Changelog
What has changed
Releases of the platform and corpus. Corrections to records are logged separately on the dataset page.
· 2026.10.17-seo-visuals
Complete diagrams, easier-to-scan pages and honest usage counts
- Animated diagrams now show the whole flow before they play, including for visitors who prefer reduced motion. The collection diagram adds OSV, SEC incident filings (checked every six hours) and the permanent archive, and the API reference shows what happens to one request.
- The verification page summarises each test suite as a grid of passes and failures, with every case one click away. The API reference lists MCP tools and limits as cards and a table.
- Internet-wide security scanners are no longer counted as AI clients or analyses. The impact page now also shows dataset downloads and pages that ChatGPT or Claude fetched to answer someone.
- Shorter page titles that fit in search results, and search engines are notified of changed pages after each release.
· 2026.10.16-review-recovery
Keep your review progress when you return
- Analysis safeguard checkmarks and export format now survive refreshing or opening an incident and returning. Choices stay in the current browser tab and are kept separate for each result.
- Editing a shared analysis starts a new review URL, so refreshing retains the edited design and its app files instead of restoring the original shared proposal.
· 2026.10.15-readable-workflows
Clearer analysis, export and reference pages
- Exports sit directly after the safeguard checklist, with six visual format choices, counts reflecting your checkmarks, save locations, and a complete preview that opens on request.
- Analysis cards show concise summaries and shared conditions first. Match explanations, incident-specific rules and examples expand when needed; score breakdowns and animations remain available.
- Long reference pages have section links on phones and desktops. API endpoints use responsive cards with request fields on demand, and older dataset corrections stay available in an expandable archive.
- Methodology shows all four evidence types, including incident disclosures. Comparison badges wrap on small screens, headings stay readable during scrolling, and analysis controls appear without entrance delays.
· 2026.10.14-feed-recovery
Larger advisory feeds and clearer health alerts
- Stream NVD’s bulk feed without holding the complete decoded document in memory, preserving newest-first selection and archived source objects.
- Separate availability probes from advisory-freshness checks in the uptime workflow; report per-source errors and last successful refresh times.
· 2026.10.12-calm-motion
Calmer animations with one clear timeline
- Animated explanations use one seekable timeline and steady step buttons, replacing the competing progress bars. Captions stay in place and reserve enough room for every step.
- Systems stay still while messages move between them; status changes fade in without bouncing boxes or shaking messages. Pattern gallery previews stay still until you open the full explanation.
- The product tour uses one timeline with numbered chapter buttons and visible playback controls. It pauses in hidden tabs and when reduced-motion preferences change.
· 2026.10.12-visuals
More ways to explore the evidence, with accessible motion
- Dataset composition ring with exact counts and links to all four evidence types; filtered incident charts and documented incident coverage by failure pattern.
- Visual analysis score components, checklist progress by pattern on every screen size, and measured self-check durations on the verification page.
- Daily charts support touch and arrow keys, keep exact UTC tables, and draw zero values as zero. Framework bars and integration steps animate into view.
- Incident and analysis pages offer animations of their classified patterns, loaded on request. Animated explanations have a seekable timeline, pause in hidden tabs, and respect changes to reduced-motion preferences. Reduced-motion step buttons keep the selected caption and diagram together.
- Incident filters follow same-page links and browser history. Checklist totals ignore obsolete saved checks, and unsuccessful copying is reported accurately.
· 2026.10.02
See it happen: animated explanations, a launch checklist and a glossary
- Every failure pattern now has an animated, interactive explanation: watch the failure unfold step by step, then the same situation with the safeguard in place.
- A one-minute product tour on the home page, with chapters you can jump between.
- New pre-launch safety checklist: 42 checks drawn from real incidents, saved in your browser and exportable as Markdown.
- New glossary of 20 reliability and AI-safety terms, from idempotency keys to the Model Context Protocol, each explained through a real incident.
- The methodology, dataset, impact and about pages were redesigned around diagrams and animations instead of long paragraphs.
- Fixed: security advisory pages from GitHub returned “not found”, and some CISA records linked to several URLs joined into one. Links to the private source repository were removed.
· 2026.10.01.2
Verification: live test suites, production self-checks and matching fixes
- New Verification page: 17 production self-checks run every two hours and are published with a run history, alongside the latest release test report (HTTP and browser suites against the live site, with screenshots and a PDF).
- Fixed defects found by live testing: deletion-related designs (such as the home page's cloud cleanup example) returned no precedents; multi-tenant designs ranked unrelated breaches first; early clicks could be lost before pages became interactive; cached pages could reference a previous build for a few minutes after a deploy.
- Added a bounded likely-pattern ranking signal. Internal benchmark recall@5 improved from 0.43 to 0.53 and precision@3 from 0.43 to 0.50, while unrelated designs still return no results.
- Automated test traffic is excluded from public usage statistics.
· 2026.10.01
Platform redesign: server-rendered pages, framework crosswalk, impact reporting
- New design system and a rebuilt interface: a focused analyzer, a safeguards-first results page with exports for AGENTS.md, CLAUDE.md, Cursor and Copilot, and faster navigation.
- Every incident, failure pattern and framework now has its own server-rendered page with structured data, so search engines and AI assistants can read and cite them. Old URLs redirect permanently.
- Framework crosswalk mapping failure patterns and incidents to the OWASP Top 10 for Agentic Applications (2026) and for LLM Applications (2026), NIST SP 800-53, the NIST SSDF and AI RMF, the CISA Secure by Design pledge and CWE.
- Public impact page with privacy-preserving usage measurement (no cookies; daily-rotating hashes), daily CSV export and service status.
- MCP server updated to current Streamable HTTP behavior with protocol-version negotiation, tool annotations, structured output and new get_incident and get_safeguards tools, at the shorter URL https://collectsea.com/mcp.
- Open dataset downloads (JSON, CSV, JSONL) under CC BY 4.0, an Atom feed of new incidents, and llms.txt.
- Corrected safeguard lessons, plain-language headlines for older records, and illustrative scenarios capped at one per analysis.
- Removed features that did not hold up: the simulated "risk reduction" percentages, the generic architecture diagram, and the public button that triggered corpus synchronization.
· 2026.09.30
Evidence tiers, re-verified sources and semantic retrieval
- Every record carries a visible evidence type: documented incident, security advisory or illustrative scenario.
- Re-verified every curated incident against a primary source, added real dates, replaced template safeguards with incident-specific ones, and demoted five records with no findable source.
- Added 20 source-checked incidents, including major cloud outages (AWS, Google Cloud, Meta, GitHub, Cloudflare, Slack, Roblox), breaches (Uber, LastPass, MOVEit, Log4Shell) and AI-agent failures (Replit, Amazon Q, GitHub and Supabase MCP prompt injection, EchoLeak, Air Canada).
- Added four failure patterns and semantic retrieval with Workers AI embeddings; analysis falls back to lexical matching if the AI call fails.
- Rebuilt the internal benchmark on real incidents only.
· 2026.08.30
Evidence integrity and production audit
- Reclassified bundled records as machine-extracted candidates until source-specific human adjudication is recorded.
- Separated source-attributed facts from CollectSEA inferences and exposed public review-status totals.
- Removed unsupported coverage claims and made benchmark limitations explicit.
· 2026.08.27
Corpus quality gates and operations
- Authenticated corpus review queue with approve, correct and reject decisions.
- Bounded NVD ingestion, explicit CVE identity, rejection reporting and cross-feed deduplication.
- CI-gated production deployment with startup validation and structured logs.
· 2026.08
MCP server and public corpus
- Model Context Protocol endpoint so AI assistants can query CollectSEA directly.
- Scheduled ingestion every two hours from GitHub Security Advisories, CISA KEV and NIST NVD.
· 2026.07
Analogy matching and internal benchmark
- Behavioral capability classifier and transparent multi-factor analogue scoring.
- Internal regression benchmark for retrieval quality.
· 2026.06
Launch
- First public release of CollectSEA (Collective Software Engineering Analogues) with the initial failure-pattern taxonomy.