Every feature, fix, and improvement — in order. We ship fast.
Jun 2026v3.0New
Advanced Security Analysis — 6 New Deep Security Modules
·Email Security module: SPF, DMARC (policy enforcement), DKIM (13 common selectors), MX, BIMI, MTA-STS (TLS enforcement), and TLS-RPT — all via Cloudflare DNS-over-HTTPS, no API key required. Email security score (0–95) with OWASP and CWE mapping per finding.
·DNS Security module: DNSSEC (DS + DNSKEY validation), CAA records (wildcard issuance control), NS redundancy check, SOA consistency validation, and dangling CNAME subdomain takeover detection. Maps to OWASP, CWE, NIST CSF, and MITRE ATT&CK.
·AI Security module (passive): AI API endpoint discovery (14 providers — OpenAI, Anthropic, Gemini, Groq, AWS Bedrock, Azure OpenAI, etc.), system prompt exposure detection, client-side AI SDK detection (LangChain, OpenAI SDK, Anthropic SDK), and denial-of-wallet cost abuse indicators. Maps to OWASP LLM Top 10 2025.
·API Exposure module: active HTTP probes for 23 high-risk paths — .env files, .git repository, Swagger/OpenAPI specs, GraphiQL IDE, debug endpoints, phpinfo.php, server-status, database admin tools (phpMyAdmin, Adminer), WordPress user enumeration. Maps to OWASP API Top 10 2023.
·Breach Intelligence module: passive compromise signal analysis — defacement marker detection, obfuscated JS injection patterns, suspicious HTTP headers (X-PHP-Originating-Script), nameserver reputation checks. Explicit evidence labels and false-positive disclosure on all findings.
·Evidence Framework: every finding uses one of 7 evidence labels (Verified, Detected, Observed, Likely, Potential, Manual Review Recommended, Unable to Verify Automatically) with confidence score, detection source, validation method, and false-positive likelihood.
·Standards Mapping: every finding mapped to relevant OWASP Top 10, OWASP API Top 10, OWASP LLM Top 10 2025, CWE, NIST CSF, and MITRE ATT&CK identifiers.
·New API endpoint: POST /api/scan-framework-v2 — accepts {url}, runs all 6 modules in parallel, returns per-module scores (A–F grades) and an Overall Security Score.
·Compare page: 5 new feature categories added — Email Security (8 rows), DNS Security (6 rows), AI Security (5 rows), API Security (8 rows), Secret Detection (8 rows).
·Features page: 4 new feature cards added — Email Security Scanner, DNS Security Scanner, AI Security Scanner, API Exposure Scanner.
Jun 2026v2.9Improved
Advanced Security Analysis — Accuracy Pass & Scanner Inventory Complete
·Accuracy fix: security header count corrected from '13+' to '6' everywhere it appeared (compare page, features page, homepage JSON-LD) — SECURITY_HEADER_NAMES in crawler.ts has exactly 6 entries (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
·Scam detection: URLhaus added to features page description (was missing — all 4 sources are Google Safe Browsing, VirusTotal, URLhaus, PhishTank)
·Scam detection: features page description expanded to cover urgency language detection, payment gateway validation (Stripe, PayPal, Razorpay, Square), and design quality signals
·Compare page: added 2 privacy rows — privacy policy page detection (live HTML scan) and Terms of Service page detection (live HTML scan) from scam detector module
·Compare page: added 2 threat rows — urgency/scam language pattern detection and payment gateway legitimacy validation (Pro) from scam detector module
Jun 2026v2.8Fix
Security Hardening & Product Synchronization
·Security fix: cron job auth moved to x-cron-secret header (was URL param) across all routes
·Security fix: emergency admin login bypass removed — all admin auth now requires proper token
·Security fix: hardcoded admin email removed from waitlist and support ticket routes
·Trust Badge: FAQ corrected — award threshold is 80+ (not 70+), validity is 90 days (not 30)
·FAQ: Agency API access documented as live — API keys available from the Agency dashboard
·Compare page: reorganized into 9 category groups (SEO & Technical, Website Security, Secrets Detection, Privacy & Compliance, Threat Intelligence, AI Features, Code Audit, Reporting, Agency & Developer) — 57 rows total
·Compare page: Privacy section updated to use accurate 'Technical Signals [Requires Legal Review]' language for GDPR/CCPA/DPDP
·Features page: added Code Audit module card covering logic gaps, data leaks, performance bloat, and GDPR/DPDP compliance signals in code
·Pricing table: added Pages per scan limits (Free: 1 / Starter: 5 / Pro: 25 / Agency: 50), multi-client dashboard, team seats, and API access rows
·API docs: corrected all endpoint paths from /api/team/* (ghost routes) to /api/agency/* (live routes) — added API key management, webhook, and team member endpoints
·PDF report: added optional AI Executive Summary section (verdict, priority actions, fix time, content authenticity verdict)
·FAQ: added Code Audit, AI CTO Summary, and multi-page scan limit questions
Jun 2026v2.7Growth
Onboarding, Leaderboard & Credits Redemption
·New user welcome modal — guides first scan, social share, and referral invite
·Public /leaderboard page — top 90+ scoring sites ranked with verified badges
·Credits redemption — spend credits on bonus scans or generate discount codes
·Public /changelog page (this page!)
Jun 2026v2.6Growth
Re-engagement Drip + Signup Enhancements
·Daily re-engagement email cron — scan nudge for 0-scan users, upgrade nudge for free users
·Post-signup: magic link confirmation notice, 'Run your first audit' CTA
·Referral milestone progress bar on waitlist screen (3 referrals → Priority Access)
·Re-engagement Drip agent added to Admin Agents tab with Run Now button
Jun 2026v2.5New
Scan Limit Upsell Modal
·Dedicated ScanLimitModal replaces generic pricing popup when free limit is hit
·Shows countdown timer to midnight UTC (when scans reset)
·Social proof strip + two CTAs: Pro monthly and Starter one-time
·Scan counter button glows and changes text at limit
Jun 2026v2.4New
Viral Badge Email + Share Score + Blog Optimizer
·Auto badge award email fires when a site scores 80+ — includes embeddable HTML badge
·ShareScoreButton on audit results — X, LinkedIn, WhatsApp, copy link with score-aware copy