Changelog

Earlier releases

19 changes

Interactive Guides, Animated Hero, Dashboard Polish, and SARIF Fixes

  • +Interactive guides — new /guides section with step-by-step walkthroughs for the web scanner, CLI, GitHub Action, and API. Persistent progress checkboxes, copy-to-clipboard code blocks, expected output panels, and troubleshooting per guide
  • +Animated hero terminal — homepage now demos a real scan in a typing terminal that loops every ~30 seconds, instead of a static screenshot
  • +No-login demo scan — visitors can run one real scan from /demo without signing in, persisted across reloads
  • +Top Fixes card on dashboard — surfaces the three highest-severity findings from your latest scan with deep links to each fix
  • +Bigger grade indicator with a click-to-open scoring modal explaining how grades are calculated
  • +Trial-end upgrade modal — prompts trial users to add a payment method when their trial has 2 days or fewer remaining
11 changes

Compliance Dashboard, Export Tools, and UX Polish

  • +Compliance page scorecards — at-a-glance pass/fail status for SOC2, ISO 27001, OWASP Top 10, and CWE
  • +Expandable compliance controls — click any control to see all mapped rules and their status
  • +Compliance export — copy as AI prompt, export as Markdown, JSON, or CSV
  • +Framework info tooltips — plain-English explanations of what SOC2, ISO 27001, OWASP, and CWE are and why they matter
  • +Severity tooltips on scan results — hover to learn what Critical, High, Medium, and Low mean
  • +Custom checklist items now work correctly — no longer stuck as N/A
9 changes

Security Hardening, Referral Program, and QA Fixes

  • +Referral program — earn 1 free month for every referral that subscribes
  • +Trial abuse prevention — one free trial per account
  • +Security hardening across CLI, web, and API
  • +Shared checklist links now expire after 30 days
  • +Team members properly recognized as paid across the app
  • +Viewer role fully enforced — Scan/Checklist hidden from nav, pricing hidden from billing
17 changes

XploitScan V1.0 — Production Launch

  • +Team Plan ($99/mo) — 5 seats included, shared scan history, RBAC, team invite management, and portfolio reports
  • +Annual billing with 20% discount — Pro $23/mo, Team $79/mo when billed annually
  • +In-app plan switching — upgrade, downgrade, or change billing interval with prorated billing
  • +Full team management — invite members by email, assign roles (Owner/Admin/Member/Viewer), remove members
  • +Role-based access control (RBAC) with granular permissions for each team role
  • +Team members inherit Pro features through the owner's subscription — no separate payment needed
10 changes

Auto-Fix Code, Exposure Badges, Impact Explanations, PR Comments

  • +Auto-fix code suggestions — top rules now show before/after code diffs with the secure version
  • +Exposure badges — every finding tagged as Public or Internal based on file path
  • +Impact explanations — 'Real-world risk' callouts in the 'Why it matters' section
  • +GitHub Action now posts a security report summary comment on pull requests
  • +CLI rule gating — free users get 30 core rules, Pro users get all 131
  • +Single upload button — auto-detects file type (individual files or ZIP)
6 changes

131 Rules, Rate Limiting, Compliance Mapping

  • +Added 15 new high-impact security rules: path traversal, PII logging, OAuth secrets, deprecated TLS, weak RSA, ECB encryption, Terraform state exposure, and more
  • +Total rule count now 131 across CLI, web, and API
  • +Server-side scan rate limiting — free users: 5 scans/day, Pro users: unlimited
  • +Scan limit banner with real-time usage counter
  • +SOC2/ISO 27001 compliance mapping for all rules
  • +GitHub Action verified end-to-end with SARIF upload to Security tab
5 changes

New Rules, False Positive Fixes, Smarter Detection

  • +Added 10 performance and code quality rules
  • +Reduced false positives across lockfiles, Electron, and HTML detection
  • +Scan public GitHub repos by pasting a URL — no download needed
  • +Scan history shows project names instead of generic labels
  • +Improved PDF export and report visualization
10 changes

Enterprise Features, Billing, CI/CD

  • +Added 10 IaC and container security rules: Dockerfile, Kubernetes, Terraform, Helm, AWS IAM
  • +SOC2 and ISO 27001 compliance mapping for all rules
  • +SBOM generation in CycloneDX 1.4 format
  • +Audit logging for key account events, including sign-ups, scans, billing changes and team membership
  • +Custom YAML rules editor in Settings (never applied to scans; removed September 16, 2026)
  • +Pro plan with 7-day free trial and billing integration
7 changes

XploitScan Launch, 116 Rules

  • +Launched as XploitScan with xploitscan.com
  • +Expanded to 116 security rules covering secrets, injection, auth, crypto, Docker, Kubernetes, CI/CD
  • +AST-based analysis for JavaScript/TypeScript — fewer false positives
  • +Entropy-based secret detection — flags high-entropy strings that look like secrets, even in formats no specific rule covers
  • +Confidence scores (high/medium/low) on every finding
  • +Framework-aware rule filtering — fewer irrelevant findings
7 changes

96 Security Rules, PDF Export, Webhooks

  • +Added 96 security detection rules (up from 10)
  • +PDF report export with security grades
  • +Slack and Discord webhook integrations
  • +Public security badge for READMEs
  • +CLI --watch mode for continuous scanning
  • +.xploitscanrc configuration file support