Changelog: 8 entries

src/content/changelog/2026-08-18-authentik-access-review-source.mdx

@@ -0,0 +1,14 @@
+---
+title: "authentik as an Access Review Source"
+description: "Access Review can now pull user and MFA data straight from authentik, so teams running their own identity provider don't need a manual export to run a review."
+date: 2026-08-18
+images: ["/changelog/2026-08-18-authentik-access-review-source-1.png"]
+imagesLayout: "logos"
+tags: ["Access Review"]
+---
+
+Access Review now connects to authentik. Add the instance URL and an API-intent token, and Probo pulls in users and their MFA status for the next campaign.
+
+MFA status comes from authentik's own authenticator devices. When a device type can't be read, Probo marks that account's MFA as unknown rather than guessing it's off, so a review doesn't quietly under-report weak accounts.
+
+If your team self-hosts identity instead of using Okta or Google, this closes a gap that used to mean manual spreadsheets.

src/content/changelog/2026-08-18-probot-slack-bot.mdx

@@ -0,0 +1,15 @@
+---
+title: "Probot: Compliance Notifications in Slack"
+description: "Employees can link their Slack identity to their Probo account with /probot login, then get compliance review and approval notifications right in Slack, complete with action buttons for each request."
+date: 2026-08-18
+images: ["/changelog/2026-08-18-probot-slack-bot-1.png"]
+tags: ["Integrations"]
+---
+
+Probot is your Slack bot for Probo. Run /probot login in Slack and it links your Slack identity to your Probo account.
+
+Once you're linked, compliance review and approval requests show up as Slack messages instead of emails you have to go dig up later. Each notification carries buttons for the specific action it needs, approve a request or sign off on a review, right in the thread.
+
+Bound users can also drive Probo actions from a channel by talking to the bot directly.
+
+Admins manage the whole setup from Settings: install the Slack app, pick the channel, and see who's linked their identity.

src/content/changelog/2026-08-21-access-review-calendly-cal-com.mdx

@@ -0,0 +1,14 @@
+---
+title: "More Access Review Connectors"
+description: "Access Reviews now connect to Calendly and Cal.com over OAuth, including Cal.com team accounts, so scheduling tool access shows up alongside every other connector in the same review."
+date: 2026-08-21
+images: ["/changelog/2026-08-21-access-review-calendly-cal-com-1.avif", "/changelog/2026-08-21-access-review-calendly-cal-com-2.png"]
+imagesLayout: "logos"
+tags: ["Access Review"]
+---
+
+This release adds Calendly and Cal.com to Access Reviews. Both connect over OAuth, and Cal.com also supports team accounts, so you can pull in access data for an entire team's bookings in one pass.
+
+Scheduling tools carry real access: calendar visibility, contact details, sometimes call recordings. Before this, checking who had access meant leaving Probo to check each tool by hand.
+
+Connect Calendly or Cal.com from the Access Review sources page. Each user's access gets pulled into your existing review cycle, same audit trail, same approval flow as every other connector.

src/content/changelog/2026-08-24-new-access-review-connectors.mdx

@@ -0,0 +1,16 @@
+---
+title: "New Access Review Connectors"
+description: "Access Review now connects to GitHub App installations and Resend, so you can pull in access data from two more tools without setting up a workaround or a manual import."
+date: 2026-08-24
+images: ["/changelog/2026-08-24-new-access-review-connectors-1.png", "/changelog/2026-08-24-new-access-review-connectors-2.svg"]
+imagesLayout: "logos"
+tags: ["Access Review"]
+---
+
+This release adds GitHub App and Resend as Access Review connectors.
+
+For GitHub, you can now authorize a GitHub App installation instead of pasting a personal access token. Probo mints short lived installation tokens automatically and keeps checking the connection's health with checks that understand the GitHub App protocol.
+
+Resend connects the same way as our other CIMD backed integrations. Point Probo at your Resend account and access entries start flowing in on the next sync.
+
+Both connectors show up wherever your other Access Review sources do, with sync status and next steps on the same screen.

src/content/changelog/2026-08-25-chatgpt-codex-mcp-oauth.mdx

@@ -0,0 +1,11 @@
+---
+title: "ChatGPT and Codex Can Now Log In to Probo's MCP"
+description: "ChatGPT and Codex can connect to Probo over MCP with a real OAuth login instead of a workaround, using resource bound tokens so each connection is scoped to your Probo organization."
+date: 2026-08-25
+images: ["/changelog/2026-08-25-chatgpt-codex-mcp-oauth-1.svg", "/changelog/2026-08-25-chatgpt-codex-mcp-oauth-2.png"]
+tags: ["Integrations"]
+---
+
+Probo's MCP server now speaks the OAuth dialect that ChatGPT and Codex expect. Both clients negotiate the auth method through CIMD and get issuer identification per RFC 9207, so the connection sets itself up correctly on the first try instead of failing on a mismatched flow.
+
+Access and refresh tokens are bound to your Probo organization as the resource, so a token minted for one org cannot be replayed against another. If you tried connecting ChatGPT or Codex to Probo before and hit a wall, it's worth trying again.

src/content/changelog/2026-08-25-tracker-catalog-attribution.mdx

@@ -0,0 +1,10 @@
+---
+title: "Attribution Labels on Tracker Pages"
+description: "Tracker pages in the console now show whether a script is a known vendor, first party code, or still being identified, even when the underlying catalog entry has no vendor name of its own."
+date: 2026-08-25
+tags: ["Cookie Banner"]
+---
+
+Every tracker Probo detects gets checked against a catalog of known vendors. Some catalog entries do not carry a vendor name of their own, for example first party scripts or ones still being identified. Those trackers used to show up with no attribution at all.
+
+Now the console, GraphQL API, and MCP all surface that verdict directly on the tracker page: vendor name when we have one, first party, or still identifying. You get a clearer picture of what is actually running on your site without digging through the catalog separately.

src/content/changelog/2026-08-26-nda-pdf-upload.mdx

@@ -0,0 +1,11 @@
+---
+title: "NDA Uploads via PDF Drop"
+description: "The compliance portal's NDA card now accepts a PDF dropped straight onto it, with download and delete controls up top and the full signature history behind an activity popover."
+date: 2026-08-26
+images: ["/changelog/2026-08-26-nda-pdf-upload-1.png"]
+tags: ["Compliance Portal"]
+---
+
+Setting up an NDA for your compliance portal no longer means digging through a separate upload flow. Drop a PDF onto the NDA card and it's live.
+
+Download and delete controls sit right in the card header, and if you need to check who signed what and when, the full signature audit trail is one click away behind an activity popover instead of cluttering the card itself.

src/content/changelog/2026-08-26-treatment-plans-risk-analyses.mdx

@@ -0,0 +1,13 @@
+---
+title: "Treatment Plans for Risk Analyses"
+description: "Risk analyses now hold a dedicated treatment plan for each risk with its own score, treatment choice, and owner, and linked measures move it from inherent toward residual automatically."
+date: 2026-08-26
+images: ["/changelog/2026-08-26-treatment-plans-risk-analyses-1.png"]
+tags: ["Risk Management"]
+---
+
+Until now, treatment lived loosely attached to a risk, and reusing it across a new period meant copying values by hand. Now each treatment plan is tied to one risk and one analysis. The risk still needs a spot on the scenario map, but once it's there you can set a score, pick a treatment, and assign an owner directly on the plan.
+
+Linked measures do the rest. As they get implemented, the plan's risk level moves from inherent toward residual on its own, except for risks marked Accepted, which stay at inherent since there's nothing left to mitigate.
+
+Risk analysis pages also split the heatmap from the plan table, so you're not scrolling through diagrams to find open action items.