Changelog

Earlier releases

3 changes

A buyer's guide for AI-code scanners, plus clearer comparisons

  • +New guide: "the best security scanner (SAST) for AI-generated code." An honest, side-by-side look at XploitScan, Semgrep, Snyk, and Bearer — anchored to a held-out third-party benchmark (XploitScan 15/15, Bearer 9/15, Semgrep 8/15 at the time; XploitScan was later tuned on some of those cases after seeing them, which the benchmark page now marks — see the July 3 entry) — with a straight answer on which tool fits which job.
  • +Every comparison page now opens with a plain-language verdict and answers the questions people actually ask — does it replace the other tool, which is better for a solo dev, how detection works, and where the other tool legitimately wins.
  • +The Semgrep comparison and the Semgrep benchmark write-up now show their results in a clean table instead of a text block, so the numbers are easier to scan and cite.
3 changes

XploitScan in your editor, plus hardcoded-PII detection

  • +XploitScan is now a VS Code extension. Install it from the Marketplace and every file you save gets scanned for vulnerabilities right in your editor — findings land in the Problems panel, it runs locally, and nothing is uploaded. Same engine as the CLI and web app.
  • +New: detection for hardcoded personal data. The scanner now flags real credit card numbers and US Social Security Numbers left in source. Both are tuned to stay quiet on test cards and lookalike values, so they catch the real thing without the noise.
  • +More to compare and read: new side-by-side comparisons vs Bearer, Checkmarx, and Burp Suite, plus two new guides — a practical pre-deploy security checklist for AI-generated code, and a deep dive on the Django ALLOWED_HOSTS = ['*'] wildcard.
6 changes

100% detection on third-party code, head-to-head held-out comparison, and smoother scanning

  • +The held-out benchmark — real vulnerabilities from public projects like OWASP NodeGoat and Juice Shop that no XploitScan rule author ever saw — now scores 10 out of 10. Two new detections closed the final gaps: SQL injection where the query is built in a variable before reaching the database call, and SSRF through the needle, superagent, and undici HTTP clients. Both ship across the CLI, web scans, API, and GitHub Action.
  • +The benchmark page now runs Semgrep and Bearer against that same held-out corpus with the same scoring, side by side. Current standing: XploitScan 10/10, Semgrep 6/10, Bearer 6/10 — with the per-class breakdown published so you can see exactly what each scanner catches and misses.
  • +New on the blog: "Why we don't trust our benchmark" — an honest look at why a perfect score on a self-authored corpus isn't enough, and how the held-out set keeps us accountable.
  • +Fixed an issue that could prevent scans started from the website from completing. Demo scans and signed-in scans both run reliably again.
  • +The docs now cover connecting your account end to end: CLI login, API keys for CI, exit codes for build gating, and MCP server setup in the Quick Start.
  • +Hand-typed URLs like /sign-up and /login now land on the right pages instead of a 404.
5 changes

Report false positives in one click, plus a smoother first scan

  • +Every finding now has a "Not a real issue?" link. If the scanner flags something that's intentional, test code, or just wrong, tell us in two clicks — pick a reason, add optional context, done. Reports go straight to the team and feed directly into rule tuning, so the detections you see keep getting more precise.
  • +Try a scan on the home page, then sign up, and your results carry straight into your account — re-scanned with the full Pro rule set, waiting on your dashboard. No more re-pasting the code you just scanned.
  • +New to XploitScan and don't have a project handy? The dashboard now offers a one-click scan of a sample project so you can see exactly what a real report looks like before uploading your own code.
  • +Signup form streamlined — the agree-to-terms step no longer greys out the form, so getting started is cleaner and faster.
  • +After a clean scan, we now nudge you to publish a Trust Page so you can show customers and prospects your security posture with a verified public badge.
9 changes

Trust Page polish, CLI reliability, and five rule precision fixes

  • +CLI v1.1.8 published — a reliability fix so scan uploads consistently reach your dashboard and Trust Page. Run `npm install -g xploitscan@latest` to pick up the fix.
  • +Trust Page timestamps now render in the visitor's local timezone instead of UTC. A scan that ran at 7:43 PM Eastern no longer displays as 11:43 PM to the visitor — the timestamp shows in whatever timezone their browser is set to.
  • +Trust Page badge layout updated to read "[Company Name] — Verified by XploitScan" instead of the previous "Secured by [Company Name]". The earlier wording read as the customer attesting to themselves; the new order makes XploitScan's third-party verification explicit. Existing embedded badges update automatically within five minutes of the next view (CDN cache window) — no need to re-paste the HTML.
  • +Several common false-positive patterns no longer flag — everyday safe idioms around config constants, parameterized queries, intentional HTML rendering, and authenticated routes. Rule precision improves accordingly on real codebases, so there are fewer noise findings to triage.
  • +New `// VC###-OK: <reason>` inline silencer convention. Add it on the same line or directly above an intentional finding to suppress that one site without weakening the rule globally. Honored by every rule. The `// scanner-OK` wildcard form silences any rule at that site.
  • +Scan API now picks up rule changes automatically on every deploy — no more occasional drift between the CLI's rule set and what api.xploitscan.com runs. Rule fixes published to npm propagate to all five surfaces (CLI, MCP server, GitHub Action, web app, edge API) on their next deploy.
6 changes

XploitScan GitHub App, plus refreshed CLI, MCP, and Action releases

  • +The XploitScan GitHub App is live — install it on any account or organization and every pull request gets an automatic security scan posted as a Check Run, with findings shown inline in the diff view. Free plan covers the core 30 rules; Pro and Team unlock the full 206-rule set plus the AI false-positive filter on every PR. Install at github.com/apps/xploitscan or from your dashboard.
  • +Dashboard now has a GitHub tab listing your installed accounts, recent PR scans across all of them, and one-click links to manage which repositories the App can see.
  • +GitHub Action v1.3.2 published — the Marketplace listing and the PR-comment footer both now accurately advertise the full 206-rule Pro set. The previous release was still showing the older 158-rule count from before the spring rule additions.
  • +Marketplace description tightened to fit GitHub's 125-character cap so the action is cleaner to skim on its discovery page.
  • +CLI v1.1.2 and MCP server v1.1.2 published on npm — both rebuilt against the current rule corpus so `npx xploitscan@latest` and any AI agent using the MCP server pick up the exact same detection set the web scanner uses.
  • +Page-load reliability improvements across the site for visitors using browsers with strict security policies — a few residual console errors are now gone and the product analytics that drive roadmap decisions are more accurate.
6 changes

GitHub Action Pro unlock, live demo repo, and pricing polish

  • +GitHub Action Pro unlock is live — add `api-key: ${{ secrets.XPLOITSCAN_API_KEY }}` to your workflow to run all 206 rules in CI (previously capped at the 30 free rules). Generate a key under Settings → API Keys. Also now accepts an optional `anthropic-api-key` input that routes findings through the AI false-positive filter on CI runs for ~$0.01 per scan.
  • +xploitscan-demo repo is live at github.com/bgage72590/xploitscan-demo — a deliberately-vulnerable Express app that scans on every PR. Linked from the Action's README so prospective users can see a real PR comment, real Security-tab alerts, and real inline annotations in one click.
  • +Action v1.3.1 published on the GitHub Marketplace — includes the api-key / anthropic-api-key inputs, an MIT LICENSE file (GitHub's license detector was reporting null), the belt-and-suspenders install fallback chain so a broken CLI publish can't block customer CI, and documented every output (previously `medium-count`, `low-count`, and `sarif-file` were exposed but undocumented).
  • +Settings → Billing now exposes the full upgrade/downgrade matrix. A Pro user can one-click downgrade to Indie, a Team owner can one-click downgrade to Pro or Indie, and every transition confirmation spells out exactly what you gain or lose so team-plan downgrades don't surprise anyone by deactivating members.
  • +Pricing page CTAs are now auth-aware. Signed-out users see 'Choose Indie' / 'Start Free Trial'; signed-in users on Pro see 'Current plan' on the Pro card, 'Upgrade to Team' on Team, and 'Downgrade to Indie' on Indie — with the CTA hitting Stripe checkout directly instead of bouncing through the sign-in redirect. Clicking a plan while signed in no longer lands you on the dashboard by mistake.
  • +Annual sticker prices rounded to conventional SaaS numbers: Indie $59/yr, Pro $119/yr, Team $699/yr (effective $5 / $10 / $59 per month). Savings still clear the 40% marketing claim on every tier (Pro is actually 48% off). No change to monthly prices.
8 changes

AST-based detection, benchmark grown to 151 fixtures, head-to-head with Bearer goes live

  • +Detection benchmark expanded from 41 to 151 labeled fixtures across 25+ vulnerability classes — secrets, SQL injection, XSS, SSRF, SSTI, prototype pollution, mass assignment, deserialization (Python pickle, js-yaml, Java ObjectInputStream), path traversal, NoSQL injection, XXE, JWT alg confusion, weak hashing, hardcoded crypto keys, CSRF, TOCTOU, IAM wildcards, Docker root, Kubernetes privileged containers, GitHub Actions script injection, CORS wildcards, insecure WebSocket, sensitive data in URL params, plus 30 realistic multi-file mini-app fixtures (auth flows, file upload pipelines, payment webhooks, GraphQL APIs, OAuth callbacks, admin dashboards) that exercise rules in integration-level contexts.
  • +AST-based detection layer alongside the existing pattern matcher. Babel-parsed taint tracker recognizes user-controlled sources from Express (req.body / query / headers), Fastify (request.*), Koa (ctx.request.*), Next.js App Router (await request.json(), formData, text), Web Fetch API, process.argv, and AWS Lambda event.body. Taint propagates through const/let bindings, destructuring (including renames), assignments, template literals, and member access.
  • +Ten rules upgraded to dual-layer regex + AST: SSRF (VC041), prototype pollution (VC023), mass assignment (VC042), XXE option-object inspection (VC081), SSTI (VC082), timing-unsafe secret comparisons (VC043), log injection (VC044), weak password hashing across files (VC060), insecure RNG with security-context detection (VC034), and the schema-aware fix to VC030 that no longer false-positives on yaml.load with FAILSAFE_SCHEMA.
  • +Benchmark precision now 100% (zero false positives across the entire 151-fixture corpus). Recall is 80%+ on the 60+ rules with active fixtures; the remaining tracked-but-not-yet-detected entries are documented openly on the /benchmark page in a dedicated 'in progress' section with an amber badge so transparency replaces the previously confusing dashes.
  • +Bearer goes live on /benchmark — its real numbers are now visible in the head-to-head alongside Semgrep and XploitScan.
  • +Detection methodology page at /docs/detection-methodology — full writeup of the regex + AST architecture, taint tracker scope, fixture labeling convention, TP/FP/FN counting rules, the methodology used for fair comparison against Semgrep and Bearer, and reproducibility instructions for running the benchmark locally.
14 changes

VS Code extension, MCP server, public detection benchmark, Docker image, and SIEM exports

  • +VS Code extension — security scanning in your editor as you work. Scan on save, findings in the Problems panel with severity and fix suggestions, and a compact status-bar indicator with per-file counts. 206 rules, runs locally, nothing uploaded. Coming to the VS Code Marketplace shortly; the VSIX is available now from the repo's CI artifacts.
  • +XploitScan MCP server — install with `npx -y xploitscan-mcp` and wire it into Claude Desktop, Cursor, Windsurf, or any other Model Context Protocol client. Your AI coding agent can now call `scan_code`, `explain_rule`, and `grade_code` as native tools, so it can self-check its output before writing it to disk.
  • +Public detection benchmark at xploitscan.com/benchmark — precision, recall, and F1 scored on a labeled corpus of 41 vulnerability fixtures covering SQL injection across five database libraries, XSS, command injection, unvalidated redirects, missing pagination, reflected CORS, and service-specific secret detection (AWS, Anthropic, GitHub, Slack, Supabase). The runner is open source; the numbers regenerate on every commit.
  • +Head-to-head comparisons with Semgrep and Bearer on the same corpus, visible on /benchmark. See what each scanner catches and misses side by side, with full methodology and reproducibility instructions on the page.
  • +New blog post: 'We Ran Semgrep Against Our Benchmark. It Missed Half the Bugs.' — a walkthrough of where Semgrep's community rules fall short on the patterns AI coding tools produce by default, with specific examples for SQL injection via template literals across Prisma, Drizzle, Knex, pg, and mysql2.
  • +Docker image for on-prem environments: a multi-arch (amd64 + arm64) scanner image, rebuilt with each CLI release. It runs as non-root, and you mount your source read-only. Without an XploitScan API key or an ANTHROPIC_API_KEY, the only thing sent out is the list of dependency names and versions, which goes to OSV.dev for vulnerability checks. With an XploitScan API key, the scanner also checks your plan, downloads the Pro rules on a paid plan, and uploads the scan results, including the matched code snippets, to your xploitscan.com dashboard. With ANTHROPIC_API_KEY set, file contents are also sent to Anthropic for AI analysis. Use `docker save` to move the image into air-gapped environments.
16 changes

API keys, Cursor integration, privacy tools, and compliance exports

  • +API keys for CI — generate personal access tokens in Settings → API Keys and pass them to the GitHub Action via the new api-key input to authenticate CI scans with your Pro or Team plan
  • +XploitScan for Cursor — drop our security ruleset into any project with one command and Cursor will proactively avoid the most common AI-generated vulnerabilities (unprotected webhooks, hardcoded secrets, missing auth checks, SQL injection) as it writes. New landing page and step-by-step install guide
  • +Broader dependency coverage — the CLI now checks every pinned package against a comprehensive live vulnerability database in addition to our curated rule set. Covers npm, PyPI, and RubyGems
  • +Compliance exports: PDF and Markdown reports now include a rule-by-rule pass/fail breakdown for each mapped SOC 2 and ISO 27001 control. It is an informational mapping, not audit evidence that a control is satisfied.
  • +Download your data — new 'Export My Data' option in Settings creates a single JSON file with every record we hold for your account. Available under GDPR Article 20
  • +Delete your account — new self-service account deletion flow in Settings with type-to-confirm. Cancels any active subscription and removes all of your data in one step