+Routes that check the caller before they change data are no longer missing-authentication findings. A guard mounted ahead of the route, a public sign-in or password-reset URL, and a webhook that checks the raw body with its signing secret all count. Hashing a reset token is no longer a password-hash finding, a path from the signed-in user's id is no longer path traversal, and a publishable test key or the placeholder password "password" is no longer a live secret.
1 change
+createClient service-role check: commented-out calls no longer count toward the 200-call per-file limit; calls beyond 200 real calls in one file are still not checked.
1 change
+Suppressions now match on the CLI, GitHub App, API, and web scans. Reports show the suppressed count. A marker needs a rule ID, counts only in a real comment, allows one blank line, and covers the first line. Strings no longer hide findings. Ignore files over 64 KB or 2,000 lines are skipped. The CLI reads nested files. Other uploads read only the root file. Paths using `..`, a drive letter, or a single-segment absolute path are rejected. ZIP patterns are globs.
8 changes
+CLI 1.18.15 bundles the VC001 fix from #1011.
+CLI 1.18.16 is a fix for stdout purity and the AI output budget.
+MCP server 1.9.3 and VS Code extension 1.6.3 bundles the VC001 fix from #1011.
+Production builds now check that billing and scan configuration is present before the site is published. Scheduled maintenance jobs record whether they finished, and a malformed address returns a clear error instead of a server failure.
+Findings in test files are shown at lower severity and labeled as not graded.
+Non-live findings in a test or fixture path are reported at low severity and labeled as not graded. GitHub code-scanning alerts for those lowered findings change level, because a low finding is sent as a note.
+VC001 now catches a key that follows another quoted value on the same line, including a service-role key passed into a client call. A publishable live key is reported as low. A test-mode secret key outside a test file is reported as medium. A live secret key stays critical, including in a test file.
+A finished scan now says whether AI review completed, was partial, or was skipped, including when a saved scan has no stored status. Uploads past the browser file cap say how many files were scanned and point to the CLI for the rest.
1 change
+Three rules now use the shared test-file detection. Some application files that were skipped before (for example names containing 'test' or 'mock', and routes/test/) are now scanned, so real issues there can lower grades and fail --fail-on or Action gates. Fixture and mock folders are now consistently skipped.
12 changes
+The GitHub Action now runs CLI 1.18.13.
+GitHub Action v1.11.2 runs CLI 1.18.14, and the v1 tag points to that release. v1.11.1 runs CLI 1.18.13.
+README grade badges are now one neutral grey image for every grade, labeled "XploitScan: no verified grade". They still load, and they no longer show a letter or a color for the grade.
+CLI 1.18.10 through 1.18.13 are published.
+CLI 1.18.14 (shared rules 2.4.19) finishes secret checks on long XML lines and HTML meta lines, with the same findings as before. It includes the PHP image checks CFG013 and CFG014.
+The Indie plan is no longer offered to new subscribers. See our Terms and Privacy Policy.
+MCP server 1.9.2 and VS Code extension 1.6.2 use the same rules as CLI 1.18.14 (shared rules 2.4.19), including the PHP image checks and the long-line secret checks. The extension still lists findings in the Problems panel and the status bar without a grade. Update it from the Extensions view.
+Dockerfiles pinning an official php image to a version affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) are now flagged: CFG013 (critical) for -apache and -fpm images in any build stage, CFG014 (info) for other variants in the final stage. Affected: 8.2.0-8.2.34, 8.3.0-8.3.35, 8.4.0-8.4.26, 8.5.0-8.5.11, and 8.1 and older (end of life). For 8.2 and later, only exact patch tags such as php:8.3.35-apache are checked; floating tags such as php:8.3-apache aren't flagged. Rebuild on 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. In CLI 1.18.14, MCP 1.9.2 and VS Code 1.6.2.
+A Trust Page badge now reflects a plan change within five minutes. Enabled Trust Pages on plans that include a Trust Page are listed in the sitemap, which refreshes hourly.
+The pricing comparison no longer lists a public security badge. A Pro or Team Trust Page can show the grade and date of your most recent scan, and it is not an audit or certification. The free Trust Page says you can upgrade to Pro for your logo and your most recent scan results.
+When a public Trust Page shows a scan, the header date, the Latest Security Scan section, and the disclaimer stay together. Otherwise the header shows when page settings were updated, the scan section is omitted, and the disclaimer says "No automated scan results are shown on this page." The share title is "Trust Page | XploitScan", with the company name first when set. The description is "Self-attested security information, hosted on XploitScan. Not a security audit or certification.", and names the company after "from" when set.
+Settings shows the Trust Page tab on Free and Indie. When the plan cannot publish one, it says "Trust Pages are part of Pro. Upgrade to Pro to publish a Trust Page with your logo and your most recent scan results." Paid embed badges show the company name without a grade or scan results. The embed link includes utm_source=trust_page. A privacy policy URL must be https and at most 500 characters, and a security contact email at most 254; otherwise the save says "Invalid Trust Page settings."
1 change
+Annual prices: Pro $190/year and Team $990/year ("2 months free"). Monthly stays Pro $19 and Team $99. From Nov 2–30, the founding rate is $119/yr for annual Pro or $699/yr for annual Team, kept as long as you keep renewing the same plan and billing interval. Ends if you cancel or switch plan or billing interval. Limited to 20 Pro and 5 Team subscriptions. The first annual payment secures a seat; a free trial doesn't hold one. Switching an existing monthly subscription to annual doesn't qualify. See Pricing.
1 change
+CLI 1.18.10 (shared rules 2.4.14) masks secrets in the AI review reason with the same short prefix and suffix as the excerpt, then keeps at most 500 characters. CLI 1.18.11 (shared rules 2.4.15) finishes the secret-name check on a very long line. CLI 1.18.12 (shared rules 2.4.16) finishes the "use client" and "use server" quality checks on a large file. CLI 1.18.13 (shared rules 2.4.17) finishes secret detection on a very long line, and the findings match the previous release.
2 changes
+GitHub Action v1.10.0 runs CLI 1.18.9, up from 1.18.5 in v1.9.0, so your CI grade and pass/fail can change. It adds the route shared-secret fixes and folder-name-only uploads. With anthropic-api-key set, secrets the scanner detects in AI false-positive review excerpts are cut to a short prefix and suffix. Other excerpt code, including undetected secrets, is sent as written, and AI analysis still sends whole source files to Anthropic under your key. v1.9.0 and earlier send excerpts unmasked. upload-sarif moves to v3.39.0.
+GitHub Action v1.11.0 (the v1 tag now points to it) adds an upload-sarif input, default true. Set it to 'false' to skip the code-scanning upload, for example on a private repository without GitHub Code Security; you can then drop security-events: write. The SARIF file is still written, and a scan with findings but an empty SARIF still fails the job. Same CLI (1.18.9).
2 changes
+The GitHub Action's source pinned CLI 1.18.8 on October 16; the first release with these fixes is v1.10.0 (CLI 1.18.9, October 19).
+CLI 1.18.9 (shared rules 2.4.13) masks secrets in the short code excerpts sent for AI false-positive review. The flagged line, the lines around it, and the finding's description and suggested fix are sent with each secret reduced to a short prefix and suffix. The review still runs on the website, in GitHub pull-request checks, and in the CLI.