon sessions say macOS, Windows, and Linux. The dashboard footer matches the release tag.

1.7.0

Organization authentication policy, MFA enrollment and remembered browsers, and durable daemon device trust. Owners set these under Settings.

Added

• PUT /api/organization/authentication sets require-MFA, remember-browser for MFA, login expiry, and durable daemon device trust.
• Password login can require TOTP before a session exists. Disable is blocked while the org requires MFA.
• Remember-browser cookie skips TOTP for 30 days on that user after a successful challenge.
• Known daemon devices with proof of possession skip Approvals when durable device trust is on.
• GET /api/roles/assignable lists roles that can be invited or assigned.

1.6.0

Action-level permissions and organization roles. Owner, Admin, Developer, and Viewer are seeded on signup. Owner is immutable and always has the full catalog. Custom roles and edited default bags need Enterprise on cloud, or advanced-rbac on a self-hosted licence.

Added

• [AuthorizeKryptic] checks action permissions. GET/POST/PUT/DELETE /api/roles manages the bags.
• /api/auth/me returns roleId, roleName, permissions, and advancedRbac.
• Staff can cancel or delete a customer's Stripe subscription from the Internal console (Admin staff role).

Changed

• Environment update and delete need ReadWrite on the target environment. Reorder and set-default need it on every environment in the project.

Fixed

• Microsoft sign-in accepts accounts whose id_token omits email_verified. An explicit false still blocks linking and signup.

1.5.2

Device approve works with the session cookie: the Daemon BFF uses the same CORS rules as the Management API. Each API host logs a TokenKey fingerprint at startup so a mismatched signing key is obvious.

1.5.1

Staff can send platform announcements and the public newsletter from the Internal console, with HTML preview and a recipient role filter.

1.5.0

Security updates across sign-in, sessions, and machine identities.

Changed

• Web sessions now live in an httpOnly cookie instead of browser storage. Existing sessions migrate on first load; you stay signed in.
• New machine identity client secrets use a ksm2_ prefix. Existing secrets keep working; rotating an identity moves it to the new format.
• Security updates and hardening across the APIs.

1.4.0

Optional TOTP for password accounts, Nexus registry lifecycle from the Internal console, and staff can delete platform error log rows.

Added

• Optional TOTP two-factor authentication for email/password accounts: authenticator QR setup, recovery codes, and a login challenge.
• Staff can deactivate, activate, or delete a customer's Nexus registry pull account from the Internal console.
• Staff can delete a platform error log entry.

1.3.15

Signup can start on kryptic.dev/register and hand the session to the app.

Added

• OAuth register from kryptic.dev may use /oauth/callback on the public site, then hands the session to the management app.

1.3.14

Registry-access mail links the newest published air-gap tarball, and heartbeat alerts wait 30 seconds before paging.

Fixed

• Registry-access mail links the newest kryptic-airgap-X.Y.Z.tar.gz on https://nexus.webservices.theka.io. It lists Nexus for the latest published tarball instead of using the Internal API image tag or the in-cluster Nexus URL.

Changed

• Internal heartbeat alerts wait 30 seconds and re-probe before emailing a slow or down service, so a short rollout blip does not page.

1.3.13

Successful /health probes no longer fill the console.

Changed

• Console request logs skip successful /health probes. Information lines for real requests stay. Failed health checks still log.

1.3.12

Secret version caps stay at the plan limit, self-host databases keep only product tables, and plan switches require a Stripe card.

Fixed

• Free (and other capped plans) keep at most N secret versions. Trim now counts the version added in the same write.
• Plan and billing-interval changes fail clearly when Stripe has no payment method, instead of previewing an invoice on a trial.

Changed

• Management API no longer migrates the site and docs schemas. Internal API applies those on Theka.

1.3.11

Registry-access mail names the kit Helm chart kryptic-helm-X.Y.Z.tgz.

Changed

• Registry-access mail names the kit chart as kryptic-helm-X.Y.Z.tgz.

1.3.10

Registry-access mail links the air-gapped image bundle instead of attaching it, and the mail is restructured around set-password and a details card.

Fixed

• Registry-access issue and rotate no longer download the air-gap tarball into the Internal API.

Changed

• Registry-access mail links docker/kryptic-airgap-X.Y.Z.tar.gz on the raw repo. Users download it with their registry credentials.
• Registry-access mail is restructured: set-password button first, then username, image tag, and chart version, then downloads.

1.3.9

Registry-access mail attaches the air-gapped image tarball.

Changed

• Registry-access mail attaches kryptic-airgap.tar.gz (docker-saved images) from Nexus, next to the Compose kit zip.

1.3.8

Registry-access mail names the image tag, chart version, and install docs.

Changed

• Registry-access mail includes the image tag (KRYPTIC_VERSION), the Helm chart version, and a link to the self-hosting docs.

1.3.7

Platform and Management Client are v1.3.7. The 1.3.7 chart defaults KRYPTIC_VERSION to that tag.

Changed

• Self-host image pins are the exact product tag, not the 1.3 band.

1.3.6

Licence 402s reach the dashboard toast.

Fixed

• Self-host licence 402 responses include CORS headers, so the dashboard toasts the expiry message instead of "Failed to fetch".

1.3.5

Empty self-host licence key is unlicensed, not Business.

Fixed

• Self-hosted installs with no licence key no longer resolve to Business. Writes stop; existing secrets stay readable.

Changed

• Registry-access kit zip includes values.example.yaml for Helm.

1.3.4

X.Y.Z tags only. Registry-access mail picks the newest versioned Compose kit.

Changed

• Release tags are vX.Y.Z only. Image floating tags stay on 1.3.
• Staff registry-access mail attaches the newest kryptic-selfhost-X.Y.Z.zip from Nexus.

1.3.3.4

Compose kit on the registry-access mail.

Added

• Staff registry-access mail attaches kryptic-selfhost.zip from Nexus. Issue and rotate fail if the kit is missing.

1.3.3.3

The rest of the mail templates on the light grey card.

Changed

• Registration confirm, payment failure, status, and heartbeat mail use the same compact grey canvas as invitations.
• Email headers use uppercase KRYPTIC next to the mark.

1.3.3.2

Transactional mail on a light grey canvas.

Changed

• Emails use a compact white card on grey, so short mail panes crop the page background instead of the message.

1.3.3.1

Dashboard-only patch.

Changed

• Register only offers Google, GitHub, Microsoft, and Entra ID. Okta and JumpCloud stay on sign-in. They join an existing SAML connection, they cannot create an organization.

1.3.3

Self-host first login without mail, one organization per instance, and billing from the signed key.

Changed

• Self-hosted password signup creates the organization immediately. There is no confirmation email.

Fixed

• Self-hosted billing uses the signed key's plan, seat cap, and expiry.
• A self-hosted instance accepts only one organization.

1.3.2

SMTP for self-host mail, the instance licence on the box, and the dashboard origin.

Added

• Self-hosted installs send mail over SMTP when SMTP_HOST is set.

Changed

• A self-hosted instance uses the signed licence for plan and seat cap.
• The management API accepts the dashboard origin from ManagementClientUrl.

1.3.1

Paged project list and name search.

Changed

• The projects list is paged. Search matches project name. You only see projects you can open.

1.3.0

Self-host registry pull accounts, and tag-only image releases.

Added

• Email signup asks for organization, name, and email first. Continue checks that the address can register, then asks for the password twice.
• Staff send a one-time link from the customer record so the customer can set a Nexus pull password. The mail has the username and https://kryptic.dev/registry-access?token=.... Staff never see the password. A rotate sends a new link for the same username.

Changed

• Platform and management-client images publish from a vX.Y.Z git tag. A patch on an older line (for example v1.2.2 while main is 1.5.2) still lands on Nexus under that version, and does not move production GitOps or :latest.

Patch.20260906.2

Organization-wide shared secrets on Business and Enterprise.

Added

• Owners and admins get a Shared secrets catalog: one set of keys, environments, and labels for the whole organization.
• A project secret can be an org reference. Each project environment maps to a catalog environment. Rotate the catalog value once and every linked project picks it up.
• After a fallback to Free or Team, existing catalog values and links keep working. You cannot create, edit, or add new links until you are back on Business or Enterprise. Unlink stays allowed.
• When a developer changes an org reference, the write waits for an owner or admin as a change request.
• New organizations get development, staging, and production on the catalog. They stay unused until you link them.
• Catalog keys use the same rotation reminders as project keys. Due items show on the dashboard as shared/key.

Patch.20260906

Yearly billing, Stripe-native trials, and clearer what happens when a trial or paid plan ends without payment.

Added

• Team and Business can be billed yearly (two months free versus monthly).
• Trials create a Stripe subscription with no card required. Add a payment method in Plans & billing before the trial ends.
• If a trial ends without a card, or a paid plan is cancelled or fails renewal after a 3-day grace, the organization returns to Free. The Owner and up to two Admins stay active; other members are disabled until you subscribe again and re-enable them.
• Failed renewals send owner emails at the start of the grace and again about 24 hours before Free downgrade.

Changed

• Plans & billing after subscribe focuses on status plus Change seats, Change plan, and Change billing.
• Seat bands are Free up to 3, Team up to 25, Business up to 200, Enterprise unlimited.
• Adding seats, plan upgrades, and monthly-to-yearly go through Stripe Checkout. Seat reductions and yearly downgrades wait for renewal. No mid-cycle refund.

Patch.20260905

Work since the September 1 launch. Signing up with an email and password waits until you confirm the address. Signing in with Google, Microsoft, or GitHub can create the organization for you. Your login password and your vault passphrase stay separate steps.

Added

• Password signup sends a confirmation email. The organization is created after you click the link.
• Google, Microsoft, and GitHub can create an organization when the email is new and no other organization already uses that domain.
• After you join with one of those providers, you can name the organization.
• You can change your vault passphrase. People who already have access keep it.
• Directory import shows a preview. You pick which users and groups to bring in before anyone is created.
• A reference secret can reuse the value of another secret in the same project. Exports and reveals follow that link. You change the original, not the alias, and you cannot delete a secret that others still point at.
• When a developer updates a secret, the change request waits for an owner or admin. They can approve or deny it. The person who asked can cancel.
• Secrets rotation reminders, once or on a schedule. Due items show on the dashboard. If you do not pick who to notify, owners and admins are emailed.
• You can now reveal a past version of a secret before restoring it.
• Adding seats goes through checkout. Removing seats keeps what you already paid until the next renewal. There is no refund.
• Access requests expire after 7 days.

Changed

• You cannot sign in with a password until the email is confirmed.
• Owners who signed up with Google, Microsoft, or GitHub can delete the organization without a login password. Owners who use a password still confirm with that password.