New Features

NSF Import Support — The import command now supports Nested Share Folder (NSF) records and folders, including permissions.

Improvements

PAM tunnel diagnose — The pam tunnel diagnose command resolved four diagnostic accuracy issues: GOV region server targeting for port-443 tests, region display for non-US servers, WebSocket tests now correctly fail on HTTP 4xx/5xx responses, and WebRTC sample color coding.

Team name validation — Added validation when resolving team names during key fetching to prevent ambiguous UID-shaped strings from being misclassified as teams.

API timeout — Default response timeout increased from 120 s to 300 s to align with backend timeouts.

Correct Azure import library name — Fixed incorrect library reference for Azure imports.

KEPM SCIM user/group IDs — SCIM user and group output now includes the Id field.

JSON output for additional commands — The --format json option is now supported for PAM list and info commands, and for record-history --action view.

Service command accepts service names — The service command can now be referenced by service name in addition to UID.

Bug Fixes

PAM RBI edit in NSF — Fixed pam rbi edit so that NSF RBI settings are correctly persisted via update_pam_record.

PAM workflow policy enforcement — PAM workflow admin commands are now blocked after the workflow-settings policy is revoked.

Docker one-shot commands — Fixed Docker containers hanging indefinitely after executing one-shot commands.

Docker service setup ownership — Ownership is now required before Commander adopts existing Docker setup folders and KSM apps.

References

Keeper Commander CLI Documentation

Raycast extension that provides fast and seamless access to your Keeper Security vault

About

A comprehensive Raycast extension that provides seamless access to your Keeper Security vault on macOS and Windows. Manage records, generate secure credentials, and access your vault records without leaving your workflow.

Features

• Record Management: Browse your Keeper vault with a clean, searchable, filterable interface and perform different actions
• Password Generation: Generate secure passwords with custom options or instantly with defaults, automatically copied to clipboard
• Passphrase Generation: Generate 24-word passphrase, automatically copied to clipboard

Prerequisites

• Keeper Commander CLI: Must be installed and authenticated on your system
• Keeper Security Account: Active subscription with vault access (Consumer, B2B, MSP)

Quick Setup

Step 1. Install the Keeper Security Extension

You can install the Keeper Security extension directly from the Raycast website:
https://www.raycast.com/keepersecurity/keeper-security
Or, open Raycast Settings > Extensions > Click "+" button > Install from Store and search for "Keeper Security".

Step 2. Install the Keeper Commander CLI

Follow the Keeper Commander Installation Guide to download and install the binary for your operating system.

Step 3. Authenticate with Keeper Commander CLI

• Open your Terminal app.

• Run the following command: keeper shell

• If you're not already logged in, type login [email protected] and you'll be asked to enter your Keeper credentials.

• After login, we recommend activating "persistent login" mode:

  this-device register
  this-device persistent-login on
  this-device timeout 43200

There are several other authentication methods, including biometric login. See the Logging In documentation for more info.

Step 4. Start Keeper Commander Service Mode

In order to preserve zero knowledge and provide all of the full Raycast integration capabilities, you need to run the Keeper Commander service on your local machine, or any server that can be accessed over an HTTPS connection. To keep things simple, a quick command for Keeper Commander that is compatible with the Raycast integration looks like this:

service-create -p 9007 -q n -c "generate,get,list,this-device,sync-down,share,totp,server"

This will produce some output like below:

Generated API key: XXXXXXXXXXXXXX
...
Commander Service starting on http://localhost:9007/api/v1/
...

After you type this, you'll need to save two pieces of information:

• API URL: This looks like http://localhost:9007
• API Key: This looks like abcdefghi123456==

Keep the Commander CLI running in order to stay connected.

Step 5. Authenticate the Extension

• Open Raycast using your configured hotkey.
• Search for "Keeper Security" and run any keeper security command from the extension.
• If you're not authenticated, the extension will prompt you to enter the API URL and API Key.

Note: remove /api/v1 from the API URL, so it looks like below.

Setup is now complete.

Usage

Open Raycast using your configured hotkey to run below commands:

My Vault Command

• Purpose: View and interact with all your vault records.
• Available Actions:
  • Show Details – Displays detailed information about the record
  • Open in Browser - Opens the record directly in the Web Keeper Vault via your browser
  • Copy Login – Copies the username/email to clipboard (if available in the record)
  • Copy Password – Copies the password to clipboard (if available)
  • One-Time Share Record – Generates a 7-day shareable link for the record
  • Copy Two Factor Code – Copies the TOTP code (if available)
  • Sync Records – Fetches the latest vault records from the cloud

Generate Password Command

• Purpose: Generate a random password with custom options and automatically copy it to the clipboard.

Generate Password (Quick) Command

• Purpose: Generate a random password using default options and automatically copy it to the clipboard.

Generate Passphrase Command

• Purpose: Generate a random 24-word passphrase and automatically copy it to the clipboard.

Restarting the Service Mode

Commander Service Mode needs to be running in order for the Raycast extension to communicate with Keeper. If the Terminal app closes, you can easily start Commander Service Mode using this one-line command from your terminal:

keeper service-start

Assuming that you followed the above Quick Setup instructions, this should immediately login to Keeper and start up the service inside your Terminal app.

Learn More

This document has covered the basic use cases to integrate Keeper Commander with Raycast. Many more advanced options exist. To learn more, see the below helpful documents:

• Logging In to Commander
• Service Mode REST API

Support

For support, bugs or feature requests, please email [email protected].

Security

KSM-1168: Fixed an authorization gap in ksm sync --type aws where a Keeper user with add access to a synced folder could craft a record title to target arbitrary secrets in the operator's AWS account. Secret names written to AWS are now confined to a caller-supplied namespace prefix (--prefix). Dry-run output no longer includes the live destination secret value for any cloud backend (AWS, Azure, GCP).

Improvements

KSM-1114: Removed the unmaintained colorama dependency; terminal coloring now uses click.style(), already present via click-help-colors, with no new dependency added

When KSM_CONFIG is set and a keyring profile would otherwise take precedence, the CLI now warns on stderr naming the active config source. The warning is suppressed when the keyring is unavailable or empty, so CI and container environments using KSM_CONFIG exclusively see no output.

Bug Fixes

KSM-929: Fixed locked OS keyring (e.g. gnome-keyring over SSH) silently returning no profiles; CLI now raises an actionable error pointing at --ini-file / KSM_CONFIG as a fallback

KSM-1113: Fixed config path search on Windows (%APPDIR% → %APPDATA%) and on Linux (/etc entries now resolve as absolute paths instead of relative to the current directory)

KSM-1107: ksm secret add clone now exits non-zero when the source UID does not exist, instead of silently exiting 0

KSM-1118: Fixed ksm secret add clone crashing with "list index out of range" when the source record contained an unpopulated complex field (name, address, host, etc.)

KSM-1126: Fixed ksm secret add file and ksm secret add editor crashing with the same "list index out of range" error when the record contained an unpopulated complex field

KSM-1135: Fixed ksm secret download crashing with MissingSchema: Invalid URL 'None' when called immediately after ksm secret upload; the vault propagates the file's download URL asynchronously and the CLI now raises a clear retry message

KSM-1155: Fixed fatal keyring storage errors swallowing the underlying error message; the original error is now surfaced directly

KSM-1156: Fixed ksm shell crashing at startup with UnicodeEncodeError when stdout could not represent the Unicode box-drawing banner (cp1252 on piped/redirected Windows output, C-locale pipes on Linux); the shell now falls back to a plain-text banner

KSM-1157: Fixed ksm shell ignoring session global options (--ini-file, --profile-name, --output, --color, --cache, --log-level) for commands run inside the shell; all session options now propagate to inner commands

KSM-1162: Fixed ksm shell on Windows corrupting file paths containing backslashes; C:\dir\file.ini was silently converted to C:dirfile.ini

KSM-1165: Fixed ksm shell truncating command arguments at # characters; UIDs and paths containing # are now passed through intact

KSM-1163: Fixed two keeper.ini discovery bugs on all platforms: KSM_INI_DIR was silently overridden by a keeper.ini in the current directory without any warning, and unset environment variables in the search path were probed as literal directory names

KSM-1018: Fixed macOS installer crashing on every ksm invocation; bundled libssl updated to OpenSSL >=3.2.0 (x64 and arm64)

KSM-1105: Fixed Windows installer's post-install launch of ksm.exe being blocked by endpoint security (EDR/AV)

KSM-1106: Fixed macOS PKG installer ignoring Keyring and Cloud Sync component checkboxes in GUI mode; the installer now respects the user's component selection

KSM-1116: Fixed Windows installer placing the 64-bit binary in Program Files (x86) instead of Program Files on 64-bit systems

KSM-1159: Fixed Windows installer appending a duplicate PATH entry on every install or upgrade

KSM-1164: Fixed Windows uninstall and upgrade corrupting the system PATH by writing it as REG_SZ instead of REG_EXPAND_SZ; %SystemRoot% and %WINDIR% expansion was broken in all subsequent processes after the uninstaller ran

KSM-1117: Fixed the Docker Alpine image shipping a musl 1.2.4 base image while the bundled binary required musl >= 1.2.5; the /cli/musl/ksm init-container binary failed to load in its own image

KSM-1120: Fixed the Docker /cli/glibc/ksm and /cli/musl/ksm init-container binaries shipping as amd64 ELF on all platforms; arm64 init-containers have never had a functional binary

KSM-1160: Fixed install.sh producing a cryptic PyInstaller crash on Alpine 3.19 (musl 1.2.4) or systems with glibc < 2.28; the script now checks platform compatibility before installing

KSM-1169: ksm sync dry-run output no longer includes the live destination value for Azure Key Vault or GCP Secret Manager; behavior now matches AWS. Destination names supplied via --map are validated against Azure and GCP naming rules before any write is attempted.

KSM-1170: ksm sync --record and --folder now warn on stderr when a token resolves by record title or folder name rather than by UID, since those identifiers are mutable. Resolution behavior is unchanged; UIDs are recommended for scheduled syncs.

KSM-1171: ksm init k8s now uses a YAML serializer to build the Kubernetes Secret manifest, so --name and --namespace values are always properly encoded and cannot inject content into the manifest.

Breaking Changes

KSM-1168: ksm sync --type aws with --record, --folder, or --folder-recursive now requires a --prefix argument. Existing sync commands must add --prefix (e.g. --prefix keeper/).

KSM-1120: Linux GitHub release tarballs now include the architecture in the filename. The previous single Linux tarball is replaced by keeper-secrets-manager-cli-linux-amd64-1.5.0.tar.gz and keeper-secrets-manager-cli-linux-arm64-1.5.0.tar.gz; the Alpine tarball is split the same way, into keeper-secrets-manager-cli-alpine-linux-amd64-1.5.0.tar.gz and keeper-secrets-manager-cli-alpine-linux-arm64-1.5.0.tar.gz. Scripts that reference the old unsuffixed tarball names need to be updated.

Resources

PyPI Package

Docker Hub

GitHub Releases

CLI Documentation

Breaking changes

KSM-1193: create_secret now raises an error if the application configuration has no owner public key. Every other SDK already requires this key for record creation. This change makes Ruby consistent with the other SDKs. The SDK sets this key only during binding. An already-bound configuration cannot get this key later. Re-bind with a fresh one-time token, or set the KSM_APPOWNERPUBLICKEY environment variable if you use the read-only EnvironmentStorage.

Security

KSM-1193: Resolved an encryption issue with create_secret commands, affected by versions 17.0.3, 17.0.4, 17.1.0, and 17.2.0. This fix affects only records created after the SDK upgrade. To fix any existing records, the records must be deleted and re-created.

Resources

• RubyGems package
• Ruby SDK Documentation

Secure ingestion of security and incidents alerts into FreshService

Overview

The Keeper Security ITSM application provides a secure and streamlined integration between Keeper Security Alerts and FreshService incident tickets. It enables enterprise customers to centrally manage and respond to Keeper-generated security alerts by automating their intake, transformation, and creation as FreshService Incident tickets.

This integration helps security teams maintain visibility, improve response times, and ensure that Keeper Security alerts are managed consistently within existing FreshService workflows.

Marketplace Link

Features

• Receive Keeper Security alerts and incidents through a protected webhook endpoint, ensuring that only authorized sources can submit data to the platform.
• Guided Setup to configure webhooks and alert severity mappings.
• Transform incoming alerts into a FreshService Incident ticket
• Provides custom priority mapping for Keeper Security alert types enabling FreshService administrators to work on incidents on priority basis.

Example Use Cases

Below are some example UseCases.

Password BreachWatch In Keeper Vault

• Trigger: BreachWatch has detected a record in the Keeper vault with a vulnerable password.
• Action: An alert will be sent to FreshService webhook that contains the BreachWatch incident.
• FreshService Keeper Security ITSM app will receive the alerts, checks for priority mapping and creates a Incident Ticket.
• Result: FreshService admins can audit, and work on the incident reported.

Privileged User Behavior Monitoring

• Trigger: An admin user created a new Team or new policy in Keeper Administrative account.
• Action: An alert will be sent to FreshService webhook that contains the incident information and an incident ticket will be created.
• Result: SIR admins can audit, and work on the incident reported.

Prerequisites

• Alerts configurations in Keeper Admin Console
• FreshService subscription

Configuration Instructions

To configure the Keeper Security ITSM App in FreshService perform below steps:

• Login as a admin in FreshService portal and click on the Market place icon, Search for Keeper Security ITSM and Download the app.
• Once downloaded, head over to Manage Apps > Keeper Security ITSM > Click on Install. you will see below app configuration page

Getting Webhook Token

To get a webhook authentication token, Login to Keeper Security admin console click on Reporting & Alerts and create a new alert.

Click on Add Recipient then click on Add webhook.

Generate the token by click on generate button.

Once, the token is generated, copy the same token in app configuration page in FreshService ITSM application.

Once, the app is successfully install. Copy the webhook URL back to above alert configuration and save the alert configurations in Keeper admin console.

Receiving Alerts

Once, the application is configured, You will receive alerts in tickets section

Keeper Security Event Types Mapping

In the app configuration, users can set the priority, urgency, and impact for each event type. These values determine how alerts are classified when they create tickets. Configure them to match your team's incident-management process.

Troubleshooting

Use the application logs section to review relevant logs during troubleshooting.

Keeper Browser Extension version 18.1.0 introduces a redesigned autofill prompt, the ability to pause Keeper for a specific site or domain and various bug fixes.

Autofill Prompt Redesign

The Keeper Browser Extension has been updated to make autofilling credentials faster and more intuitive, with smarter suggestions appearing inline as you interact with forms and greater control over how your saved information is applied.

What's New

Inline Autofill Recommendations The Keeper Browser Extension now displays autofill suggestions directly beneath form fields as you interact with them — no more hunting through pop-ups or menus. When you click into or tab to a login, address, or payment field, Keeper shows matching credentials from your vault in a compact list positioned just below the field. Click any item to autofill the entire form instantly.

Smart Search as You Type Start typing in a field and the suggestions list narrows in real-time, filtering your vault entries to match what you're entering.

Multiple Credential Visibility If you have more than one login saved for a site, all matching entries appear in a scrollable list sorted by favorites first, then recently used, then alphabetical. Use the inline search to find the right one quickly.

Granular Control of Autofill Click the expand arrow on any suggestion to see all fields in that record. From there you can:

• Autofill only specific fields
• Copy individual values (username, password, etc.) to your clipboard using the copy icon

Hide Keeper

Sometimes you don't want the Keeper Browser Extension to autofill or show suggestions on a particular website — for example, when you're filling out a long form manually or browsing a site where autofill gets in the way. This feature allows you to effectively have a pause-for-a-visit / site-pause to temporarily silence the Keeper Browser Extension on any domain with a single click.

What it Does

• Hides all Keeper Browser Extension autofill popups, autofill suggestions, and KeeperLock icons on the paused site
• Keeps the extension toolbar icon active so you can still open your vault or resume at any time
• Works on sites already saved in your vault and sites you haven't saved yet

Hiding Keeper on a site applies to the entire domain (e.g., all pages on example.com), not just the current URL. Your hide/restore preferences are remembered locally in your browser until you change them.

How it Works

Click the Keeper lock icon and from the overflow menu (three vertical dots), select Hide Keeper on this site.
Alternatively, right-click on any autofill field and select Hide Keeper on this Site from the Keeper context menu.

How to Restore Keeper

When you're ready to resume Keeper's functionality on a site, click the Restore button at the top of the extension toolbar. Alternatively, within the extension Settings menu, select Hidden Sites > Restore next to the site's domain name. Keeper's autofill and suggestions functionally will immediately return to normal.

Bug Fixes

• BE-7855: Record disappears from autofill and extension after account switch.
• BE-7852: Incorrect matching credit cards/addresses after re-logins in new form filler.
• BE-7799: Incorrect Create New Record prompt.
• BE-7794: Multiple confirmation modals appear when filling payment card and address records via new form-fill prompt redesign.
• BE-7733: Shared folder is not removed from vault after owner deletion when no other folders exist.
• BE-7711: Address, payment card, and secure note records not displaying as expected in landscape mode.
• BE-7660: SSO Connect Duo 2FA method buttons gray out after selection.
• BE-7576: Select Folder Location resets after clicking away from toolbar window.
• BE-7565: Snapshot Preview Page - 'Report Issue' text spilling out of button.
• BE-7344: Password generator history navigation with tab key stuck on eye icon.
• BE-7340: Accessibility tab not functioning as expected in default password manager flow.
• BE-7264: Recent sort is not being updated after viewing record in toolbar window.
• BE-7955: Addressed security finding related to cross-origin navigation during checkout flows (payment and address records) while confirmation dialog is in a pending state.
• BE-7956: During HTTP Basic Auth autofill scenarios, only offer credentials that match the origin of the request (e.g. http:// authorization only offered if the record URL uses http:// as opposed to https://).

This is a security-focused release addressing several 3rd party penetration testing reports and library depedencies. All Automator deployments should be upgraded to version 17.1.2 as soon as possible, or during the next scheduled maintenance window.

As documented, ensure all Automator deployments adhere to our recommended Ingress Requirements, ensuring all inbound traffic is restricted to Keeper's infrastructure.

Security Updates

• KAA-167: Deserialization Hardening
  Applied a strict ObjectInputFilter allow-list to Java deserialization paths, blocking untrusted classes from being instantiated during object deserialization. Only explicitly permitted packages (Keeper, Protobuf, BouncyCastle, Keycloak, and a minimal set of JDK primitives/collections) are now accepted.
• KAA-167: Path Traversal Protection
  SSL password file path configuration now canonicalizes the resolved path and rejects any path that resolves outside the Automator working directory, preventing directory traversal attacks against local file resources.
• 3rd party library dependencies: We have upgraded 47 library dependencies in accordance to our regular SDLC process.

Update Instructions

Warning

Updating to version 17.1.2 requires a re-initialization due to encryption changes

• For container deployments, update the container and restart the service. Then run "automator setup" followed by "automator init" as described in the relevant section "Installation Method" for your type of deployment.
• For other deployment methods, see the Automator documentation to update

Advanced Features

See this page for all of the new and advanced features / settings for the Automator service.

Improvements

• VAUL-9249: Updated postcss and use-sync-external-store dependencies
• VAUL-9261, VAUL-9319, VAUL-9322: Resolved a number of NPM audit finding
• VAUL-9295: Resolved issues with fast-uri dependency
• KDE-2194, KDE-2222: Resolved a few NPM audit findings

Bug Fixes

• VAUL-9284: Fixed Nested Shared Folder participants failing to pull access display name from folder
• VAUL-9267: Fixed conflicting team access in Nested Shared Folders
• KDE-2186: Upgraded Electron from 41.7.0 to 42.7.1
• KDE-2193: Resolved tar module dependency

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh)

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from:

https://www.keepersecurity.com/download.html?t=d

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.

New Features

Improved Master Password Grading Algorithm

EM-8533: The Admin Console now uses an upgraded algorithm to evaluate Master Password strength, providing more accurate and consistent password grading for enterprise users.

Keeper EPM — Workload Support

Keeper Endpoint Privilege Manager Workload Support

EM-8885: "Events" has been renamed to "Workloads" throughout the EPM section to align with updated product terminology.

EM-8894: The Subscriptions tab now displays EPM Workload tier information, allowing administrators to view their current tier and usage.

EM-8895: The EPM Dashboard now surfaces Workload data, giving administrators visibility into active workload counts directly from the dashboard.

EM-8898: The Notification Center now includes alerts for EPM Workload tier upgrades, notifying administrators when usage approaches or exceeds their current tier.

EM-8925: Added an EPM Upgrade Tier checkout modal, enabling administrators to upgrade their Workload tier directly from within the Admin Console.

Bug Fixes

EM-8984: Fixed incorrect or missing information appearing across multiple screens following a recent update.

EM-9007: Fixed incorrect billing cycle dates being displayed on the KeeperPAM NHI Dashboard.

Release 2.1 broadens Keeper EPM's agentic-AI coverage, strengthens the macOS System Extension and the Linux agent, adds macOS MDM deployment, and delivers a wide set of improvements across Windows, macOS, and Linux.

New Features

• Configurable elevation wait overlay — the elevation wait UI supports configurable messaging and a distinct failure-display path, giving administrators clearer control over the end-user experience during elevation.
• Agent-side machine-check policy enforcement — policies can enforce machine-scoped checks directly on the agent, reducing round-trips and enabling stricter local evaluation.
• Linux non-elevated command line and controls — Linux endpoints gain non-elevated command-line coverage and associated controls, extending parity with Windows and macOS.
• Expanded agentic-AI detection — detection rules cover additional cloud agents (Grok, GitHub Copilot, and Microsoft 365 Copilot) and the VS Code Claude plugin (bun.exe).
• macOS MDM install support — a packaged installer with a paired Full Disk Access configuration profile enables silent, MDM-managed deployment of Keeper EPM.
• Billing-grade audit events for Agentic Access and Agentic Privilege Elevation — new audit tracking events support billing and utilization reporting, and audit timestamps include millisecond precision.

Enhancements

• Cisco VPN exclusions added to the default exclusion set.
• dsa-wrs-app.exe added to exclude.dat, streamlining evaluation.
• Default local port changed to remain compatible alongside Acronis, with documentation updated to match.
• Application collection matching — collection members can be matched by hash only, path only, or path + hash (AND), giving administrators finer control over Application collections.
• Azure and Entra group import — group-import jobs handle a wider range of directory shapes and error conditions during synchronization.
• Pre-inventory warmup for known AI agents — Keeper EPM primes agent metadata at startup so the first Agentic AI launch delivers instant response.
• Policies cleared on unregister — unregistering an endpoint clears its policy cache, keeping endpoint state clean after removal from the console.
• JSON parsing hardened — configuration and policy JSON parsing tolerates a broader range of character-code inputs.

Security

• Hardened AI-agent ancestor detection — agentic privilege elevation validates process identity using PE VersionInfo and trusted Authenticode identity, resolving a Bugcrowd-reported local privilege escalation vector.
• Trusted Signing / short-lived certificate handling — agentic-AI identity verification recognizes timestamped and short-lived Trusted Signing certificates, keeping legitimately signed processes properly identified across their full validity window.
• Elevation tokens redacted from logs — elevation tokens are stripped from log output, hardening log-collection workflows against sensitive-data exposure.
• CURL updated to 8.21.1 — incorporates upstream fixes for high-severity CVEs in the bundled CURL dependency.

Improvements

Windows

• Signed-binary validation via WinVerifyTrust performs reliably across the certificate trust chain.
• Startup resilience: KeeperClient launch retry and Backend/API retry coordinate with network readiness, delivering smoother boot-time initialization.
• KeeperUserSession ephemeral-profile cleanup handles in-use NTUser.Dat files gracefully, delivering a stable removal path with reduced startup and runtime cost.
• Logon-time job and plugin execution is coordinated by boot phase, delivering a smoother, more responsive sign-in experience.
• Windows hook-side optimizations lower policy-evaluation load during high-concurrency events, improving overall responsiveness.
• TCP table lookups remain reliable under burst-load conditions.
• FileAccess wildcard paths resolve relative to the binary directory, so leading-wildcard patterns match as authored.
• Agent UI presents a streamlined Register | Exit menu once an endpoint has been unregistered.
• Windows 11: endpoint registration state clears cleanly when KeeperUnregistraterHelper is run as administrator and the endpoint is removed from console.
• Progress indicator on Windows dismisses cleanly on fast application launches.
• KeeperApproval submits reliably when rapid agentic-AI launches spawn concurrent approval dialogs.
• Port number changes in appsettings.json propagate to every plugin.
• Privilege Elevation with justification: the justification prompt appears reliably on the first attempt.
• Agentic AI auto-update via ShipIt completes cleanly during privilege elevation.
• Detached subprocesses such as chrome_crashpad_handler are traced back to their originating parent application, even when the intermediate process has exited.
• MFA resubmit and retry completes end-to-end in a single flow.
• More specific policies take precedence over wildcard subprocess rules.
• FileAccess hook skips evaluation for event types with no defined policies, reducing per-launch overhead.
• Performance improvement when launching or elevating files from user-profile directories.
• Every Agentic AI request carries a matching Activity Correlation UID across its audit events.
• Consecutive calls to the same agentic-access app are consistently classified and logged as agentic access.
• Agentic grants are reused across Agentic AI subprocess executables in the same session, delivering a single-approval experience for multi-process agents.
• FA ACL enforcement honors all-users policies via UserCheck "*", preserving the Users and Total Restrictions counts.
• Agentic Access Monitor / MonitorAndNotify preserves subprocess attribution when no Enabled AgenticAccess policy exists, keeping agentic audit and Console notifications intact.
• Enriched OpenProcessToken audit events include the process PID and name when both are available.
• File-access attempts made before endpoint registration completes return a clear, actionable diagnostic.
• Audit event stream is streamlined by removing redundant subprocess_* records and expanded with policy_evaluation_status events for FileAccess in every evaluation path, giving reviewers a complete trail.

macOS

System Extension resilience :

• Reliable operation of keeper_auth_event through display-wake cycles.

• Cold-boot startup uses non-blocking user resolution, keeping the extension registered with EndpointSecurity from the first boot cycle.

• A watchdog automatically restores the extension's MQTT connection to KeeperPrivilegeManager, keeping policy delivery uninterrupted.

• UID-to-username resolution completes promptly under enterprise directory configurations, keeping the System Extension and KeeperPolicy stable.

• Request Elevated launches GUI applications, non-GUI (terminal) applications, and DMG installers with the intended admin/root privileges.

• Wildcard FileAccess policy scopes precisely to executable binaries when applied via KeeperClient.

• AgenticAI policies apply consistently to nested .app bundle helpers launched by an approved agent.

• Agentic AI Justification and MFA grants complete in a single prompt, and the target application launches on the first attempt.

• TaskExecutor releases pipe handles cleanly on process timeout, improving long-running stability and audit signal quality.

• Policy evaluation on macOS handles cross-platform policy sets containing Windows-specific path variables cleanly.

• macOS audit events include deduplicated, stamped process ancestry across Agentic AI chains (Cursor, Claude, and shell wrappers).

• macOS auto-update installs the new System Extension build even when the previous build is [activated enabled], ensuring endpoints track the latest release.

• MDM Full Disk Access profile applies to KeeperPrivilegeManager.app automatically, enabling zero-touch enterprise deployment.

• DMG/PKG elevation surfaces a specific, actionable error with resolution steps when Full Disk Access is missing.

Linux

• Kill-on-deny precisely targets the offending wrapper script, preserving surrounding applications such as Firefox and VS Code.
• KeeperLinuxAgent produces concise syslog output for system-UID auto-allow decisions, matching the format used by the other plugins.

Enhancements

Nested Shared Folders With Role-Based Folder Permissions

Keeper introduces Nested Shared Folders with Role-Based Folder Permissions on iOS, a complete redesign of how you organize, share, and protect your records. You can now build folders and subfolders up to five levels deep, so your vault reflects the way your team actually works instead of forcing everything into a flat list.

Permissions flow down automatically from a parent folder through every subfolder and record inside it, so a single sharing decision applies consistently across an entire branch, with the flexibility to make precise exceptions wherever you need them. When more than one permission applies, the most specific one wins: a permission set directly on a record takes priority over one set on its folder, which in turn takes priority over a permission inherited from a parent folder.

Role-based permissions give you granular control over exactly who can view, edit, share, and manage content at every level, and share managers can add users and teams, make bulk permission changes, set access to expire on a chosen date, or revoke it entirely, though no one can grant access higher than their own.

Creating a folder is simpler too: just tap Create New Folder. There's no longer a separate choice between a regular and a shared folder, and you simply tap Share whenever you want to share one.

This new system runs alongside the existing Classic folder system, with two distinct folder icons so you can always tell them apart, and a Classic option remains available when you need compatibility with older workflows.

This feature is currently available by invitation only. To request access or learn more, please contact your Keeper representative or visit keepersecurity.com/contact.

iOS-8123: We've made a wide range of improvements to how files are uploaded and attached, making the experience faster, clearer, and more reliable. You can now select and share multiple files into Keeper in a single action from the iOS Share Sheet, instead of adding them one at a time. A loading indicator now appears the moment an upload starts, so you always get immediate feedback rather than wondering if the app has stalled. Uploads that run into a network problem now stop and show a clear message within a couple of minutes instead of appearing to hang, and on records that require a file attachment, Keeper now prevents saving until the file has uploaded successfully and tells you exactly what went wrong. Large photos and files are now handled more efficiently for better stability on older devices, leftover temporary files are cleaned up automatically after a failed or cancelled upload, and the app will no longer attempts to sync files in the background while you're offline.

iOS-8081: The Notification Center icon now gently pulses when you have new, unread notifications that need your attention, such as an approval request with Approve or Deny buttons. The animation draws your eye to time-sensitive items the moment they arrive, including when they're waiting for you as the app launches, and stops automatically once you open the Notification Center or there's nothing left that needs action.

iOS-8046: Keeper now supports viewing the new PAM Cloud record type on iOS, used for secure, just-in-time access to cloud provider environments such as AWS, Azure, and Google Cloud, as well as SaaS applications. You can open these records on your device and see their details, including login URL, account identifier, and PAM configuration, in a clean, read-only view consistent with other PAM record types.

Bugs

iOS-7597: Corrected an issue where the region and phone number set during sign-up in the UK could change after logging out and back in.

iOS-8121: Fixed an issue when adding an account from a different region than an existing account, which previously showed a confusing alert and failed to add the account. The experience is now clearer and works as expected.

iOS-8117: Resolved an issue where users with Stay Logged In enabled were asked for their current Master Password instead of biometrics when resetting their Master Password.

iOS-8118: Addressed an issue where resetting your Master Password from the login screen could display the wrong error message when account recovery wasn't available.

iOS-8120: Fixed the Account screen incorrectly showing an incorrect renewal date in the Secure File Storage row for users without a file storage plan.

iOS-8125: Corrected a problem where the label and value of a custom password field could fail to display properly when viewing or editing a record.

iOS-8124: Resolved an issue where an internal configuration type incorrectly appeared as an option in the list of record types when creating a new record.

KeeperDB is a fast, secure, cross-platform database management tool. Use it inside KeeperPAM connections or as a standalone desktop app on Windows, macOS, and Linux.

Query, explore, and operate PostgreSQL, MySQL, SQLite, Microsoft SQL Server, Oracle, Amazon Redshift, MongoDB, and Amazon DynamoDB from one interface.

KeeperDB is built for engineers and data scientists. It replaces legacy tools like DBeaver, MySQL Workbench, and pgAdmin. In KeeperPAM, it brings core database workflows into a fully managed passwordless experience.

Quick Links: Product Documentation | Download Now

Version 2.4.0 Summary

KeeperDB 2.4 adds support for NoSQL databases: MongoDB and Amazon DynamoDB. The interface adapts to each database's native query language, so document and key-value workloads get the same guided, safety-checked experience as SQL. This release also adds a "Test Connection" button to the login screen, improves Oracle and SQL Server connection stability, and speeds up browsing of large tables.

KeeperDB 2.4 is available standalone, and built into the upcoming Keeper Gateway release.

MongoDB Protocol

KeeperDB now connects to MongoDB, including MongoDB Atlas and TLS-enabled self-hosted deployments.

• Browse databases and collections in the schema tree
• Write queries in MongoDB's native shell syntax, such as db.Artist.find({}), with JavaScript syntax highlighting
• Results render in a document viewer designed for nested JSON
• Replica set and multi-host deployments are supported through Advanced options
• Destructive operations such as drop() and deleteMany() go through the same confirmation flow as SQL

Amazon DynamoDB Protocol

KeeperDB now connects to Amazon DynamoDB using AWS access keys, with optional session token support.

• Query tables with PartiQL, DynamoDB's SQL-compatible query language
• Browse tables and page through items on the Data tab
• Results render in the document viewer
• A custom endpoint option supports DynamoDB Local for development and testing

Test Connection Button

A new Test Connection button on the login screen validates credentials without opening a session. It reports round-trip latency and the server version, so you can tell a bad credential from an unreachable host before you connect.

More resilient Oracle and SQL Server connections

• Oracle no longer crashes when many sessions close at the same time
• Oracle detects more dead-connection conditions and recovers cleanly instead of surfacing raw driver errors
• Oracle cross-schema browsing now includes tables granted through roles and PUBLIC
• The connection info panel shows which Oracle driver is in use (thin or thick)
• SQL Server detects dropped connections more reliably, and TLS validation now uses the Windows certificate root store
• Sessions launched through KeeperPAM now show an accurate error when database credentials are invalid, instead of a "session ended" screen

Editor and data browsing improvements

• A "refresh" button on the Data tab reloads the current view
• Page navigation on large tables is faster: KeeperDB no longer re-counts rows on every page change

Resources

• KeeperDB Documentation
• KeeperDB Proxy Documentation
• KeeperDB Feature Page
• KeeperAI Documentation
• KeeperPAM

Roadmap

We publish monthly updates based on customer feedback. Send feature requests and bug reports to [email protected], or post on our Reddit community page.

Improvements

• Improved server performance by optimizing slow operations that could cause delays during user role assignment
• Fixed Nested Shared Folder subfolder sharing so that new subfolders correctly inherit team sharing permissions from their parent folder
• Fixed live syncing to properly communicate folder sharing state for subfolders

Bugs

• KA-8905: Fixed an issue where the sharing state of subfolders was not sent during sync operations. Clients now correctly receive sharing state data for all subfolders.
• KA-9136: Resolved a performance issue where a slow operation during user role assignment caused unnecessary delays. The operation has been optimized and moved outside the critical path.
• KA-9137: Fixed a bug where the enterprise key pair setup operation incorrectly returned 400 errors, preventing administrators from completing key pair configuration.
• KA-9140: Fixed a bug where a new Nested Shared Folder subfolder created inside a team-shared folder did not inherit the parent folder's team sharing permissions. Subfolders now correctly inherit team access when the parent folder has inherited sharing enabled.

Enhancements

Nested Shared Folders With Role-Based Folder Permissions

Keeper introduces Nested Shared Folders with Role-Based Folder Permissions on Android, a complete redesign of how you organize, share, and protect your records. You can now build folders and subfolders up to five levels deep, so your vault reflects the way your team actually works instead of forcing everything into a flat list.

Permissions flow down automatically from a parent folder through every subfolder and record inside it, so a single sharing decision applies consistently across an entire branch, with the flexibility to make precise exceptions wherever you need them. When more than one permission applies, the most specific one wins: a permission set directly on a record takes priority over one set on its folder, which in turn takes priority over a permission inherited from a parent folder.

Role-based permissions give you granular control over exactly who can view, edit, share, and manage content at every level, and share managers can add users and teams, make bulk permission changes, set access to expire on a chosen date, or revoke it entirely, though no one can grant access higher than their own.

Creating a folder is simpler too: just tap Create New Folder. There's no longer a separate choice between a regular and a shared folder, and you simply tap Share whenever you want to share one.

This new system runs alongside the existing Classic folder system, with two distinct folder icons so you can always tell them apart, and a Classic option remains available when you need compatibility with older workflows.

This feature is currently available by invitation only. To request access or learn more, please contact your Keeper representative or visit keepersecurity.com/contact.

• AN-9318: The Notification Center icon now gently pulses when you have new, unread notifications that need your attention, such as an approval request with Approve or Deny buttons. The animation draws your eye to time-sensitive items the moment they arrive, including when they're waiting for you as the app launches, and stops automatically once you open the Notification Center or there's nothing left that needs action.
• AN-9377: Keeper can now fill your saved logins directly into the Microsoft Outlook and Microsoft Authenticator apps, so signing in is faster wherever you work. To keep your records accurate and avoid clutter, Keeper fills your existing credentials in these apps without prompting you to save new ones.
• AN-9280: Keeper now supports viewing the new PAM Cloud record type on Android, used for secure, just-in-time access to cloud provider environments such as AWS, Azure, and Google Cloud, as well as SaaS applications. You can open these records on your device and see their details, including login URL, account identifier, and configuration, in a clean, read-only view consistent with other PAM record types. Learn more about Keeper Privileged Cloud.
• AN-9252: We refreshed the Keeper logo across the Android app for a cleaner, more modern look, including the login and splash screens, the manual Autofill sheet, the Autofill search screen, and the Wear OS companion app.

Bugs

• AN-8814: Corrected an issue where a record's type icon could fail to update after a record with an attachment was converted to the newer record format.
• AN-9287: Fixed a brief flicker of the red notification badge that could appear when new notifications synced to your device.
• AN-9248: Resolved a crash that could occur during account switching when removing a user and then adding a third account.

Improvements

• The keeper-automator.jar file is now minimized — unused classes have been removed, resulting in a smaller deployment footprint and faster startup time.
• Windows build hardened: ensures the build\wix directory exists before running heat, and the automator_heat.bat script is more robust against edge-case failures.

Security Updates

• Addressed Bugcrowd reported vulnerabilities.
• Upgraded transitive Netty dependency to remediate a flagged CVE.
• Mitigated multiple library-related CVEs through updated dependencies and Dockerfile hardening.
• Fixed additional vulnerabilities identified by Manifest security scanning.
• Eliminated MavenGate supply-chain exposure by building exclusively from libraries hosted in Keeper Central.
• Automator now rejects setup_crypto step 1 requests when the service is already in a RUNNING state, preventing potential misconfiguration during active operation.

Bug Fixes

• Fixed an issue where team approvals were sending incorrect information, causing users not to be added to Teams after Automator approved the operation.

Update Instructions

• For container deployments, simply update the container and restart the service
• For other deployment methods, see the Automator documentation to update

Advanced Features

• See this page for all of the new and advanced features / settings for the Automator service.