diff --git a/.env.example b/.env.example
index 6e2e418..17f82bf 100644
--- a/.env.example
+++ b/.env.example
@@ -15,9 +15,17 @@ DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN
# Optional: two-tier Gemini validation engine (google-genai SDK).
# Tier 1 pre-filters obvious noise cheaply; Tier 2 deep-validates real / critical
-# findings. Defaults track Google's current lineup (Gemini 3.x); override to pin.
-GEMINI_TIER1_MODEL=gemini-3.1-flash-lite
-GEMINI_TIER2_MODEL=gemini-3.5-flash
+# findings. Defaults track Google's current lineup: Tier 1 on 3.5 Flash-Lite
+# (fastest / most cost-effective 3.5-class), Tier 2 on 3.6 Flash (stronger
+# reasoning workhorse). Override to pin a specific model.
+# Tip — list the exact model IDs your key can call before overriding:
+# curl -s "https://generativelanguage.googleapis.com/v1beta/models?key=$GEMINI_API_KEY" | jq -r '.models[].name'
+GEMINI_TIER1_MODEL=gemini-3.5-flash-lite
+GEMINI_TIER2_MODEL=gemini-3.6-flash
+# Security-focused option: point Tier 2 at the security-specialised 3.5 Flash
+# Cyber model (tuned to detect/reason about software vulnerabilities) once your
+# API key can call it — a strong fit for the deep secret-validation tier.
+# GEMINI_TIER2_MODEL=gemini-3.5-flash-cyber
# Reasoning effort per tier (Gemini 3.x thinking_level): minimal|low|medium|high
GEMINI_TIER1_THINKING=minimal
GEMINI_TIER2_THINKING=high
@@ -25,7 +33,7 @@ GEMINI_TIER2_THINKING=high
# (comma-separated: CRITICAL,HIGH,MEDIUM,LOW).
GEMINI_ESCALATE_SEVERITIES=CRITICAL
# Back-compat: a single GEMINI_MODEL (legacy) is honoured as the Tier-1 model.
-# GEMINI_MODEL=gemini-3.1-flash-lite
+# GEMINI_MODEL=gemini-3.5-flash-lite
# Optional: Comma-separated list of origins allowed to call the API from a
# browser (CORS). Leave empty if the dashboard is always served from the
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32da708..fe0efd5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,27 @@
All notable changes to SecretNode are documented here. This project adheres to
[Semantic Versioning](https://semver.org/).
+## [2.7.1] — Gemini validation-engine model refresh
+
+Tracks Google's current Gemini lineup for the two-tier AI validation engine, with no
+change to the engine's logic — only the default model IDs (all remain env-overridable).
+
+### Changed
+- **Tier-1 pre-filter default → `gemini-3.5-flash-lite`** (was `gemini-3.1-flash-lite`): the
+ fastest / most cost-effective 3.5-class model, a natural fit for the high-volume noise-rejection
+ tier.
+- **Tier-2 deep-validation default → `gemini-3.6-flash`** (was `gemini-3.5-flash`): the stronger
+ coding/reasoning workhorse, for confirming genuine high-severity exposures.
+
+### Added
+- **Security-specialised Tier-2 option.** `.env.example` documents pointing `GEMINI_TIER2_MODEL`
+ at the security-tuned **3.5 Flash Cyber** model (built to reason about software vulnerabilities)
+ for security-focused deployments, once a key can call it — a strong fit for the deep
+ secret-validation tier.
+
+All model IDs stay overridable via `GEMINI_TIER1_MODEL` / `GEMINI_TIER2_MODEL`; the legacy
+single-model `GEMINI_MODEL` override is still honoured. No test or logic changes — suite stays green.
+
## [2.7.0] — Deep attack-surface platform (passive)
SecretNode grows from a single-URL secret scanner into a **passive attack-surface platform**: give it
diff --git a/README.md b/README.md
index 5c3ed18..7db7711 100644
--- a/README.md
+++ b/README.md
@@ -102,8 +102,8 @@ Pipeline: **browser-like spider (+ source-map mining) → regex (54 patterns) +
│ └─ shannon_entropy() (filter < 3.5 bits) │
│ │
│ validate_with_gemini() — two-tier engine (google-genai SDK) │
-│ └─ Tier 1 pre-filter: gemini-3.1-flash-lite (thinking:min) │
-│ └─ Tier 2 deep-valid.: gemini-3.5-flash (thinking:high) │
+│ └─ Tier 1 pre-filter: gemini-3.5-flash-lite (thinking:min) │
+│ └─ Tier 2 deep-valid.: gemini-3.6-flash (thinking:high) │
│ └─ Structured output → Pydantic GeminiVerdict │
│ {is_valid, confidence, reason} │
│ │
diff --git a/backend/report.py b/backend/report.py
index ee96b9a..af8ca32 100644
--- a/backend/report.py
+++ b/backend/report.py
@@ -45,7 +45,7 @@ def _tool_version() -> str:
return s.split("=", 1)[1].strip().strip('"').strip("'")
except Exception:
pass
- return "2.7.0"
+ return "2.7.1"
_TOOL_VERSION = _tool_version()
diff --git a/backend/scanner.py b/backend/scanner.py
index 5158a66..ab3e95e 100644
--- a/backend/scanner.py
+++ b/backend/scanner.py
@@ -44,9 +44,15 @@
# and thinking levels are env-overridable so the engine tracks Google's lineup
# without a code change. A legacy single-model GEMINI_MODEL override, if present,
# is honoured as the Tier-1 model so existing deployments keep working.
+#
+# Defaults track Google's current lineup: Tier 1 on 3.5 Flash-Lite (fastest /
+# most cost-effective 3.5-class, ideal for the high-volume pre-filter) and Tier 2
+# on 3.6 Flash (stronger coding/reasoning workhorse). For security-focused
+# deployments, set GEMINI_TIER2_MODEL to the security-specialised 3.5 Flash Cyber
+# model (tuned to reason about vulnerabilities) once your key can call it.
_LEGACY_MODEL = os.environ.get("GEMINI_MODEL", "").strip()
-GEMINI_TIER1_MODEL: str = os.environ.get("GEMINI_TIER1_MODEL", _LEGACY_MODEL or "gemini-3.1-flash-lite")
-GEMINI_TIER2_MODEL: str = os.environ.get("GEMINI_TIER2_MODEL", "gemini-3.5-flash")
+GEMINI_TIER1_MODEL: str = os.environ.get("GEMINI_TIER1_MODEL", _LEGACY_MODEL or "gemini-3.5-flash-lite")
+GEMINI_TIER2_MODEL: str = os.environ.get("GEMINI_TIER2_MODEL", "gemini-3.6-flash")
GEMINI_TIER1_THINKING: str = os.environ.get("GEMINI_TIER1_THINKING", "minimal")
GEMINI_TIER2_THINKING: str = os.environ.get("GEMINI_TIER2_THINKING", "high")
# Severities that ALWAYS escalate to the deep tier, even if the cheap pre-filter
diff --git a/frontend/index.html b/frontend/index.html
index e0bd9b3..99f7f68 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -3,7 +3,7 @@
- SecretNode v2.7.0 — ASM Scanner
+ SecretNode v2.7.1 — ASM Scanner