What we shipped, what it found, and what we got wrong. ScopeHunter's compliance automation is built against our own production infrastructure first — so this log includes the parts that didn't work.
Most compliance tooling shows you a number. The interesting question is whether the number is earned. Everything below was run against real hosts before it was written about, and where a control turned out not to work, that is recorded here rather than quietly fixed.
2026.8.43 — inventory inbox
Reporting per-check evidence used to require pinning a system UUID into each machine's config. For a 200-host estate that is 200 hand-maintained values and 200 chances to point two machines at the same record. Machines now identify themselves by their own name; anything the platform doesn't recognise is held rather than rejected, and an admin claims it once. Every later report routes itself.
2026.8.43 / 2026.8.44 — formula distribution
Customers fetch a pinned, checksum-verified release over an authenticated endpoint instead of cloning a repository. Publishing is a deliberate release act with no upload path reachable over HTTP — production can read the artifact bucket and cannot write to it, because the artifact is software that runs as root on someone else's servers.
cmmc-lockdown-formula 2026.8.2
Inside a controlled boundary the machines usually cannot reach the internet at all. The master already talks to every machine and is already the host permitted out, so it now collects and reports on the fleet's behalf — one outbound connection instead of one per host. Validated on a real master with a genuinely egress-restricted minion, and the masterless path was re-proven afterwards rather than assumed.
Our security suite passed against a release it did not cover. Green that means less than it looks is worse than red, because it gets trusted. We now verify every new control by deliberately breaking it and confirming the suite fails — and added fuzz testing, because the defects that got through were all cases nobody had thought to assert.
An external review of our own changes found three paths where a machine's report could be accepted and then quietly dropped. All three were the same failure wearing different clothes, in code written specifically to prevent it. Fixed, each with a regression test, and a database constraint now enforces an invariant that had previously been maintained only by a comment.
On-access scanning was implemented, applied cleanly, reported itself as running — and detected nothing. It is currently disabled and recorded as not working, rather than counted as a satisfied control. A control that reports success without doing its job is worse than an obvious gap.
Our own production host publishes its posture through the same pipeline customers use. See the feature status page for what is live versus still incubating, and the CMMC automation write-up for how the hardening is actually tested.