Changelog

What's new in XploitScan

The benchmark page now names the version of every scanner it compares against

  • +The methodology section of the benchmark page was showing a blank space where Bearer's version number should have been. The comparison itself was never affected — the numbers on the page are correct — but the page could not tell you which build of Bearer produced them, which is the whole point of publishing a methodology. It now names the version, and the same page states Semgrep's version the same way.
  • +If a version genuinely cannot be determined, the page now leaves it out of the sentence instead of printing an empty value. We would rather say less than show you something we did not actually measure.

CLI 1.3.4 — please upgrade if you are on 1.3.3

  • +If you installed xploitscan 1.3.3, upgrade to 1.3.4. A change intended only to print an accurate rule count in the terminal caused the published package to carry rule definitions that belong to the paid tier. 1.3.4 removes them; the count is unchanged and still correct. Run `npm i -g xploitscan@latest`, or nothing at all if you use `npx`, which will pick up the new version on its own.
  • +The scanner's own detection benchmark now reports its coverage correctly. The page said a number of rules had no test fixtures that was wrong twice over — first by four, then by one — because the count was written by hand and then computed against a list that includes the entropy scanner, which is not one of the rules being counted. It is now derived from the rule catalog itself, so it stays right as rules are added.

Prove you own the domain, and we'll scan the source behind your public source maps

  • +The top navigation now fits every window it is in, and collapses to the menu button at widths it cannot fill. Signed-in visitors see their own links on first paint rather than the marketing menu, and the bar stays put as you move between pages.
  • +New: if your source maps are public, we can now scan the source behind them. When a URL scan finds source maps being served, prove you control that host and we'll download them, rebuild your original TypeScript, and run the full rule set over it — real findings at file and line, with no repository access and nothing to install. It is the same scan you'd get from pointing the CLI at your code, reached from a URL box.
  • +Proving it takes about a minute: we give you one line to save at /.well-known/xploitscan-verification.txt on that host, and check for it. A DNS TXT record works too if you'd rather, and if you control the zone — many apps live on a builder-provided subdomain where you don't, which is why the file comes first. The proof belongs to your account, so verifying a domain doesn't hand it to anyone else, and we re-check it rather than trusting it forever, because hosts change hands.
  • +The reconstructed scan always tells you what it could not read. Plenty of builds ship maps without the original file contents embedded, and a large map may be more than one scan will download — in either case you get the count of files that went unchecked instead of a clean-looking result over half your app. Nothing is stored: the source is rebuilt in memory for that one request and dropped.
  • +Everything the URL scan already did stays free and needs no account. The verification step exists only for the reconstructed scan, because that output is the one thing on the page that isn't already sitting in your visitors' devtools.
  • +Every verification command on those pages tells you what it can answer on your plan. Some of the checks they cover run only on a paid plan, so each command names the rules a free scan skips and says what the number it returns does and does not mean — a zero from a command whose checks never ran is not a clean result, and a command that mixes free and paid checks returns the free one's count, not nothing. Same for the closing call to action: the first scan still needs no card and no signup, and it runs the 30 free rules rather than the full 212 the Index round used.
  • +The other three builder pages are now live: /for/v0, /for/bolt and /for/base44. Each reads its own builder's results rather than repeating Lovable's, and what repeats genuinely differs — v0 projects come with a real server from the first prompt, so unprotected route handlers lead; Base44 apps run against a hosted backend, so permission checks written in the browser lead; Bolt's smallest sample leads with a secret travelling back out in an error response. Every page carries what we're worst at on that builder's code alongside what we catch, with the confidence interval attached. The Bolt page is deliberately reported in counts rather than percentages, and says why: its sample is the thinnest in the round, and a rate over that many projects would read as more precise than anything we measured.
  • +The URL scanner now describes what a source map actually contains instead of assuming. It used to tell every site with a public map that anyone could reconstruct its original TypeScript — which was wrong whenever the map held plain JavaScript, and wrong again when the code belonged to a theme or a library rather than to the person running the site. It now reads the file list in the map, names the real language, and says plainly when the exposed code is third-party, so a finding about a WordPress theme's bundled script no longer reads like your own application source is on the internet. Genuine exposure of your own code is reported exactly as strongly as before.
  • +New page: xploitscan.com/security-questionnaire. If a prospect has sent you a security questionnaire and the deal is waiting on it, that page explains what the questionnaire tools do — the questions covered, how answers get sourced from your scan history, what stays blank for you to write, and which plan it's on. It's also reachable from Resources in the top nav, and if you're signed in below Pro it now appears under Procurement, where the tools themselves were previously invisible to you.
  • +Every questionnaire answer now shows what's behind it. Answers drawn from a scan are marked Verified by scan and carry the date and how many scans are on record; answers drawn from your trust page or your security checklist are marked Self-attested, because they're your own entries rather than something we measured. Both are useful and they aren't the same thing, and a procurement reviewer can now tell at a glance which is which. Scan-backed answers also show their age, and once the evidence passes 90 days we say so and suggest a re-scan rather than letting a nine-month-old result read like this morning's. The labels survive Print / Save as PDF, so whoever receives the document sees the sourcing too.
  • +The security questionnaire now answers only what your account can actually show. Several questions used to arrive pre-filled with claims about your side of things — that scans run on every code change, that findings block your deploys, that your traffic is on TLS 1.2 — whether or not anything on your account supported them. Those are facts about your pipeline and your infrastructure, and we have no way to see them, so they now come to you blank to fill in. The questions we can answer from your scan history still fill themselves, and now cite the date of the scan they came from, so a procurement reviewer can see what's behind each one. If you've never scanned, the security questions stay empty rather than agreeing on your behalf.
  • +The endpoint-authentication check now reads Supabase Edge Functions. If your app is a Vite or React front end talking to Supabase, your whole backend lives in supabase/functions/ — and that check only understood Next.js and Express handlers, so it had almost nothing to say about your server code. It now flags an edge function that never establishes who is calling it, and stays quiet when the function resolves the caller's token, leaves the tenant boundary to row-level security, verifies a signature, or is a health check, preview image or scheduled job. The same check also picks up Next.js route handlers written as export const GET = async () => {}, which it used to read straight past. As always, // VC003-OK: <reason> marks any endpoint that's public on purpose.

Scanning the same code twice now gives you the same answer

  • +Scan results are reproducible. Both AI-assisted steps — the false-positive review that removes findings, and the optional contextual analysis that adds them — now run at a fixed sampling setting, so scanning unchanged code returns the same findings and the same grade every time. Both previously ran at the model's default sampling, where a second scan could quietly differ from the first with nothing in your code having changed.
  • +Scanning a subdirectory now respects the .xploitscanignore at your project root. Previously that file was only read when it sat directly in the directory you scanned, so xploitscan scan src/ — and any CI job pointed at a single package in a monorepo — quietly scanned everything you had excluded. Paths are matched relative to the file that declares them, and a nested .xploitscanignore still takes precedence, exactly like .gitignore.
  • +The GitHub Action's outputs (grade, score, findings-count, the per-severity counts, and sarif-file) now carry real values, so you can branch on them in later workflow steps. They previously resolved to an empty string.
  • +Your Trust Page can now show how your app compares to the Vibe Security Index. When your latest scan supports it, the scanning section adds a line like "Fewer findings than 62% of the 25 Lovable apps we scanned for the Vibe Security Index" — matched to the builder that scaffolded your project where we can tell, and to the whole round where we can't. The sample size is always in the sentence, the methodology is one click away, and the line simply doesn't appear when the sample is too small to support it. It is a comparison, not a badge or a certification.
  • +The inline "I've reviewed this" comment now works where you most need it. Marking a single finding as accepted with // VC003-OK: <reason> or // ENTROPY-OK: <reason> had no effect on those two checks — the endpoint-authentication check and the high-entropy-string check — so the only way to quiet one intentionally-public endpoint or one published verification token was to exclude the whole file. Both now honour the marker, and your explanation can run across several lines instead of having to fit on one.
  • +New: scan a URL, no signup. Paste your app's address at /url-scan and see what your deployed build already tells every visitor. Top of the list is whether your source maps are publicly served — if they are, anyone can reconstruct your original TypeScript, comments and all. Below that: whether your backend configuration ships to the browser, which AI builder the bundle looks like it came from, and which security headers are missing.
  • +The URL scan reads only what your site already serves any browser — its HTML, its JavaScript bundles, its response headers. It never sends attack payloads, never attempts a login, and never queries anyone's database. It is deliberately a smaller question than a code scan: it can tell you your source maps are public, but it cannot see the authorization check missing from an API route, because that code never reaches the browser.
  • +When a builder is detected, the report quotes that builder's Vibe Security Index rate beside it — how often apps built with the same tool turned out to have a critical finding, with the sample size printed next to the number so you can see what it is worth. The report holds nothing back: it names the exact source maps it confirmed and the backend project it found, because every one of those values is already served to anyone who opens your site in a browser. Find it under Scan a URL in the nav.
  • +The navigation menus are now fully keyboard-operable. Open a menu with Enter, Space or the arrow keys, move through it with Up and Down, jump with Home and End, and close it with Escape — which puts you back on the button you opened it from. The mobile menu closes on Escape too, and it no longer stays stuck open when you widen the window past the point where its button disappears. Screen readers now get the menu behaviour they were already being promised.
  • +New: What Lovable apps get wrong, at /for/lovable. If you build with Lovable, this is the security findings that actually repeat across the 25 Lovable projects in the latest Vibe Security Index round — and for each one, why building this way produces it, the prompt change that stops it coming back, and the command that proves it's gone. It also says where our own detection is weakest on this kind of code, because a scanner that only advertises what it catches isn't much help in deciding whether to trust it. Aggregate only, every rate shown with the count behind it, no repository ever named. More builders to follow.

Your grade now reflects your code, not your scaffold — and a public index of what AI builders ship

  • +Findings in code you didn't write no longer set your security grade. AI app builders copy shadcn/ui into your project verbatim, codegen writes into __generated__/, and READMEs contain example code that exists to show what not to do. All of it is still scanned and every finding is still reported — it just doesn't decide your grade or fail your CI build.
  • +This was a real problem, not a theoretical one: one vendored UI component uses dangerouslySetInnerHTML to set CSS variables, which trips a critical XSS rule, and a single critical caps a project at grade D. Across a 20-repo study of Lovable, v0, Bolt, and Base44 projects, that one library file was driving the grade in most of them. Projects graded on their own code now see a very different — and accurate — result.
  • +Nothing is hidden. Held-out findings appear in the CLI, the web report, the SARIF upload, and the GitHub Action's PR comment, each tagged "Not graded," with the count shown right next to the grade. A grade that excluded findings always says so.
  • +Prefer to grade everything? Run xploitscan scan . --grade-vendored, or set { "scan": { "gradeVendored": true } } in .xploitscanrc.
  • +New: the Vibe Security Index. That 20-repo study became a recurring public one. Each round we sample public repositories built with Lovable, v0, Bolt, and Base44, scan them with the full rule set, and publish the aggregate results — how often critical findings show up, how grades are distributed, and which issues repeat. It applies the same application-versus-scaffold split described above, so no builder is charged for a component library it copied in. No repository is ever named: every figure is an aggregate, because publishing the list would mean pointing at live vulnerabilities in other people's projects. The full methodology and every limitation we know about are published beside the numbers.
  • +Dashboard: choosing "All Projects" now shows a genuine portfolio grade — the average across each project's most recent scan, with total open findings by severity beside it. It previously showed whichever single project you happened to scan last, which read as your overall posture when it wasn't. The portfolio grade now matches the one on your reports and exported PDFs.
  • +The Index now publishes the median project size per builder, because it changes how the table should be read: this round spans a fivefold range, and a smaller app has fewer places for a critical finding to occur regardless of how it was built. The vendored-scaffold column also carries a plain warning that it is not a security ranking — it mostly reflects how much of a component library each builder copies in, so a 0% rate means a builder vendors less code, not that it writes safer code.
  • +The benchmark page and the Index now link to each other. They answer different questions and both answers matter: the benchmark is whether the scanner is accurate, measured against code where the right answer is already known; the Index is what that same scanner finds when pointed at real projects.

A smoother path from first scan to signed up, and docs that match the CLI exactly

  • +The live demo scanner now gives you 3 scans of your own code per day, plus unlimited scans of the sample code — so you can kick the tires properly before creating an account. Try it from the new Live Demo link in the nav.
  • +Pricing buttons now take you straight to sign-up with your plan and billing interval pre-selected, and signing in returns you to whatever you were doing instead of dropping you on the dashboard.
  • +Anonymous and free-plan web scans now run the 30-rule free set — the same set the free plan gets in the CLI and everywhere else — and every scan result reports exactly how many rules ran. Paid plans scan with all 210+ rules on every surface.
  • +Documentation refresh: the docs and guides now match CLI 1.2.2 exactly — current flags (--diff, --watch, the SIEM output formats), the real .xploitscanrc reference, complete GitHub Action inputs and outputs, and an API reference listing the actual public endpoints.
  • +Slack and Discord webhook settings (Pro) now save to your account instead of a single browser. Configure them once in Settings → Webhooks and scan-complete notifications fire for every scan you upload — web, CLI, or CI. Settings previously saved in this browser are picked up automatically; just hit Save once to finish the move.

We added a benchmark case we can't detect (on purpose)

  • +The held-out benchmark now includes a real-world broken-access-control (BOLA) case — a logged-in user editing another user's record — that no scanner we test catches today, including ours. The held-out score is now 15 of 16, with the miss shown openly on the benchmark page. Static analysis genuinely struggles with authenticated-but-not-authorized bugs, and we'd rather show you that gap than hide it.
  • +Scans now recognize what built your project: reports say "Detected: Lovable + Cursor project" when the scaffold is unambiguous, so findings read in the context of what those tools typically get wrong.
  • +Improved IDOR detection for Express and Hono apps: routes that fetch a record by a request-supplied ID (URL, body, or query) without an ownership check are now flagged — tuned to avoid false positives on routes that already enforce ownership. The new held-out case above is a harder shape those improvements don't yet cover.

A buyer's guide for AI-code scanners, plus clearer comparisons

  • +New guide: "the best security scanner (SAST) for AI-generated code." An honest, side-by-side look at XploitScan, Semgrep, Snyk, and Bearer — anchored to a held-out third-party benchmark none of them were tuned against (XploitScan 15/15, Bearer 9/15, Semgrep 8/15 at the time; now 15/16 — see the July 3 entry) — with a straight answer on which tool fits which job.
  • +Every comparison page now opens with a plain-language verdict and answers the questions people actually ask — does it replace the other tool, which is better for a solo dev, how detection works, and where the other tool legitimately wins.
  • +The Semgrep comparison and the Semgrep benchmark write-up now show their results in a clean table instead of a text block, so the numbers are easier to scan and cite.

XploitScan in your editor, plus hardcoded-PII detection

  • +XploitScan is now a VS Code extension. Install it from the Marketplace and every file you save gets scanned for vulnerabilities right in your editor — findings land in the Problems panel, it runs locally, and nothing is uploaded. Same engine as the CLI and web app.
  • +New: detection for hardcoded personal data. The scanner now flags real credit card numbers and US Social Security Numbers left in source. Both are tuned to stay quiet on test cards and lookalike values, so they catch the real thing without the noise.
  • +More to compare and read: new side-by-side comparisons vs Bearer, Checkmarx, and Burp Suite, plus two new guides — a practical pre-deploy security checklist for AI-generated code, and a deep dive on the Django ALLOWED_HOSTS = ['*'] wildcard.

100% detection on third-party code, head-to-head held-out comparison, and smoother scanning

  • +The held-out benchmark — real vulnerabilities from public projects like OWASP NodeGoat and Juice Shop that no XploitScan rule author ever saw — now scores 10 out of 10. Two new detections closed the final gaps: SQL injection where the query is built in a variable before reaching the database call, and SSRF through the needle, superagent, and undici HTTP clients. Both ship across the CLI, web scans, API, and GitHub Action.
  • +The benchmark page now runs Semgrep and Bearer against that same held-out corpus with the same scoring, side by side. Current standing: XploitScan 10/10, Semgrep 6/10, Bearer 6/10 — with the per-class breakdown published so you can see exactly what each scanner catches and misses.
  • +New on the blog: "Why we don't trust our benchmark" — an honest look at why a perfect score on a self-authored corpus isn't enough, and how the held-out set keeps us accountable.
  • +Fixed an issue that could prevent scans started from the website from completing. Demo scans and signed-in scans both run reliably again.
  • +The docs now cover connecting your account end to end: CLI login, API keys for CI, exit codes for build gating, and MCP server setup in the Quick Start.
  • +Hand-typed URLs like /sign-up and /login now land on the right pages instead of a 404.

Report false positives in one click, plus a smoother first scan

  • +Every finding now has a "Not a real issue?" link. If the scanner flags something that's intentional, test code, or just wrong, tell us in two clicks — pick a reason, add optional context, done. Reports go straight to the team and feed directly into rule tuning, so the detections you see keep getting more precise.
  • +Try a scan on the home page, then sign up, and your results carry straight into your account — re-scanned with the full Pro rule set, waiting on your dashboard. No more re-pasting the code you just scanned.
  • +New to XploitScan and don't have a project handy? The dashboard now offers a one-click scan of a sample project so you can see exactly what a real report looks like before uploading your own code.
  • +Signup form streamlined — the agree-to-terms step no longer greys out the form, so getting started is cleaner and faster.
  • +After a clean scan, we now nudge you to publish a Trust Page so you can show customers and prospects your security posture with a verified public badge.

Trust Page polish, CLI reliability, and five rule precision fixes

  • +CLI v1.1.8 published — a reliability fix so scan uploads consistently reach your dashboard and Trust Page. Run `npm install -g xploitscan@latest` to pick up the fix.
  • +Trust Page timestamps now render in the visitor's local timezone instead of UTC. A scan that ran at 7:43 PM Eastern no longer displays as 11:43 PM to the visitor — the timestamp shows in whatever timezone their browser is set to.
  • +Trust Page badge layout updated to read "[Company Name] — Verified by XploitScan" instead of the previous "Secured by [Company Name]". The earlier wording read as the customer attesting to themselves; the new order makes XploitScan's third-party verification explicit. Existing embedded badges update automatically within five minutes of the next view (CDN cache window) — no need to re-paste the HTML.
  • +Several common false-positive patterns no longer flag — everyday safe idioms around config constants, parameterized queries, intentional HTML rendering, and authenticated routes. Rule precision improves accordingly on real codebases, so there are fewer noise findings to triage.
  • +New `// VC###-OK: <reason>` inline silencer convention. Add it on the same line or directly above an intentional finding to suppress that one site without weakening the rule globally. Currently honored by VC063 (dangerouslySetInnerHTML) and VC146 (token in URL). The `// scanner-OK` wildcard form silences any rule at that site.
  • +Scan API now picks up rule changes automatically on every deploy — no more occasional drift between the CLI's rule set and what api.xploitscan.com runs. Rule fixes published to npm propagate to all five surfaces (CLI, MCP server, GitHub Action, web app, edge API) on their next deploy.
  • +Security disclosure contact consolidated to admin@xploitscan.com on the /security page, RFC 9116 security.txt files, and the GitHub-rendered SECURITY.md. One inbox handles both general support and vulnerability reports.
  • +Web framework dependency (Hono) bumped to 4.12.19 to pick up the latest security patches.
  • +Released `xploitscan-shared-rules` v1.7.0 on npm — bundles the five rule precision fixes plus the new inline-silencer helper. Downstream CLI / MCP / Action publishes follow within hours.

XploitScan GitHub App, plus refreshed CLI, MCP, and Action releases

  • +The XploitScan GitHub App is live — install it on any account or organization and every pull request gets an automatic security scan posted as a Check Run, with findings shown inline in the diff view. Free plan covers the core 30 rules; Pro and Team unlock the full 206-rule set plus the AI false-positive filter on every PR. Install at github.com/apps/xploitscan or from your dashboard.
  • +Dashboard now has a GitHub tab listing your installed accounts, recent PR scans across all of them, and one-click links to manage which repositories the App can see.
  • +GitHub Action v1.3.2 published — the Marketplace listing and the PR-comment footer both now accurately advertise the full 206-rule Pro set. The previous release was still showing the older 158-rule count from before the spring rule additions.
  • +Marketplace description tightened to fit GitHub's 125-character cap so the action is cleaner to skim on its discovery page.
  • +CLI v1.1.2 and MCP server v1.1.2 published on npm — both rebuilt against the current rule corpus so `npx xploitscan@latest` and any AI agent using the MCP server pick up the exact same detection set the web scanner uses.
  • +Page-load reliability improvements across the site for visitors using browsers with strict security policies — a few residual console errors are now gone and the product analytics that drive roadmap decisions are more accurate.

GitHub Action Pro unlock, live demo repo, and pricing polish

  • +GitHub Action Pro unlock is live — add `api-key: ${{ secrets.XPLOITSCAN_API_KEY }}` to your workflow to run all 206 rules in CI (previously capped at the 30 free rules). Generate a key under Settings → API Keys. Also now accepts an optional `anthropic-api-key` input that routes findings through the AI false-positive filter on CI runs for ~$0.01 per scan.
  • +xploitscan-demo repo is live at github.com/bgage72590/xploitscan-demo — a deliberately-vulnerable Express app that scans on every PR. Linked from the Action's README so prospective users can see a real PR comment, real Security-tab alerts, and real inline annotations in one click.
  • +Action v1.3.1 published on the GitHub Marketplace — includes the api-key / anthropic-api-key inputs, an MIT LICENSE file (GitHub's license detector was reporting null), the belt-and-suspenders install fallback chain so a broken CLI publish can't block customer CI, and documented every output (previously `medium-count`, `low-count`, and `sarif-file` were exposed but undocumented).
  • +Settings → Billing now exposes the full upgrade/downgrade matrix. A Pro user can one-click downgrade to Indie, a Team owner can one-click downgrade to Pro or Indie, and every transition confirmation spells out exactly what you gain or lose so team-plan downgrades don't surprise anyone by deactivating members.
  • +Pricing page CTAs are now auth-aware. Signed-out users see 'Choose Indie' / 'Start Free Trial'; signed-in users on Pro see 'Current plan' on the Pro card, 'Upgrade to Team' on Team, and 'Downgrade to Indie' on Indie — with the CTA hitting Stripe checkout directly instead of bouncing through the sign-in redirect. Clicking a plan while signed in no longer lands you on the dashboard by mistake.
  • +Annual sticker prices rounded to conventional SaaS numbers: Indie $59/yr, Pro $119/yr, Team $699/yr (effective $5 / $10 / $59 per month). Savings still clear the 40% marketing claim on every tier (Pro is actually 48% off). No change to monthly prices.

AST-based detection, benchmark grown to 151 fixtures, head-to-head with Bearer goes live

  • +Detection benchmark expanded from 41 to 151 labeled fixtures across 25+ vulnerability classes — secrets, SQL injection, XSS, SSRF, SSTI, prototype pollution, mass assignment, deserialization (Python pickle, js-yaml, Java ObjectInputStream), path traversal, NoSQL injection, XXE, JWT alg confusion, weak hashing, hardcoded crypto keys, CSRF, TOCTOU, IAM wildcards, Docker root, Kubernetes privileged containers, GitHub Actions script injection, CORS wildcards, insecure WebSocket, sensitive data in URL params, plus 30 realistic multi-file mini-app fixtures (auth flows, file upload pipelines, payment webhooks, GraphQL APIs, OAuth callbacks, admin dashboards) that exercise rules in integration-level contexts.
  • +AST-based detection layer alongside the existing pattern matcher. Babel-parsed taint tracker recognizes user-controlled sources from Express (req.body / query / headers), Fastify (request.*), Koa (ctx.request.*), Next.js App Router (await request.json(), formData, text), Web Fetch API, process.argv, and AWS Lambda event.body. Taint propagates through const/let bindings, destructuring (including renames), assignments, template literals, and member access.
  • +Ten rules upgraded to dual-layer regex + AST: SSRF (VC041), prototype pollution (VC023), mass assignment (VC042), XXE option-object inspection (VC081), SSTI (VC082), timing-unsafe secret comparisons (VC043), log injection (VC044), weak password hashing across files (VC060), insecure RNG with security-context detection (VC034), and the schema-aware fix to VC030 that no longer false-positives on yaml.load with FAILSAFE_SCHEMA.
  • +Benchmark precision now 100% (zero false positives across the entire 151-fixture corpus). Recall is 80%+ on the 60+ rules with active fixtures; the remaining tracked-but-not-yet-detected entries are documented openly on the /benchmark page in a dedicated 'in progress' section with an amber badge so transparency replaces the previously confusing dashes.
  • +Bearer goes live on /benchmark — its real numbers are now visible in the head-to-head alongside Semgrep and XploitScan.
  • +Detection methodology page at /docs/detection-methodology — full writeup of the regex + AST architecture, taint tracker scope, fixture labeling convention, TP/FP/FN counting rules, the methodology used for fair comparison against Semgrep and Bearer, and reproducibility instructions for running the benchmark locally.
  • +Benchmark CI gate now compares per-rule enforcedF1 (which excludes documented in-progress fixtures from the regression check) instead of total micro-F1. Means a corpus-growth PR that adds tests for a not-yet-detected vulnerability won't trigger a false regression alert while the rule is being improved.
  • +Benchmark workflows are 5–15× faster — the runners now invoke each scanner once across the whole corpus instead of once per fixture. Cuts CI wall-clock from ~4 minutes to ~30–60 seconds, lets corpus-growth PRs land in the time it takes to write the commit message.

VS Code extension, MCP server, public detection benchmark, Docker image, and SIEM exports

  • +VS Code extension — security scanning in your editor as you work. Scan on save, findings in the Problems panel with severity and fix suggestions, and a compact status-bar indicator with per-file counts. 206 rules, runs locally, nothing uploaded. Coming to the VS Code Marketplace shortly; the VSIX is available now from the repo's CI artifacts.
  • +XploitScan MCP server — install with `npx -y xploitscan-mcp` and wire it into Claude Desktop, Cursor, Windsurf, or any other Model Context Protocol client. Your AI coding agent can now call `scan_code`, `explain_rule`, and `grade_code` as native tools, so it can self-check its output before writing it to disk.
  • +Public detection benchmark at xploitscan.com/benchmark — precision, recall, and F1 scored on a labeled corpus of 41 vulnerability fixtures covering SQL injection across five database libraries, XSS, command injection, unvalidated redirects, missing pagination, reflected CORS, and service-specific secret detection (AWS, Anthropic, GitHub, Slack, Supabase). The runner is open source; the numbers regenerate on every commit.
  • +Head-to-head comparisons with Semgrep and Bearer on the same corpus, visible on /benchmark. See what each scanner catches and misses side by side, with full methodology and reproducibility instructions on the page.
  • +New blog post: 'We Ran Semgrep Against Our Benchmark. It Missed Half the Bugs.' — a walkthrough of where Semgrep's community rules fall short on the patterns AI coding tools produce by default, with specific examples for SQL injection via template literals across Prisma, Drizzle, Knex, pg, and mysql2.
  • +Docker image for on-prem and air-gapped environments — `docker pull ghcr.io/bgage72590/xploitscan:latest` gives you a multi-arch (amd64 + arm64) scanner image, pinned to each CLI release. Runs as non-root, mount your source read-only, nothing touches the network. `docker save` for air-gapped transport.
  • +GitLab CI and Bitbucket Pipelines guides at /guides/gitlab and /guides/bitbucket — drop-in YAML templates that mirror the GitHub Action we shipped earlier, so every major CI platform now has the same one-step integration path.
  • +SIEM export formats — three new CLI output formats. `--format splunk-hec` emits Splunk HTTP Event Collector envelopes. `--format elastic-ecs` emits Elastic Common Schema 8.11 compliant NDJSON that works with Elastic Security and OpenSearch Security Analytics without custom mappings. `--format datadog-logs` emits the Datadog Logs v2 format with `ddtags` pre-populated for dashboards and monitors.
  • +Context-aware entropy scanner — the secret detector got much better at telling real secrets apart from the high-entropy-but-harmless strings every codebase has (build hashes, generated class names, content-addressed asset filenames, publishable client-side keys). Far fewer false-positive secret findings to triage on real projects.
  • +Scanner accuracy improvements from running the benchmark on harder real-world patterns: broader SQL-injection coverage across raw-query builders, better command-injection detection, improved secret detection for service tokens, and correct recognition of safely-parameterized query templates (so they no longer produce false positives).
  • +Pro CLI coverage expanded — 20 service-specific secret detectors (hardcoded Anthropic, GitHub PAT, SendGrid, Slack bot token, GCP service account JSON, Shopify, GitLab, Twilio, Mailgun, Datadog, Vercel, Supabase service role, HashiCorp Vault, and Pinecone keys, plus secrets-in-URL-param / console.log / error-response / bundle-config / HTML-attribute / CLI-argument surfaces) now ship in the Pro bundle. Run `npm install -g xploitscan@latest` to pick them up.
  • +CLI `--version` output now reflects the actual installed version instead of a stale hardcoded string. Verify with `xploitscan --version`.
  • +Grammar polish — the grade summary line now reads 'N critical vulnerabilities require immediate attention' or '1 critical vulnerability requires immediate attention' depending on count, not the singular-noun-plural-verb variant.
  • +Under the hood: the scanner engine is now a single npm package (`xploitscan-shared-rules`) consumed by the CLI, the web app, the GitHub Action, the MCP server, and the VS Code extension. One rule change, every surface updates in the same release — no more drift across products.

API keys, Cursor integration, privacy tools, and compliance exports

  • +API keys for CI — generate personal access tokens in Settings → API Keys and pass them to the GitHub Action via the new api-key input to authenticate CI scans with your Pro or Team plan
  • +XploitScan for Cursor — drop our security ruleset into any project with one command and Cursor will proactively avoid the most common AI-generated vulnerabilities (unprotected webhooks, hardcoded secrets, missing auth checks, SQL injection) as it writes. New landing page and step-by-step install guide
  • +Broader dependency coverage — the CLI now checks every pinned package against a comprehensive live vulnerability database in addition to our curated rule set. Covers npm, PyPI, and RubyGems
  • +Auditor-ready compliance exports — PDF and Markdown reports now include a rule-by-rule pass/fail breakdown inside every SOC 2 and ISO 27001 control so you can drop the export straight into your audit binder
  • +Download your data — new 'Export My Data' option in Settings creates a single JSON file with every record we hold for your account. Available under GDPR Article 20
  • +Delete your account — new self-service account deletion flow in Settings with type-to-confirm. Cancels any active subscription and removes all of your data in one step
  • +Cookie and privacy controls — explicit consent banner on first visit with Accept all / Essential only options, plus a Terms of Service and Privacy Policy acknowledgment on sign-up
  • +Team member profiles — add first name, last name, and title to any team member so the team list reads like a roster instead of an email dump
  • +Richer dashboard trends — new 7-day / 30-day / 90-day toggle above the trend charts and a 'fixes made this period' callout so you can see progress at a glance
  • +Scan history page size — pick how many scans to show on the dashboard (25, 50, 100, or all). Your choice is remembered across visits
  • +Three new landing pages targeting specific audiences: Cursor users shipping to production, anyone who's been burned by a webhook bug, and teams prepping for a SOC 2 audit
  • +Five interactive how-to guides under /guides — web scanner, CLI, GitHub Action, API, and Cursor integration — each with numbered steps, copy-to-clipboard snippets, and progress tracking
  • +New blog post: 'Why Traditional SAST Tools Fail on AI-Generated Code' — our take on why the old-school scanners miss the bugs AI coding tools ship by default
  • +Cleaner top navigation — work-focused nav for logged-in users (Dashboard, Scan, Reports, Compliance, Settings), conversion-focused nav for visitors (Live Demo, Cursor, Pricing, Blog, Docs). Active page highlighting throughout
  • +Various reliability and polish improvements across the dashboard, team management, and billing flows
  • +CLI v1.0.7 on npm with the new cursor install command and expanded dependency scanning

Interactive Guides, Animated Hero, Dashboard Polish, and SARIF Fixes

  • +Interactive guides — new /guides section with step-by-step walkthroughs for the web scanner, CLI, GitHub Action, and API. Persistent progress checkboxes, copy-to-clipboard code blocks, expected output panels, and troubleshooting per guide
  • +Animated hero terminal — homepage now demos a real scan in a typing terminal that loops every ~30 seconds, instead of a static screenshot
  • +No-login demo scan — visitors can run one real scan from /demo without signing in, persisted across reloads
  • +Top Fixes card on dashboard — surfaces the three highest-severity findings from your latest scan with deep links to each fix
  • +Bigger grade indicator with a click-to-open scoring modal explaining how grades are calculated
  • +Trial-end upgrade modal — prompts trial users to add a payment method when their trial has 2 days or fewer remaining
  • +View Demo Project button on the empty-state dashboard so first-time users can see a finished report before scanning
  • +Compare Scans dropdown order fixed — both rows now read chronologically (older → newer) left-to-right
  • +Project name truncation on the dashboard table for very long paths, with a tooltip showing the full path
  • +Low-severity findings now surfaced everywhere — animated hero, demo card, GitHub Action PR comment table (Medium row used to silently double-count Low — fixed)
  • +GitHub Action: SARIF upload no longer rejected — CLI 1.0.4 fixes invalid 'fixes' shape per the SARIF 2.1.0 schema
  • +GitHub Action: new medium-count and low-count outputs, plus PR comment table now shows all four severities
  • +New blog post: 'Why Traditional SAST Tools Fail on AI-Generated Code' answering 'isn't this just Semgrep?'
  • +New blog post: 'The $10,000 Stripe Webhook Bug Hiding in AI-Generated Code'
  • +New About and Support pages with founder bio, Cipherline LLC story, and three help cards
  • +Privacy FAQ promoted to first entry with a direct 'is my code uploaded?' answer
  • +Page metadata added to /scan, /demo, /compliance for better SEO
  • +Sitemap and robots.ts refreshed to include all new pages and disallow authed app surfaces
  • +CLI 1.0.4 published to npm with the SARIF schema fix

Compliance Dashboard, Export Tools, and UX Polish

  • +Compliance page scorecards — at-a-glance pass/fail status for SOC2, ISO 27001, OWASP Top 10, and CWE
  • +Expandable compliance controls — click any control to see all mapped rules and their status
  • +Compliance export — copy as AI prompt, export as Markdown, JSON, or CSV
  • +Framework info tooltips — plain-English explanations of what SOC2, ISO 27001, OWASP, and CWE are and why they matter
  • +Severity tooltips on scan results — hover to learn what Critical, High, Medium, and Low mean
  • +Custom checklist items now work correctly — no longer stuck as N/A
  • +Device session names now persist across browsers
  • +Consistent pointer cursor on all interactive elements
  • +Navigation simplified for logged-out users
  • +GitHub Action now correctly reports scan grades and finding counts
  • +Updated Terms of Service and Privacy Policy with AI and data handling disclosures

Security Hardening, Referral Program, and QA Fixes

  • +Referral program — earn 1 free month for every referral that subscribes
  • +Trial abuse prevention — one free trial per account
  • +Security hardening across CLI, web, and API
  • +Shared checklist links now expire after 30 days
  • +Team members properly recognized as paid across the app
  • +Viewer role fully enforced — Scan/Checklist hidden from nav, pricing hidden from billing
  • +Billing improvements — canceled trials now show correct status
  • +Automatic data cleanup for free-tier scans, shared checklists, and audit logs
  • +PDF export audit trail for SOC2 compliance
  • +Updated FAQ, Terms of Service, and Privacy Policy

XploitScan V1.0 — Production Launch

  • +Team Plan ($99/mo) — 5 seats included, shared scan history, RBAC, team invite management, and portfolio reports
  • +Annual billing with 20% discount — Pro $23/mo, Team $79/mo when billed annually
  • +In-app plan switching — upgrade, downgrade, or change billing interval with prorated billing
  • +Full team management — invite members by email, assign roles (Owner/Admin/Member/Viewer), remove members
  • +Role-based access control (RBAC) with granular permissions for each team role
  • +Team members inherit Pro features through the owner's subscription — no separate payment needed
  • +Email notifications — welcome emails, team invites, trial ending reminders, weekly security digests
  • +Notification preferences — control which emails you receive from Settings
  • +Reduced false positives — improved detection accuracy for test files, documentation, and common libraries
  • +Finding deduplication — one finding per location, specific rules take priority over generic detections
  • +Exposure badges — every finding tagged as Public or Internal based on file path
  • +Impact explanations — real-world risk callouts explaining why each finding matters
  • +Auto-fix code suggestions — before/after diffs showing the secure version
  • +Full SOC2, ISO 27001, OWASP Top 10, and CWE compliance mapping for all 151 rules
  • +Portfolio Overview — aggregate security stats across all projects with PDF, Markdown, and CSV export
  • +Plan comparison table in Settings for transparent feature visibility
  • +Updated Terms of Service and Privacy Policy for launch

Auto-Fix Code, Exposure Badges, Impact Explanations, PR Comments

  • +Auto-fix code suggestions — top rules now show before/after code diffs with the secure version
  • +Exposure badges — every finding tagged as Public or Internal based on file path
  • +Impact explanations — 'Real-world risk' callouts in the 'Why it matters' section
  • +GitHub Action now posts a security report summary comment on pull requests
  • +CLI rule gating — free users get 30 core rules, Pro users get all 131
  • +Single upload button — auto-detects file type (individual files or ZIP)
  • +Added blog: 'Why AI-Generated Code Is Insecure'
  • +Polished docs page with configuration, SBOM, compliance mapping, and API reference sections
  • +Dashboard defaults to most recently scanned project
  • +QA pass with fixes across security, performance, and content accuracy

131 Rules, Rate Limiting, Compliance Mapping

  • +Added 15 new high-impact security rules: path traversal, PII logging, OAuth secrets, deprecated TLS, weak RSA, ECB encryption, Terraform state exposure, and more
  • +Total rule count now 131 across CLI, web, and API
  • +Server-side scan rate limiting — free users: 5 scans/day, Pro users: unlimited
  • +Scan limit banner with real-time usage counter
  • +SOC2/ISO 27001 compliance mapping for all rules
  • +GitHub Action verified end-to-end with SARIF upload to Security tab

Enterprise Features, Billing, CI/CD

  • +Added 10 IaC and container security rules: Dockerfile, Kubernetes, Terraform, Helm, AWS IAM
  • +SOC2 and ISO 27001 compliance mapping for all rules
  • +SBOM generation in CycloneDX 1.4 format
  • +Audit logging for all user actions
  • +Custom YAML rules — define your own security rules
  • +Pro plan with 7-day free trial and billing integration
  • +Webhook notifications for Slack and Discord
  • +GitHub Action for CI/CD scanning with SARIF output
  • +Security launch checklist with persistence and sharing
  • +Terms of Service and Privacy Policy

New Rules, False Positive Fixes, Smarter Detection

  • +Added 10 performance and code quality rules
  • +Reduced false positives across lockfiles, Electron, and HTML detection
  • +Scan public GitHub repos by pasting a URL — no download needed
  • +Scan history shows project names instead of generic labels
  • +Improved PDF export and report visualization

XploitScan Launch, 116 Rules

  • +Launched as XploitScan with xploitscan.com
  • +Expanded to 116 security rules covering secrets, injection, auth, crypto, Docker, Kubernetes, CI/CD
  • +AST-based analysis for JavaScript/TypeScript — fewer false positives
  • +Entropy-based secret detection — catches secrets regardless of format
  • +Confidence scores (high/medium/low) on every finding
  • +Framework-aware rule filtering — fewer irrelevant findings
  • +Authentication with dark theme support

96 Security Rules, PDF Export, Webhooks

  • +Added 96 security detection rules (up from 10)
  • +PDF report export with security grades
  • +Slack and Discord webhook integrations
  • +Public security badge for READMEs
  • +CLI --watch mode for continuous scanning
  • +.xploitscanrc configuration file support
  • +OWASP Top 10 and CWE compliance mapping

Web Dashboard & Drag-and-Drop

  • +Web dashboard with drag-and-drop ZIP scanning
  • +Git diff scanning mode
  • +Scan history with score trends
  • +Framework auto-detection
  • +Security grade (A-F) scoring system

Initial Release

  • +CLI scanner with 10 custom security rules
  • +JSON and SARIF output formats
  • +GitHub Actions integration
  • +Plain-English vulnerability explanations
Changelog — XploitScan