foxxcyber/docsAbout These Release Notes
What this changelog covers, how each product is versioned, and which application is in production.
This changelog covers production releases of the Bedrock platform and RailCompliant. It's curated: each entry describes what changed for you as a user, not every internal commit. The engineering-level changelogs live with the source and are available to assessors and partners on request.
How Bedrock is versioned
- Releases follow semantic versioning (
v1.2.0). The hosted platform's backend and web application version independently but ship together as one product — entries on the Bedrock CMMC Platform page are grouped by release date and describe the combined change. - Every release deploys to a staging environment first and reaches production only through a tagged, reviewed release. Database changes are additive — upgrades don't break in-flight work.
- Bedrock C3PAO is distributed as a container image to partners; its release notes describe image generations rather than semver tags.
- Bedrock RMF is open source and ships as semver-tagged container images;
its release notes track the
public repository's
CHANGELOG.md. - RailCompliant is not versioned for customers. It deploys continuously: each change reaches production once it passes the automated checks, so its release notes are grouped by month and date instead of by version number.
- Bedrock GRC is hosted by Foxx Cyber and is not versioned for users either: changes are deployed as they pass the automated checks, so its release notes are grouped by month and date too.
Security fixes
Dependency and security patches are included in these notes when they affect the shipped product. If you believe you've found a vulnerability, see our vulnerability disclosure policy.
Bedrock CMMC v2 is what's in production
The current web application — Bedrock CMMC v2 — has been the production application at app.bedrock-cmmc.com since August 25, 2026, when it replaced the original v1 web app (v1 is retired; the assessor portal followed on August 26). v2 is a new application line, so its own version numbers start at v1.x — entries on the platform page show both the web app version and the API version. Development continues on v2: features appear in this changelog when they ship to production — we don't document unreleased work here.