9:41
Riverstone
Product updates

Changelog

Every fix, release and hardening note shipped to Riverstone vaults.

August 15, 2024 Security
Verify Riverstone CLI signature
# signature verification needs GnuPG apt-get install gnupg -y # fetch + verify the CLI binary curl -Ls --tlsv1.3 --retry 3 \ https://cli.riverstone.dev/setup.sh \ | sh -s -- --verify-signature

Signed binaries for the install script

Installing the CLI through setup.sh now checks the release signature before anything touches your shell. Pass --verify-signature to make it mandatory in CI.

Ines Delacroix — portrait by Jake Nackos on Unsplash Ines Delacroix Platform Security v3.4.1
June 27, 2024 Launch

Scoped service tokens, per environment

Tokens can now be pinned to a single project, environment and config path, so a build runner never sees more than the secrets it was issued.

  • Read-only and rotate-only scopes
  • Expiry down to 15 minutes
  • Revocation propagates in under 4s
Marcus Adeyemi — portrait by Korede Adenola on Pexels Marcus Adeyemi Access Engineering v3.3.0
April 12, 2024 Compliance

SOC 2 Type II report renewed

Teams trust Riverstone with 6.4M secret reads a day, so we re-ran the full audit window with no exceptions raised. Read the summary report for scope and controls.

Priya Raghunathan — portrait by Foto Sushi on Pexels Priya Raghunathan Trust & Risk Audit 24-B
February 01, 2024 Security

Disclosure program is now public

Researchers no longer need an invite. Scope, safe-harbour terms and payout bands are published alongside a 72-hour first-response commitment.