Changelog

What's new in Xplorr

Product updates, new features, and improvements, in reverse chronological order.

September 30, 2026v1.13.0

Root cause for every anomaly

  • Every cost anomaly now says why it most likely happened: the change before the spike, who made it and on which resource, read from CloudTrail, the Azure Activity Log, GCP audit logs and Kubernetes changes, each cited with a link to the event.
  • For AWS, the usage types that rose most are listed too, so a spike with no change behind it (more requests, more data transferred) still shows where the money went.
  • Each cause has a confidence level, High, Medium or No clear cause, set by fixed rules. Answer an anomaly with Expected, Investigating or Wrong cause, and your answers tune later results.
  • Root cause needs read access to the audit log. If it is missing, Alerts, Cloud Accounts and Data health name the permission to grant. See the guide at docs.xplorr.io/guides/anomaly-root-cause.

September 22, 2026v1.12.0

Credit balances, audit log filters and export, 2FA for everyone

  • Track cloud credits: add a grant per account and see the remaining balance, burn rate and the date it will run out, with alerts 30 and 7 days before run out and before credits expire unused. Azure EA and MCA balances are read automatically.
  • The audit log now filters by date, user, resource type and source, exports to CSV, and shows the device, browser and location of every action.
  • Two factor authentication is now required for every account. Signing in through SAML SSO is exempt, because your identity provider handles it.
  • Edit an alert after creating it, and send a test to check it reaches your Slack channel. Alerts are checked as soon as you save them, and the Slack card now names the account.
  • Removing someone from your organisation now actually removes them, after you pick who takes over what they owned. Deactivating still keeps the account for later.
  • Onboarding emails carry a one click unsubscribe. Account, security and alert emails are unaffected.
  • Cloud sync now sends one summary email per organisation instead of one per account.
  • Connecting a Kubernetes cluster names the one outbound host the collector needs, ingest.xplorr.io on port 443, and the Helm chart stops with the exact flags to reuse an OpenCost you already run.

September 22, 2026v1.11.0

Closed the 2FA bypass, one permission model, SSO domain verification

  • Closed a bypass in cloud-sync, optimization and reporting: those services accepted the token issued between your password and your second factor. A password alone could no longer get in once this shipped, even with 2FA required.
  • Refresh tokens can no longer be used as access tokens, a viewer is capped at read everywhere, and the Resend webhook now verifies its signature.
  • Passkey sign in is fixed, and verifying your email or accepting an invitation now goes through the same second factor check as signing in normally.
  • One permission table now decides what each role can do, read the same way by every service and the console, so a button the console offers and an action the API accepts cannot disagree. It is rolling out gradually: nothing changes for how your team works today beyond the security fixes above.
  • Xplorr staff are now kept separate from your organisation, bound to one specific account and always required to use a second factor.
  • Members can share a cloud account they connected with the rest of the organisation, read only.
  • Admins can reset a member’s second factor, and reassign what a departing or demoted member owned instead of leaving it ownerless.
  • Verify domain ownership for SAML SSO with a DNS TXT record. A domain does nothing for sign in until it is verified.
  • Enterprise organisations can request approval on a recommendation directly from the console.
  • Sign-in history, successes and failures, is now recorded and kept for 90 days.
  • Outbound mail now sends from mail.xplorr.io.

September 21, 2026v1.10.0

One command to connect a cluster, one account across organisations, one second factor

  • Connecting a Kubernetes cluster is now a single Helm command. It installs OpenCost, names the cluster to it, and installs the collector, so the step people used to miss — telling OpenCost which cluster it is looking at — cannot be missed. The chart is public at charts.xplorr.io.
  • One email address can belong to more than one organisation. Signing in asks which one rather than choosing for you, and your role comes from the organisation you pick.
  • One second factor covers every organisation you belong to. Set up an authenticator app or a passkey once, not once per organisation, and an administrator resetting it resets it everywhere.
  • Upload a profile photo, and a logo for your organisation. The logo appears beside the organisation name in the sidebar.
  • Accepting an invitation now leaves an account you can sign in to again afterwards.
  • Saving your settings no longer clears the Slack webhook, and the org-wide webhook is readable by administrators only.
  • Closing an organisation works, and removes everything it should.
  • The SSO panel reports what is actually configured, and the require-SSO and auto-provision switches can be changed without setting SSO up again.
  • An organisation can no longer be left with no administrator.
  • Plans are named the way they are sold: Starter, Growth and Enterprise.

September 20, 2026v1.9.0

Passkeys and required 2FA, member-owned accounts, and network cost detail

  • Two factor authentication can be required across the platform, and a passkey satisfies it. Anyone who has to set one up is walked through it at sign in rather than locked out.
  • Members can connect their own AWS, Azure or GCP account and manage it, including who else sees it, without being made an organisation admin.
  • Members can connect a Kubernetes cluster. Deleting one still needs an admin.
  • Network cost drivers open in place to show the resources behind them: which peering, which gateway, which DNS zone.
  • A newly connected account now backfills 90 days, so last month is complete on the day you connect.
  • Allocation coverage compares cluster cost against the cloud bill for the days the cluster actually reported, instead of the whole window.
  • Connecting an Azure subscription is quick again: it verifies the subscription rather than running a cost query, and says which permission is missing when one is.
  • Removing someone from an organisation removes them from the team list, and inviting the same address again restores their account.

September 19, 2026v1.8.0

Cost collection on a job queue, GitHub as a cost source, connector detail pages

  • Per-account syncs run on a queue and sync concurrently, rather than one after another. A failed sync is retried with backoff and kept in a dead letter queue with the reason.
  • Data Health gained a sync queue panel: what is waiting, what is running, what failed, with a retry on each failure.
  • Connect a GitHub organisation to bring Actions minutes, storage and Copilot seats in beside your cloud spend.
  • Alerts on a consumed allowance, as a percentage rather than an absolute number.
  • Every connector has a detail page, with the panels that make sense for it.

April 13, 2026v1.6.0

Slack daily digest, and a round of fixes

  • Daily cost digest through a Slack webhook, with no Slack app to install.
  • Anomaly alerts no longer fire on trivially small costs.
  • GCP usage figures no longer overflow on large accounts.
  • Azure rate limits are retried rather than failing the sync.
  • Fixes across alerts, email verification, Excel export, account access and dark mode.

March 20, 2026v1.5.0

SSO/SAML, scheduled reports, tagging policies & approval workflows

  • SAML SSO enterprise authentication: supports Okta, Azure AD, and Google Workspace
  • Scheduled reports: daily, weekly, or monthly PDF/Excel reports emailed automatically to multiple recipients
  • Tagging policy enforcement: define required tags and detect violations across all cloud resources
  • Approval workflows: require approval for high-impact actions with configurable thresholds and 72-hour window
  • Unit economics: track cost per customer, transaction, or API call via metric ingestion API
  • Recommendation snooze: defer recommendations until a specific date
  • Digest settings: configurable daily digest schedules with timezone support per channel
  • Cost allocation rules: define tag-based chargeback and showback rules

March 19, 2026v1.4.0

Slack bot enhancements and Microsoft Teams groundwork

  • Microsoft Teams groundwork: the install flow and Adaptive Card templates. The Teams bot itself is not live yet (correction: this entry first said it shipped with full parity)
  • Slack daily cost digest: automated morning briefing with spend delta vs 7-day average, top services, anomalies, and forecast
  • Slack weekly executive summary: AI-generated 2-sentence insight with week-over-week trends, top cost movers, and savings realized
  • Channel configuration for the Slack daily digest and weekly summary. Per channel scope filters and alert routing are not applied yet
  • Slack button handlers for apply, snooze, dismiss, approve and reject. These are not yet attached to any message the bot sends

March 17, 2026

Security hardening & platform improvements

  • SQL injection fixes across GCP provider and reporting service
  • 2FA rate limiting and backup code race condition fixes
  • TOTP setup flow for mandatory 2FA organizations
  • Account lockout after failed login attempts
  • Refresh token IP binding
  • Invitation token hashing
  • CSV formula injection prevention
  • Network policy enforcement in Kubernetes
  • Pod security contexts across all deployments

March 16, 2026

WebAuthn support & MFA improvements

  • Added passkey and YubiKey authentication (WebAuthn)
  • Mandatory 2FA enforcement per organization
  • JWT hardening and security fixes

March 16, 2026v1.3.0

Real cloud data for all providers: inventory, network costs, per-resource costs & multi-currency

  • Resource Inventory now live for AWS (EC2, EBS, VPCs, Load Balancers, Security Groups, NAT Gateways), Azure (all ARM resources via Resource Management API), and GCP (30+ resource types via Cloud Asset API)
  • Per-resource cost breakdown: Cost Analysis page now has a "By Resource" tab showing individual resource costs (AWS via Cost Explorer RESOURCE_ID grouping, Azure via Cost Management ResourceId dimension, GCP via BigQuery resource.name grouping)
  • Network Cost Visibility page: break down data transfer costs by traffic type (internet egress, CDN, VPN, cross-region, peering) for all three providers with accurate byte counts
  • Fixed inflated network data: AWS/Azure/GCP bytes_transferred now correctly derived from usage unit (GB/gibibyte only; VPN hours, DNS operations etc. no longer counted as data transfer)
  • Savings Plans & RI Coverage dashboard for AWS: daily SP covered cost, RI covered cost, on-demand exposure, and spot usage
  • Multi-currency support across all dashboard pages: USD, CAD, EUR, INR, GBP display with correct symbols using Intl.NumberFormat; currency is per-account from billing data
  • Alert emails now route through Resend instead of falling back to unconfigured SMTP
  • Coverage data migration (016_coverage_data.sql) applied, which stores AWS commitment coverage history

March 16, 2026v1.2.0

Status page, signup improvements & infrastructure monitoring

  • Live status page at status.xplorr.io: real-time uptime for all Xplorr services, databases, and public endpoints
  • Internal service health monitoring (auth, cloud-sync, optimization, reporting, MCP server, frontend) with 60-second intervals
  • Infrastructure checks for PostgreSQL and Redis via TCP
  • Slack alerts on service degradation with auto-resolve notifications
  • Signup flow now shows live password requirement checklist, no more silent 400 errors
  • Improved signup error messages with per-field validation feedback

March 14, 2026

Performance & reliability

  • Database performance indexes for cost queries
  • Nightly data retention job
  • Crypto utility improvements

March 9, 2026v0.9.1

Faster daily billing sync

  • Daily billing sync for every account at 02:00 UTC, with Sync now for anything newer
  • Azure Cost Management API polling now waits for the throttling window Azure reports and retries, instead of failing the sync on a rate limit
  • Added sync status indicator to dashboard header showing last successful sync time

March 3, 2026v0.9.0

Slack alerts for anomaly detection

  • Connect any Slack workspace and route anomaly alerts to a channel of your choice
  • Alert messages include affected service, spike percentage, estimated monthly impact, and a direct link to the anomaly in Xplorr
  • Per-rule Slack channel routing: route AWS alerts to #aws-costs and Azure alerts to #azure-costs
  • Slack connection uses OAuth, no bot tokens to manage manually

February 19, 2026v0.8.5

GCP Billing Export support

  • Added Google Cloud Platform as a third supported cloud provider
  • Connects via Service Account with Billing Viewer role, no owner permissions required
  • Supports BigQuery billing export for maximum granularity (SKU-level data)
  • GCP committed use discounts and sustained use discounts now surface in recommendations

February 9, 2026v0.8.0

Budget alerts & forecasting

  • Set monthly or quarterly budgets per cloud account, per service, or for your whole organisation
  • Automatic alerts at 80% and 100% of budget via email (Slack coming in v0.9)
  • End-of-month spend forecasting using current trajectory, visible from the 1st of the month
  • Budget history: compare actual vs. budgeted spend month over month

January 27, 2026v0.7.2

Anomaly detection improvements

  • Fixed false-positive alerts triggered by legitimate spikes at month-start for Reserved Instances
  • Improved 7-day rolling average calculation to exclude zero-spend days (prevents alert fatigue on services used intermittently)
  • Alert email now shows the 7-day chart for the affected service so context is immediate

January 14, 2026v0.7.0

Microsoft Azure support

  • Added Azure as the second supported cloud provider
  • Supports Enterprise Agreement (EA), Microsoft Customer Agreement (MCA), and Pay-As-You-Go subscriptions
  • Connects via Service Principal with Reader role, no admin permissions required
  • Azure Reservations and Savings Plans now surfaced in the recommendations engine

December 19, 2025v0.6.0

AI cost insights (beta)

  • Powered by OpenAI: analyses your actual usage patterns and produces specific, natural-language recommendations
  • Recommendations are service-specific: "Your RDS instance in eu-west-1 is 78% idle between 18:00–06:00 UTC"
  • AI insights refresh weekly and are ranked by estimated monthly saving

November 30, 2025v0.5.0

Private beta launch

  • Launched Xplorr to first cohort of private beta users
  • AWS support via a read-only IAM role
  • Unified cost dashboard with provider, service, region, and account breakdowns
  • Anomaly detection using 7-day rolling averages with email alerts
  • PDF and Excel report export

Want to be notified of new updates?

Get started free