Skip to main content
Product updates for LaneSync (formerly SDLC State).
​
Minimal-tier onboarding — automatic branch protection

​
Trusted Bootstrap (LaneSync Lite)

  • Removed manual GitHub Actions step — minimal-tier repos no longer require running SDLC Setup (run once) from the Actions tab
  • After you merge the bootstrap PR, LaneSync automatically configures branch protection using your PAT (stored encrypted for up to 1 hour, then wiped)
  • Retry endpoint — if automatic setup fails, use Retry branch protection setup in the setup wizard (POST /api/repos/:repoId/configure-rulesets)
​
Performance — S3 + CloudFront static UI

​
CDN architecture (staging / lanesync.dev)

  • UI static assets served from a private S3 + CloudFront OAC origin with long-lived edge caching (/assets/* immutable, index.html no-cache)
  • /api/* routes to EC2 backend only (CachingDisabled — auth headers preserved)
  • EC2 right-sized to t3.small; host nginx is API-only with gzip, keepalive, and timeouts
  • Deploy pipeline builds UI and s3 syncs to the static bucket + CloudFront invalidation (deploy-ui job)

​
GitHub environment vars (staging)

​
Frontend

  • Route-level code splitting (React.lazy) — initial bundle ~27 KB (was ~439 KB monolith)
  • Vendor chunk split (react, react-router-dom)
  • Non-blocking Google Fonts preload (display=swap)
​
Public API security hardening

​
CI authentication (OIDC + API keys)

  • GitHub Actions OIDC — evidence upload and deploy gate now require Authorization: Bearer with a verified OIDC token (audience=lanesync)
  • LaneSync API keys — workspace admins can create scoped lsk_* keys in Settings for non-GitHub CI or fallback; hashed at rest
  • Tenant is derived from the verified token claim, not from unauthenticated body fields — prevents evidence spoofing

​
Cross-tenant fixes

  • GET /api/config/repo-warnings now requires session auth and returns only the active workspace’s repos
  • GET /api/milestones/check is tenant-scoped via CI auth (no global version lookup)

​
Abuse and injection hardening

  • Rate limiting (express-rate-limit) and security headers (helmet) on public endpoints
  • Webhook payload capped at 1 MB before processing
  • Evidence report HTML served with sandbox CSP + attachment disposition (stored XSS mitigation)
  • Generic error messages on public routes (no internal detail leak)

​
Bootstrapped CI templates

All language CI templates updated with id-token: write permission and authenticated evidence upload curl.
​
Trusted Bootstrap & Team features

​
Trusted Bootstrap

  • Minimal GitHub App tier (LaneSync Lite) — bootstrap via user PAT without administration:write
  • PAT-driven sdlc-bootstrap PR flow: review files → merge → sdlc-setup.yml → COMPLETE
  • File integrity monitoring for watched workflow files (sdlc-enforce.yml, ci.yml) — tampering opens a GitHub issue and flags the repo

​
Team management

  • HMAC-signed invite links (7-day expiry) for workspace teammates
  • Admin and member roles — admins manage invites, roles, and billing

​
Billing and Pro plan

  • Free plan: up to 3 managed repositories; HTTP 402 when limit exceeded
  • Pro plan: unlimited repositories — admin submits upgrade request, platform admin approves payment
  • Start Work on milestone issues — creates feature branch + draft PR from the dashboard
  • Cut Release Branch — creates the release branch from the development branch when all issues are closed
​
Documentation launch

​
Mintlify documentation site

  • New public documentation at docs-site/ — Mintlify-powered docs matching Vercel/Cursor standards
  • SaaS-first onboarding path at lanesync.dev
  • Enterprise / self-hosted section for Docker Compose deployments
  • API Reference tab with OpenAPI spec

​
Product naming

LaneSync was formerly known as SDLC State. The product name in the UI and all customer-facing docs is now LaneSync.
​
Quality tracking

​
Quality & feature tracking

  • JUnit report parsing and feature linking via sdlc.yaml patterns
  • Regression detection between releases
  • CSV, HTML, and XLSX quality report exports
  • Quality scorecards in dashboard
​
Multi-tenant SaaS

​
Hosted SaaS

  • GitHub OAuth with workspace picker for multi-org users
  • PostgreSQL row-level security per GitHub organization
  • Project roll-ups for multi-repo releases
​
Core platform

​
Release governance

  • Five-stage pipeline: PLANNING → DEVELOPMENT → TESTING → EVIDENCING → DEPLOYMENT → DEPLOYED
  • Three-layer enforcement: GitHub Rulesets, backend state machine, SDLC Enforce CI action
  • sdlc.yaml as single source of truth per repository
  • Zero-config GitHub App bootstrap with CI workflow templates

​
Stay updated