What's New in Nullafi Shield v3.11.2

v3.11.2Released: November 3, 2026 · Container image: public.ecr.aws/nullafi/shield:v3.11.2

Overview

0

New Features
1

Improvements
5

Bug Fixes
0

Security Fixes

Version 3.11.2 restores expected rule behavior for Username and Group conditions and for rule time filters, and makes response rules detect, block and log consistently across web pages, files and streamed AI answers.

Policy

Rule behavior changes that take effect with this release.

Policy & Compliance

Multiple Username or Group conditions are alternatives again A rule with several is equal or contains conditions of the same kind — for example, "Group is equal Sales" and "Group is equal Marketing" — applies to users who match any one of them, as it did before 3.11. is not equal and does not contain conditions act as exclusions that must all hold, and an is equal match takes precedence over an exclusion of the same kind. When a rule has both Username and Group conditions, both must be satisfied. Matching ignores upper/lower case.

Overnight time windows now run past midnight A time window that crosses midnight, such as Friday 22:00–06:00, now covers Friday 22:00 through Saturday 06:00. The hours after midnight belong to the day the window starts on, so Saturday doesn't need to be selected. This differs from earlier versions, where the window stopped at midnight — review rules with overnight windows after upgrading.

Response rules log what they actually did Responses covered by a rule now report every sensitive data type they contain in the Data Log, and blocked responses are logged as blocked rather than masked.

Policy documentation

Improvements & Bug Fixes

Full list of resolved issues and quality improvements in this release.

Type	Description	ID
Improvement	Rule time windows that cross midnight now continue into the following morning, so an overnight window such as Friday 22:00–06:00 covers early Saturday without selecting Saturday.	NS-825
Fix	Fixed an issue where a rule with more than one Username or Group condition applied only to users matching all of them. A rule for "Sales or Marketing" now applies to members of either group, including groups sent by the proxy.	NS-824
Fix	Fixed an issue where a rule time filter set to bypass never applied the rule. Bypass rules now apply at all times outside the configured days and hours.	NS-825
Fix	Fixed an issue where, when a response rule's own data types were absent, other sensitive data in the response was not detected or shown in the Data Log.	NS-832
Fix	Fixed an issue where response block rules did not block CSV files, streamed AI answers or Snowflake results; the content was delivered masked instead. Streamed answers covered by a block rule are now delivered once fully checked.	NS-832
Fix	Fixed an issue where blocked web page and API responses were logged in the Data Log as masked. They are now logged as blocked.	NS-832

Upgrade Instructions

Follow these steps before upgrading in production. Estimated time: 10 minutes.

Back up your database and configuration files Take a full snapshot of your database and export your current configuration — including your .env and any custom policy files. Store backups off-instance before proceeding.
Review rules affected by the behavior changes Check rules that use multiple Username or Group conditions, time filters set to bypass, or overnight time windows, and confirm they match your intent under the behavior described in Policy above.
Pull and deploy the updated container image
```
docker pull public.ecr.aws/nullafi/shield:v3.11.2
```
Configure your container runtime scripts or commands to use the new image. (If using Nullafi's sample Docker Compose files, modify the .env file so that SHIELD_IMAGE points to the new image.) Restart the Shield service after pulling the updated image.

nullafi.com · docs.nullafi.com · support@nullafi.com · Previous releases