22 October 2026

Compass 0.8.0: Read-only access, updates from the page and a demo mode

Compass now only reads your AWS account, through a role it creates once, and writes nothing without a pull request you merge. It tells you when a release is out, shows what changed and can apply it from the page, and it can run as a public demo. This release also carries 0.5.0 to 0.7.0, which were not released on their own.

Compass only reads

Run compass connect once with your AWS profile. It creates a read role whose policy is generated from what your captains declare they read, an act role with no permissions, and the queue decoy alerts report to. From then on the services run without your profile, and refuse to start if one is in reach.

docker compose run --rm -v ~/.aws:/root/.aws:ro -e AWS_PROFILE=<profile> compass connect account=<id> region=<region>

Writes by pull request

Allowing a response action, such as deactivating a decoy's key, opens a pull request that gives the act role exactly that permission. The action is armed only once you have merged and applied it and Compass has read the role back. Removing it disarms it at once. Access, under Settings → Integrations, shows every grant and its state.

compass access list

Compass checks its own access

Every day Compass compares its two roles with what they should hold: a policy added in the console or a second trusted principal is a finding, fixed by the access pull request. Each session is named for its captain and job, with who asked, so CloudTrail says all three.

compass access audit

Updates from the page

Compass checks for a release every six hours with one anonymous request. A banner and Settings → Updates say when one is out, with What's new: the notes of every release since yours. With the updater service, Update pulls it, checks health and rolls back if the services do not come up. Nothing changes version without you.

docker compose --profile updater up -d

Watch a scan run

A running map scan shows a progress bar on every tab: the phase, the region it is reading, the resources found so far and about how long is left. Settings lists its sections in the sidebar, and a captain is turned on or off with a switch.

A map that stays fast

The map is a SQLite file per workspace and keeps its history: on 100,000 resources, writing a scan takes 13 seconds instead of 18 minutes. Your existing map is copied over on the first start. The 0.6.0 notes have the details.

compass mapper backup out=/compass/map/map-backup.sqlite

Demo mode

With APP_MODE=demo, Compass runs a public demo the way demo.beamreach.ai does: a synthetic account on the map beside a real one, a guided tour, decoys a visitor can trip for real, a weekly reset, and the settings kept to the operator. docs/demo.md says how; the quickstart does not change.

APP_MODE=demo

GitHub Enterprise Server

GITHUB_API_URL points Compass at GitHub Enterprise Server; the clone URL follows, and the PR watcher tracks pull requests there too. Unset, nothing changes.

GITHUB_API_URL=https://<host>/api/v3

After the update

Fetch the new docker-compose.yml once: it adds the map-data volume and the updater service, and passes COMPASS_VERSION into the containers.
The first start copies the existing map from DynamoDB into a SQLite file, once. On a large map it takes a few minutes longer. The DynamoDB table is left as it was.
Run docker compose run --rm -v ~/.aws:/root/.aws:ro -e AWS_PROFILE=<profile> compass connect account=<id> region=<r> once, then docker compose up -d. Remove AWS_PROFILE from .env and the ~/.aws mount from an edited compose file. An install that assumed a role keeps it as the read role; one that used the profile runs nothing against the account until connect has run.
Decoys planted before this release report to the old queue until honeypot replant_alerts has opened its pull request and you have merged it.

Compass is open source (Apache-2.0).

Code, changelog and issues: github.com/beamreach-ai/compass. Already running it? The update card on Settings → Updates shows these notes before you update.