Changelog

What changed

Our roadmap listed Docker-in-Docker for Test Coverage for Q3 2026: DebtDrone would run your test suites in containers during hosted scans to measure coverage. We have withdrawn that item. It never shipped, and we will not run arbitrary customer test suites during hosted scans.

It is replaced by Coverage from your CI reports, now on the roadmap for Q4 2026 and in progress. Here is how it will work:

• You upload the coverage report your existing CI already produces; DebtDrone does not execute your tests.
• The report will be tied to the commit DebtDrone scanned, so coverage always describes the code that was analyzed.
• Supported formats: Go coverprofile, LCOV, Cobertura, JaCoCo, Clover, and SimpleCov.
• A repository without a report for that commit will show coverage as unavailable, not 0%.

Why

Running your test suite means running your code, with its dependencies, network access and secrets, on our infrastructure. That is a large security and reliability surface to add to every scan, and it would still be less accurate than the environment your CI already maintains for those tests. Importing the report you already have keeps scans predictable and leaves test execution where it belongs.

Coverage stays optional: complexity, dependency and security findings do not depend on it.

Rich PDF reports

Download PDF on any report now generates a properly designed document — DebtDrone branding, health stats, and the dependency/complexity findings laid out for reading and sharing, not a screenshot of the dashboard. Previously this just triggered your browser's print dialog; it's now a real PDF built and rendered on our servers, so it looks the same regardless of what browser or OS you're on.

Team management

• Invite by email — org owners and admins can invite teammates directly by email with a role (owner/admin/member/viewer) instead of only adding people who already have a DebtDrone account.
• Verified domains — on plans with SSO, you can verify ownership of your company's email domain (via a TXT DNS record) and let anyone signing up with that domain request to join your org automatically, instead of inviting each person one by one.
• Join requests — requests from a verified domain show up in Team Members for an owner/admin to approve or deny.

SSO fixes

• Logging in with a work email tied to an SSO organization now automatically redirects to your identity provider — no need to know to look for a separate "Sign in with SSO" option.
• The SAML configuration page now correctly restricts uploading/editing Identity Provider metadata to org owners and admins; other members see a read-only view instead of an upload form they can't use.

Downloadable reports

Every scan report now has a Download menu with two options:

• PDF — a print-formatted version of the full report (health grade, severity/type breakdowns, hotspot files, and the top issues by debt hours), ready to attach to a doc or send in an email.
• CSV — the complete issue list for that run, one row per issue, for further analysis in a spreadsheet.

Share a report publicly

Click Share on any report to generate a public link. Anyone with the link can view a read-only version of that report — the same data, in a simplified view with no sign-in required. This is useful for looping in a stakeholder, a client, or anyone else who doesn't have (or need) a DebtDrone account.

Share links can be revoked or regenerated at any time from the same dialog; regenerating immediately invalidates the previous link.

Jira one-click connect

You can now connect Jira the same way you already connect GitHub and Trello: click Connect with Jira in Settings and authorize through Atlassian — no more manually generating and pasting an API token, instance URL, and account email.

Under the hood, this uses a full Atlassian OAuth2 authorization-code flow, including automatic access-token refresh so long-running syncs don't silently break after the token's ~1 hour lifetime. Existing Jira integrations connected the manual way keep working exactly as before — nothing changes for them.

Fixes

• Test Connection and Discover Projects now work correctly for Jira accounts connected via one-click OAuth. Previously these tools only understood the older manual (API token) connection method and would report a false failure.
• Saving repository-to-project mappings on an OAuth-connected Jira integration now works. A bug in the connect flow was causing every save attempt to re-trigger a new Atlassian authorization instead of actually saving your changes.
• "Last synced" date on Issue Tracker integration cards now updates correctly for both Jira and Trello. It previously always showed "Never," even right after a successful sync.
• Configuration save reliability: fixed a database encoding issue that could cause an integration's settings to silently fail to save.
• Login redirect after connecting Jira: fixed an issue where approving the Jira authorization could incorrectly redirect back to the login screen instead of Settings.