Open Source — NoMoreJoel

Why this page exists

NoMoreJoel runs advisory security scans using well-known open-source tools. Scans execute on the control plane (after deploy, daily, or on demand) — we invoke them as separate processes, not as libraries bundled into your application containers. Your servers only run Syft once per release to list the packages in each image; vulnerability matching happens on the control plane.

Security scanning tools

Shown on Security per application

Tool	License	What it checks	Project
Gitleaks Tier-L · Secrets	`MIT`	Detects hardcoded secrets, API keys, and private keys in git repositories after deploy or manual scan.	GitHub ↗
OSV-Scanner Tier-L · Dependencies	`Apache-2.0`	Matches dependency lockfiles and manifests against the OSV vulnerability database.	GitHub ↗
Guarddog Tier-L · Supply chain	`Apache-2.0`	Flags suspicious or malicious patterns in PyPI/npm packages in your repo.	GitHub ↗
Hadolint Tier-L · Dockerfile	`GPL-3.0`	Lints Dockerfiles for security best practices (subprocess only — not linked as a library).	GitHub ↗
Syft SBOM	`Apache-2.0`	Lists every package in a release's images once per deploy (ephemeral container on your server); the SBOM is stored on the control plane.	GitHub ↗
Grype Image vulnerabilities	`Apache-2.0`	Matches stored SBOMs against known CVEs on the control plane — on each release and again after each daily advisory update.	GitHub ↗

GPL & subprocess isolation

Hadolint is GPL-3.0. We run it only as a separate subprocess on our infrastructure — never imported as a library into the product. GPL tools are never installed on tenant servers.

Route & runtime checks

HTTPS/TLS route probes use Python ssl (PSF license) and the cryptography library (Apache-2.0/BSD). These verify certificates and response headers from the control plane — they do not modify your edge configuration.

Full notices

A machine-readable copy lives in the repository as THIRD_PARTY_NOTICES.md for compliance and audits.

Back to Security

v0.10.20 Nov 6, 2026

Deploys of apps without Redis no longer fail the health check

Fixed Apps whose compose file has no Redis service now pass the deploy health check instead of failing with a bare FAIL.
Fixed Deploys that time out during publish or the health check are now reconciled against the server again, so a stack that actually came up is marked succeeded.

v0.10.19 Nov 4, 2026

Export security findings for a coding agent

New Download a markdown brief of the open security findings. It tells a coding agent what to change, where, and when each item is done, and lists sample files and false positives to leave alone.

v0.10.18 Nov 4, 2026

Security findings can be grouped and marked as false positives

Improved The security page is split into Overview, Issues, Packages, and Checks, and each package column is explained.
Improved Matching secret-shaped values in sample folders are shown together as one group.
Improved Mark a group or a finding as a false positive. Later scans still list the match, labeled as a false positive.

v0.10.17 Nov 4, 2026

Every release gets a finished security check

Improved After a deploy, each security check ends with a result, an error, or Off, instead of staying on Waiting.
Improved A release that finished without those checks is checked again within about 15 minutes.
Improved The operator security page shows the version of the scanner that is actually running.

v0.10.16 Nov 3, 2026

Deploys keep running through long builds, and security shows what was checked

Fixed Image builds no longer fail just because the database connection sat idle while the image was building.
Improved Health checks and other background jobs run on their own worker, so they no longer pile up in front of deploys.
Improved Security now lists each check that ran and the packages found in each image.
Improved Adding a database preselects the server your apps already use, and will not create one on a server that does not run them.
Improved New databases install the extensions for their flavor, including vector search.

v0.10.15 Nov 3, 2026

Background jobs and deploys run again

Fixed Deploys, scheduled checks, and other background jobs run again after a library update stopped the job worker from starting.
Improved A control-plane build now fails early if the job worker could not start, so the running version keeps serving instead.

v0.10.14 Nov 3, 2026

Steadier deploys and quieter, clearer vulnerability alerts

Fixed Deploys whose build or soak runs for several minutes now finish or fail cleanly instead of retrying until they time out.
Fixed Route health checks no longer stall or fail every route when one site is slow or unreachable.
Improved Vulnerability checks keep their database between restarts, so they start straight away instead of re-downloading it.
Improved The first vulnerability check of an existing release opens its alert without sending notifications.
Improved Vulnerability alerts count each affected package, and the deploy page shows only the latest result for each image.

v0.10.13 Nov 2, 2026

Every release is checked for vulnerabilities, and re-checked daily

New Every release is checked for known vulnerabilities in its images and re-checked daily as new advisories are published, with no per-server setting to turn on.
New You get an alert when a new critical or high vulnerability shows up in an app after it shipped, and the alert clears once it is fixed.
Improved Security now lists the apps that need attention, and each app shows its issues grouped as vulnerabilities, secrets, dependencies, image build, and site.
Improved The operator Security page shows each security job's last run, result, and error, plus how many live releases are being checked.
Fixed Deploys no longer get stuck in publishing when the post-publish routing check runs long.
Fixed Security checks no longer stall for minutes on servers that cannot be reached.

v0.10.12 Oct 18, 2026

Reuse saved SSH credentials when adding servers

Improved Add server now lets users reuse encrypted SSH credentials already used in the workspace.
Improved Remember the last workspace across login, including for platform operators.

v0.10.11 Sep 15, 2026

Healthy deploys stay succeeded when cleanup never starts

Fixed Deploys that pass health are no longer marked failed if the worker dies before cleanup.
Improved Stale-deploy cleanup resumes unfinished post-health runs so symlink and cleanup can finish.

v0.10.10 Sep 15, 2026

Remove leftover cloud servers even when the VM is already gone

Fixed You can remove a cloud server even if the machine no longer exists at the provider.
Fixed Server removal no longer fails because of leftover route-migration history.

v0.10.9 Sep 14, 2026

Keep the control plane up when a server check gets stuck

Fixed A stuck check against a dead or moved server can no longer take the whole product offline.
Improved The site stays reachable while the control plane is starting, even if database cleanup is waiting.
Improved Servers you have already moved off no longer send metrics that slow the control plane.

v0.10.8 Sep 14, 2026

Stop retrying dead servers, and remove unused Postgres after a move

Fixed Unreachable servers are checked once then backed off, so deploys and moves are not stuck behind failed SSH.
New You can remove an unused Postgres host with no databases left, even if the old machine is offline.
Improved After you move workloads off a server, background checks stop until diagnostics succeed.

v0.10.7 Sep 9, 2026

Evacuate retry still ships remaining apps instead of only switching DNS

Fixed If a move deploy fails, starting again now deploys the other apps instead of finishing with sites still down.

v0.10.6 Sep 9, 2026

Evacuate finishes after DNS cutover instead of getting stuck

Fixed After DNS cutover, Move workloads now marks the evacuate complete instead of sitting on Soak forever.

v0.10.5 Sep 8, 2026

Complete cutover no longer fails because the old apps were stopped for the move

Fixed Complete cutover no longer stops with an unhealthy-route error after freeze. A-record moves finish even if leftover traffic-shift settings are on the route.

v0.10.4 Sep 8, 2026

Complete cutover no longer crashes after you confirm

Fixed Complete cutover no longer crashes with an internal error after you confirm.

v0.10.3 Sep 8, 2026

Complete cutover no longer waits for public DNS, and Cloudflare proxy IPv6 is not treated as a zone AAAA

Fixed Complete cutover finishes the move after you confirm, even while public DNS still points at the old server.
Fixed Cloudflare orange-cloud IPv6 is no longer shown as AAAA records you need to delete — those addresses are not in your DNS zone.

v0.10.2 Sep 8, 2026

Evacuate can retry after failure and no longer health-checks the old public hostname

Fixed Evacuate no longer fails because it probed the old public URL while DNS still pointed at the source server.
Fixed After a failed evacuate you can start again from Move workloads, restore source apps when nothing copied, or see that workloads already landed on the target.
Improved Auto-deploy is turned back on when DNS cutover finishes, and source apps restart if freeze failed mid-stop.

v0.10.1 Sep 8, 2026

Move workloads page loads again during an active evacuate

Fixed Fixed an internal error on the Move workloads page when an evacuate run was in progress (Jinja treated move_live.items as a dict method, not the item list).
Fixed Fixed a crash when stale databases were listed during evacuate planning.

v0.10.0 Sep 8, 2026

Server evacuate is production-ready with clear failures

New Whole-server evacuate copies databases, volumes, and apps to another VPS, runs backups automatically, and walks you through DNS cutover.
Fixed Evacuate no longer blocks at server quota when you pick an existing target, and shared Postgres dumps bypass row-level security policies.
Improved When evacuate fails, the wizard shows the failed deploy step, error details, and links to the deploy log instead of a generic Deploy failed message.

v0.9.4 Sep 8, 2026

Failed evacuate runs explain what broke

Fixed Evacuate no longer stops with a useless Deploy failed message — it surfaces the failed deploy step, error text, and links to the deploy log.
Improved Move workloads shows failed items, failed step name, and live error details while a run is in progress.

v0.9.3 Sep 8, 2026

Evacuate survives Postgres row-level security on shared databases

Fixed Database backup and move dumps on shared Postgres hosts now use the host admin role so tables with row-level security (for example agent_actions) no longer block evacuate.
Improved Failed server evacuate runs show the error message and live log on the Move workloads page.

v0.9.2 Sep 8, 2026

Evacuate backs up databases for you instead of stopping you

Fixed Move workloads no longer blocks when a database has no recent backup on file.
Improved Whole-server evacuate runs a backup automatically at the start if one is missing, before apps are frozen.

v0.9.1 Sep 8, 2026

Evacuate no longer blocks when you already have a target server

Fixed Move workloads no longer shows a false server-quota blocker when you are at your limit but can pick an existing server as the target.
Improved Selecting a target server on the evacuate wizard now clears blockers and enables Start move.

v0.9.0 Sep 8, 2026

Move an entire server to a new VPS in one guided evacuate

New Whole-server evacuate copies databases, app volumes, and deployments to a ready target server, then walks you through DNS cutover with an honest downtime clock.
New Server detail has a Move workloads wizard; decommission no longer supports metadata-only moves, and delete blocks while databases remain.
Improved Per-database Move still works on its own; sslip test routes get new URLs on the target when the server IP changes.

v0.8.12 Sep 3, 2026

Deploys start even when background jobs pile up

Fixed Deploys were waiting for hours because background health checks flooded the job queue until it crashed. That loop is stopped, so queued deploys can start.
Improved The control plane now applies Redis memory settings on the next deploy instead of leaving a crash-looping job broker in place.

v0.8.11 Aug 20, 2026

Fix invited teammate login and password sharing

Fixed Invited teammates can finish first sign-in. The one-time password change after a workspace invite no longer fails.
New Workspace admins can reset a member password and copy a message to send (sign-in URL, email, and temporary password). Credentials are no longer placed in the page URL.
Improved The sign-in page tells invited teammates to use the email and temporary password they were sent, instead of sending them to create an account.

v0.8.10 Aug 10, 2026

Fix false Never scheduler jobs and reduce worker starvation

Fixed Operator Scheduler job types now use aligned enqueue/worker IDs so paired runs show correctly instead of false Never.
Improved Security, disk reclaim, and stale-cleanup jobs appear in the catalog with Run now actions.
Improved Scheduler boots stagger first ticks for route health and signal engine; route health SSH probes fail fast so concurrency-1 workers are not blocked for minutes.

v0.8.9 Aug 10, 2026

Clearer orphan queue cleanup on Scheduler

Improved When misrouted Celery tasks pile up on the unused celery queue, Operator Scheduler shows a top-of-page purge banner with a clear explanation and button.
Improved Alert sweep results explain when nothing was closed, and clarify that sweep does not clear Celery queues.
Improved Worker queues show plain-language labels, what the worker is doing now, and separate Close recovered alerts from queue purge.