# Changelog

> Changes to CLI, newest first.

- 2026-10-28 [Verify risk scoring, in log mode](https://developers.openwaf.dev/changelog/2026-10-28-verify-risk-scoring/index.md): Every browser challenge and Verify widget check gets a 0–100 risk score from what the request already carries; log only by default. Security events now carry the client's ASN.
- 2026-10-28 [OpenWAF Verify — a brand icon for the verification box](https://developers.openwaf.dev/changelog/2026-10-28-verify-brand-icon/index.md): Client and white-label brands can add an icon (isotype) that the Verify verification box shows next to its checkbox instead of the full logo.
- 2026-10-28 [Under attack mode for OpenWAF Verify](https://developers.openwaf.dev/changelog/2026-10-28-under-attack-mode/index.md): One switch puts every page of a zone behind the browser challenge during an attack, with exempt paths for webhooks and an automatic end.
- 2026-10-28 [Under attack mode asks visitors to tick a box](https://developers.openwaf.dev/changelog/2026-10-28-under-attack-interactive/index.md): While a zone is under attack, the challenge page shows a verification box with a «Verify you are human» checkbox after the proof of work; on by default.