Takumi Guard now lets you send a test breach notification from the settings page, so you can verify that your webhook endpoints and email addresses actually receive notifications before a real malicious-package advisory ever lands.
Takumi Guard now supports Go modules alongside npm, PyPI, and RubyGems.
Go projects can now route go get, go mod download, and go build through Takumi Guard to block known-malicious modules before they reach your CI or development environment.
We've published flatt-security/takumi-guard-portal-example, an open-source example portal that lets your developers self-mint Takumi Guard organization user tokens (tg_org_) behind your own identity provider, without ever distributing a shared bot credential to developer machines.
You can now issue, list, revoke, and probe Takumi Guard organization user tokens (tg_org_) through bot-authenticated endpoints on the Takumi API. CI/CD pipelines, onboarding scripts, MDM tooling, and other automation can manage Guard tokens programmatically without going through the console.
Takumi Guard setup scripts v0.5.0 add five primitive subcommands that let administrators compose custom rollout flows, plus a new one-token-per-device deployment example built on top of them. The v0.4.x positional-argument invocation continues to work unchanged, so existing rollouts upgrade transparently.
OIDC federation between GitHub Actions and Takumi Guard / Shisho Cloud now operates reliably even when connectivity to GitHub is unstable.
Takumi blackbox assessments now crawl more pages within the credit limit you set, improving endpoint discovery coverage.
Takumi Guard now supports RubyGems alongside npm and PyPI.
Ruby projects using Bundler can now route installs through Takumi Guard to block known-malicious packages before they reach your CI or development environment.
Vulnerability Verification now supports vulnerabilities beyond Takumi assessment results. You can verify findings from bug bounties, third-party audits, and other sources directly in Takumi.
Takumi Guard now supports organization-level breach notifications. When a package you previously downloaded through Guard is later flagged as malicious, notifications can now be delivered to a webhook endpoint and an email address that your organization chooses.