Release Notes
Version 1.0 — Pro (In Progress)
Section titled “Version 1.0 — Pro (In Progress)”Target Release: Q2 2026 | API Version: 66.0 (Spring ‘26)
Shipped
Section titled “Shipped”Verified sender address for notifications
Section titled “Verified sender address for notifications”OrgGuard notifications can now be sent from a verified Org-Wide Email Address (OWEA) you control instead of leaking through the running user’s mailbox. This is half of the deliverability story — pair it with DKIM on the OWEA’s domain to stop Gmail and Microsoft 365 from flagging alerts as “Be careful with this message — couldn’t verify this.”
What’s live:
- Setup wizard step 5 — pick an Org-Wide Email Address from the dropdown; the choice is persisted to
OrgGuard_Setup__c.OrgWide_Email_Address_Id__cand applied to every outbound notification, including the wizard’s Send Test Email button - Backward compatible — leaving the picker blank falls back to the running user’s address, so existing installs see no behavior change until they opt in
- Continuity — decouples notification From-address from any individual user, so deactivating the original scheduling user doesn’t silently kill alerts
- Admin guide updated — Setup Wizard step 5 walks through creating + verifying the OWEA in Salesforce and pairing it with Salesforce-managed DKIM keys
See Notifications → Configure the sender address for the runtime configuration walkthrough.
Scheduled Job Health Monitoring
Section titled “Scheduled Job Health Monitoring”Continuous monitoring for every scheduled Apex job, recurring batch process, and Flow schedule in your org. When a submitted-by user goes inactive, or when a job fails three times in a row, OrgGuard creates a finding and routes it to the current responsible owner.
What’s live:
- Job inventory — discovers all scheduled and recurring jobs via
CronTriggerandAsyncApexJob; dashboard shows four metrics cards (Total Jobs, Active, Failing, Error State) - Inactive owner detection — flags jobs whose submitted-by user is deactivated, frozen, deleted, or locked
- Consecutive failure detection — configurable failure threshold (default: 3) triggers a finding when a job fails that many times in a row
- Ownership routing — reuses the CLM alert engine; override the responsible owner without rescheduling the job
- Finding lifecycle — findings auto-resolve on the next scan after the condition clears
See the Scheduled Job Health guide for full details.
Certificate Discovery
Section titled “Certificate Discovery”Three-class certificate discovery is now live. OrgGuard discovers every certificate that can silently break a Salesforce integration:
| Certificate class | Native notification gap |
|---|---|
| Outbound (Salesforce Certificate obj) | Email to original creator only — no ownership routing, no dependency context |
| Inbound mTLS | None — requires a Salesforce support request to enable |
| Connected App JWT bearer | Unreliable — depends on upload path |
What’s live:
- Outbound certificates — discovered with precise expiry extraction; gracefully handles orgs where certificate content fields are unavailable
- Inbound mTLS certificates — automatically skipped on Developer Edition orgs where the feature is unavailable. (Note: reliable discovery on feature-enabled orgs was not achieved in this release; the fix ships in Pro 1.1 — see the Roadmap.)
- Connected App JWT certificates — detects both cert-reference and direct PEM upload paths; maps dependencies to the Connected App that uses each cert. Expiry parsing via the Apex-native X.509 reader was corrected in a follow-up fix — see Fixed: Connected App JWT certificates now show real expiry dates below.
See the Certificate Lifecycle Management guide for full details.
CLM Data Model
Section titled “CLM Data Model”Unified asset tracking model for certificates and scheduled jobs, dependency mapping (which integrations depend on each cert), and append-only audit history for alert traceability are deployed.
Module Field
Section titled “Module Field”Module-level feature gating is now available across findings, policies, and assets — enables Pro+/Max tier separation.
Connected App JWT certificates now show real expiry dates
Section titled “Connected App JWT certificates now show real expiry dates”Connected App JWT bearer certificates discovered via the Tooling API now correctly extract the NotAfter date from the PEM-encoded certificate. Previously, an Apex hex-parsing limitation in the X.509 parser caused it to silently fall back to null on every input — routing every JWT cert asset through the Unknown Expiry policy at Medium severity instead of the standard expiry-tracking flow.
What changes after upgrade:
- JWT cert assets that previously carried a Medium Unknown Expiry finding will see those findings auto-clear on the next scan once the real expiry date is known.
- Certs in the standard expiry windows (90 / 60 / 30 / 15 / 7 / 1 days) now produce the correct Expiring Soon finding at the expected severity, matching Outbound certificate behavior.
- Already-expired JWT certs will produce a Critical “Expired” finding on the next scan. This is the correct severity per the documented finding lifecycle (matches Outbound expired-cert handling). Orgs with stale or forgotten Connected App JWT keys should expect new Critical findings post-upgrade — review and rotate or remove those keys.
OrgGuard’s built-in 24-hour notification dedupe window prevents email floods during the severity transition — one alert per certificate per day even as findings resolve and new ones open.
”OrgGuard Help” component restored — Admin User Guide link fixed
Section titled “”OrgGuard Help” component restored — Admin User Guide link fixed”The OrgGuard Help menu component is back after being unintentionally removed as apparently-orphaned in an earlier cleanup pass. The Admin User Guide item now opens docs.orgguard.com directly.
What changed:
- OrgGuard Help component restored — available again for Lightning App Builder and Utility Bar placement, see Enable Help Menu
- Admin User Guide link now opens
https://docs.orgguard.com— previously it pointed at a static resource that returned a 404 - Contact Support link (
mailto:support@orgguard.com) unchanged
What’s next
Section titled “What’s next”See the Roadmap & Known Issues page for planned features and the known issues we’re currently working on.
Version 0.1.1 — Beta Update
Section titled “Version 0.1.1 — Beta Update”Release Date: 2026-04-13 | API Version: 65.0 (Winter ‘26)
Improvements
Section titled “Improvements”Shipped FlexiPages — full LWC UI on first install
Section titled “Shipped FlexiPages — full LWC UI on first install”OrgGuard now ships six pre-wired Lightning Pages (Inventory, Findings, Policies, Scan History, Coverage, Diagnostics) as part of the package. The OrgGuard app opens directly into rich dashboards on install — no manual App Builder setup required.
Updated app navigation: Home · Inventory · Findings · Policies · Scan History · Coverage · Notifications · Diagnostics
Diagnostics tab access tightened
Section titled “Diagnostics tab access tightened”The Diagnostics tab is now visible only to OrgGuard Admin. OrgGuard User and OrgGuard Auditor retain full access to all other tabs.
Version 0.1.0 — Beta
Section titled “Version 0.1.0 — Beta”Release Date: 2026-03-23 | API Version: 65.0 (Winter ‘26)
New Features
Section titled “New Features”Auth Asset Discovery Engine
Section titled “Auth Asset Discovery Engine”Automatically discovers all auth assets in your Salesforce org.
Discovers: SSL/TLS Certificates, Connected Apps, Named Credentials, Auth Providers, External Credentials
How it works:
- Scheduled daily at 2 AM (configurable)
- Incremental scans detect new and changed assets
- Full audit history for every discovered asset
- Coverage summary reports what can and cannot be discovered, and why
Policy Engine
Section titled “Policy Engine”Configurable policies evaluate every discovered asset after each scan and generate findings for violations.
Default policies: Certificate Expiry, Missing Owner, Unknown Expiry
Custom policies can be created through the Policy Management UI.
Findings Dashboard
Section titled “Findings Dashboard”Centralized dashboard for reviewing and acting on policy violations — filter by type, severity, and status. Acknowledge, resolve, or suppress individual findings.
Inventory Dashboard
Section titled “Inventory Dashboard”Full inventory view with filters by asset type, expiry window, owner, and status. Export to CSV for offline reporting.
Coverage Summary
Section titled “Coverage Summary”Transparent view of discovery coverage per asset type — including confidence level and known limitations.
Email Notifications
Section titled “Email Notifications”Configurable email alerts with per-policy notification settings, deduplication, and delivery tracking.
Setup Wizard
Section titled “Setup Wizard”Guided 7-step installation wizard for first-time configuration.
Data Retention
Section titled “Data Retention”Automatic purge of old scan records, notifications, and logs via configurable retention policies.
Known Limitations
Section titled “Known Limitations”- External certificates hosted outside Salesforce are not discoverable
- Discovery requires System Administrator or OrgGuard Admin permission set
- OrgGuard never stores or exposes credential values — metadata only
- Orgs with 500+ auth assets may see extended scan times (handled automatically via batch processing)
- Email notifications depend on org email deliverability settings