+CLI 1.18.8 uploads only the scanned folder's name with your results, not the full local path. The website now stores only folder names too, and older saved scans were updated.
+CLI 1.18.7: a Next.js route that only calls a helper starting with a shared-secret check is no longer reported as an unauthenticated API in the CLI, matching the website. Routes without such a check are still reported.
13 changes
+GitHub Action v1.9.0 (the v1 tag now points to it) runs CLI 1.18.5, up from 1.18.3, so your CI grade and pass/fail can change on upgrade. Postgres URLs with real passwords are now reported; placeholder and port-shaped database passwords, server actions that don't write, and SBOM files no longer raise false alarms, and a local postgres:postgres default is low severity. No input changes. The route shared-secret fix is not included yet.
+Free AI reviews now reset with free scans, at 00:00 UTC (8 PM ET in summer, 7 PM in winter).
+Updated Nov 3, 2026: This entry originally reported 98.5% F1. That overstated it, because the method left out unexpected findings on clean fixtures. Counting the findings a hand review judged to be false positives, F1 is 88.5% (reviewed Nov 3, 2026). See /benchmark for the method.
Accuracy figures across the site now round the same way as the benchmark page: 97.0% recall on 615 fixtures.
+Going back from Stripe checkout no longer leaves the pricing button stuck loading, and the pricing page now says no charge was made. The scan limit label now says "Scan limit resets…", and the dashboard labels a single project's count "Scans (this project)" so it isn't confused with Total Scans.
+CLI 1.18.5 (shared rules 2.4.11): fewer false alarms on database URLs, server actions that do not write, cookies, library entry files, high-entropy strings, SBOM files, and URL checks.
+CLI 1.18.4 (shared rules 2.4.10): a database URL that starts with postgresql:// or postgresql+asyncpg:// and contains a real-looking password is now reported as a hardcoded secret. Placeholder passwords such as user:pass, password or ${DB_PASSWORD} are not. Variables that only hold a setting name, like a theme or storage key (myTHEME_STORAGE_KEY = "dark-mode"), are still not reported, and that check now stays fast on very long lines.
+The website scanner and the paid rule download have reported postgresql:// passwords and skipped setting-name keys since October 13; CLI 1.18.4 brings both to the free CLI rules. The GitHub Action runs them from v1.9.0 (CLI 1.18.5).
+CLI 1.18.6 (shared rules 2.4.12) brings these fixes to the free CLI rules; the website and paid rule download have had them since October 14. An App Router route that checks a shared secret and rejects is no longer an unauthenticated-API finding (routes that only call such a function: CLI 1.18.7), including Vercel Commerce's revalidate route. A get() server action that does not write is no longer a public GET route. Long lines scan faster; a match or suppression needing over 300–500 characters can change, as can the grade.
+Database URLs whose password is a format placeholder (such as {password} or %s), or where a port number sits where the password would be, are no longer reported as leaked credentials. A stock local default like postgres:postgres@localhost is now reported at low severity instead of critical. A real password is still reported even when the user or host is a placeholder. On the website, in the paid rule download, and in CLI 1.18.5.
+Fewer false alarms, on the website, in the paid rule download, and in CLI 1.18.5. Entropy checks skip file paths, alphabet strings and :word: labels. Next.js server actions that never write data aren't reported as unprotected. Cookie checks match whole words, and constant UI-flag cookies are informational.
+Fewer false alarms on Next.js App Router routes: a handler that hands off to a function starting with a strict shared-secret check (comparing a value to a secret from process.env, then returning 401 or 403 or throwing) is no longer reported as unauthenticated. A lower-case get exported from a "use server" file is treated as a server action, not a GET route. On the website, in the paid rule download, and in CLI 1.18.7.
+Library index files that don't start a server no longer trigger server rules. bom.xml is now treated as a software bill of materials like sbom.json: only secret checks run on these files, so a live key in an SBOM is reported, and nothing else is. Schema URLs are judged one URL at a time. On the website, in the paid rule download, and in CLI 1.18.5.
+VS Code extension 1.6.1 picks up the current rules, including test-file and placeholder holdouts and the false-alarm fixes through October 14. It still lists findings in the Problems panel and the status bar without a grade; use the CLI or the website scanner for a grade. Update it from the Extensions view.
6 changes
+GitHub Action v1.8.0 (the v1 tag now points to it) runs CLI 1.18.3. Test and fixture findings and placeholder database URLs no longer count toward the grade or the fail-on thresholds, so your CI grade and pass/fail can change on upgrade. A live key in a test file still counts. The job now fails if the grader crashes, whatever fail-on is set to, and it refuses to upload an empty SARIF when the scan found issues, so your open code-scanning alerts aren't closed by mistake. No input changes.
+Updated Nov 3, 2026: This entry originally reported 98.5% F1 and no forbidden-rule hits, which could be read as zero false positives. That overstated it, because the method left out unexpected findings on clean fixtures. Counting the findings a hand review judged to be false positives, precision is 81.4% and F1 is 88.5% (reviewed Nov 3, 2026). See /benchmark for the method.
The benchmark grew to 615 labeled fixtures (329 vulnerable, 286 clean): 97.0% recall with all rules, and 21.3% recall with the free plan's 30 rules.
+After checkout, the billing success page only says your plan is active once the payment has been verified.
+Signed-out demo results now say the scan ran the 30 free rules out of 223, offer AI review of the findings free with an account, and link to what Pro adds.
+On paid plans, secret rules now also check test files. A live key in a test file still counts toward the grade; other secrets found in tests are listed but held out of it. Files ending in .example or .template are skipped. Free-rule secret fixes from the same change shipped in CLI 1.18.4.
+When AI review dismisses every finding, your public Trust Page and your Slack and Discord alerts now show an amber "AI filter" note next to the grade instead of an unqualified clean result. The grade itself is unchanged.
7 changes
+When AI review dismisses every finding, the scan page shows an amber warning instead of the "clean scan" banner, and the result shows no percentile. The letter grade is unchanged.
+AI review of findings now tells you what it did. If the review times out, hits its size cap or can't read a file, the affected findings stay in the report and are counted as not reviewed, instead of being dropped. Saved scans record which scanner and model produced the result. Saved scans and Trust Pages both say how many of the files you supplied were actually scanned.
+Browser scans fail more helpfully. A folder too large for the browser scanner now explains what works instead: the CLI (npx xploitscan@latest scan .), a public GitHub URL, or a smaller folder. Folders in iCloud Drive or other cloud-only storage no longer hang on "Reading files…"; reads time out with a clear message and show progress. GitHub URLs with a trailing slash are accepted.
+CLI 1.18.2 and 1.18.3 (shared rules 2.4.2–2.4.9): scans report files they skipped, so a partial scan can no longer look Excellent. When AI review dismisses every finding, the result says so instead of showing a plain clean grade. Fewer false alarms and duplicate findings on the benchmark corpus. Very long lines no longer slow the Stripe-webhook checks. Entropy no longer flags Swift \(…) interpolation. The optional AI false-positive filter caps its prompt size and resists prompt injection in scanned code.
+Authentication error-message text is not treated as a leaked secret, session fixation needs a real server-session API, JWT algorithm confusion is reported only when "none" is explicitly allowed, and the root GET route is treated as public. The same issue reported by two rules on one line now appears once, and the CLI, website, MCP server and GitHub App remove duplicates the same way.
+MCP server 1.9.1 uses the same rules as CLI 1.18.3 (shared rules 2.4.9), including holding test files out of the grade.
+A scan that skipped files can no longer look perfect. Uploads now report files skipped as unsupported, over 500 KB or minified, the scan page shows "Scanned X of Y", and when anything was skipped the result never says "Excellent" and shows no percentile. The letter grade still covers the files that were scanned.
7 changes
+The GitHub Action installs CLI 1.17.0 exactly and fails the job if that scan crashes or does not write a scan result. A normal scan still passes or fails only from the fail-on setting. Pin the action with a full commit SHA (`bgage72590/xploitscan-action@<full-sha>`) instead of a tag that can move.
+CLI 1.18.0 (shared rules 2.4.0): findings in test and fixture files stay in the report and do not change the grade, except a live-format provider key. Dependency advisories count as one ADVISORY family. A placeholder or templated database URL no longer flags, and a real password in a database URL still does. JSON output includes the grade and the score, and the ungraded field covers test-file holdouts.
+CLI 1.18.1 (shared rules 2.4.1): checks that look for an unprotected Stripe webhook finish quickly on a very long line, and they still report the same handlers. A storage slot named like myTHEME_STORAGE_KEY and set to a short kebab-case value is not reported as a hardcoded secret.
+C# files named like FooTests.cs stay in the report and no longer lower the grade. A file named SpeedTest.cs, LoadTest.cs, ABTest.cs, or Models/Test.cs is still application code. A database URL is flagged only when the user and password sit on that same line. AWS access key IDs have to be the 20-character key shape, so a longer token in third-party code is not treated as a live key.
+Test and fixture files stay in the report and no longer lower the grade. A live provider key in a test still counts, including sk_live_ and a GitHub, Slack, or OpenAI key. A test-mode key or placeholder token does not. A real password on localhost still counts. A placeholder password does not. Documentation, schema, and timestamp URLs are not insecure HTTP. Dependency advisories count as one group. Website upload reads the same files as the command-line scanner, and scan JSON includes the grade and score.
+CLI 1.17.0 (shared rules 2.3.0): a scan's score now counts at most 3 findings from each rule, and every entropy hit counts as that one rule. A fourth or later finding from the same rule stays in the report and does not lower the score or the letter. Entropy also skips SBOMs and test files, so license inventories and tests no longer show up as secrets.
+MCP server 1.9.0 now grades the same way as CLI 1.17.0: a score counts at most 3 findings from each rule, and every entropy hit counts as that one rule. Entropy skips SBOMs and test files, and findings in third-party folders stay in the report without changing the score. VS Code extension 1.6.0 uses the same skips; it lists findings but doesn't show a grade.
16 changes
+The GitHub Action fail-on input now means this severity or higher: medium no longer fails a workflow on a lone low finding, and low ignores info-only findings (for example console.log). Invalid fail-on values or non-numeric counts now exit 2 instead of passing silently; an empty value still means none. This changes pass/fail for existing @v1 workflows that set fail-on to medium or low. After merge, pin @v1.5.0 or the moved @v1 tag.
+AI review of scan findings now runs when you are signed in — including on the homepage and demo scanners — and respects plan limits and the Settings opt-out. Signed-out scans still return the same rule findings and grade, with a one-line prompt to sign in for the AI second pass. A signed-in free user at the daily scan cap can still run a homepage demo scan; that one is deterministic, without AI. The Privacy Policy now says anonymous scans are not sent to Anthropic.
+Annual billing now says Save over 40%, and Team annual is $699/year on the pricing page — more than 40% cheaper than twelve monthly payments. Per-month annual rates are the yearly total divided by 12 ($58.25 Team, $9.92 Pro), not rounded to whole dollars. Annual buttons name the yearly charge; the strikethrough is twelve months of the monthly price.
+Paid plans now say, at Stripe Checkout and in the Terms, the price, that they renew until you cancel, and that you cancel in Settings > Billing > Manage Subscription. Team is a self-serve subscription at the price shown on our pricing page, auto-renewing like Pro. Pro and Team new subscribers get a 7-day trial (one per customer); Indie has no trial.
+Transactional and onboarding email now sends through Brevo. Product emails, surveys, and offers include a one-click unsubscribe. Survey answers go to Tally without your name or email.
+CLI 1.16.0: `xploitscan upgrade` now opens the pricing page in your browser. If the paid-plan check is briefly unavailable, the CLI keeps your last known plan for up to 7 days (the same offline grace as VS Code and MCP) instead of falling back to the free rules.
+FAQ answers about switching plans now match billing: if you already pay, the change is prorated and takes effect immediately; if you are on a trial, the trial end date stays the same and you are not charged until it ends.
+Free accounts now get 5 hosted AI reviews per day — the same number as the free daily scan limit. Further scans that day still run and return the same rule findings; AI review shows as limit reached for today until the limit resets at midnight ET. Paid plans are unchanged.
+Choosing Indie or Pro on pricing now keeps that plan through sign-up and into checkout. If you back out of Stripe, the pricing page says no charge was made.
+A scan that doesn't go through now says so in plain language — with Try again, Scan sample, and Paste GitHub URL — instead of an "Unexpected token" dump. We skip node_modules, dist and lockfiles in the browser, and refuse a payload at Vercel's 4.5 MB cap before the request, so a large paste is not mistaken for a downed server.
+Signing up now shows the form right away, with one consent checkbox. We record the policy version you agreed to on our servers.
+Public pages now share one wording for how the benchmark is refreshed — checked daily and rerun when rules or fixtures change, at least weekly, live on the next deploy — and the homepage demo grade is derived from the same scoring as /demo. Remaining comparison figures come from the published claims so they cannot drift.
+Updated Nov 3, 2026: the precision below is a hand-reviewed figure, 81.4% (reviewed Nov 3, 2026). See /benchmark for the method.
Every public accuracy number on the site — the homepage, FAQ, comparison pages, and the benchmark heading — now comes from the same published results at /benchmark, so a figure cannot sit at one percentage on one page and another on the next. The current scores are 86.3% precision and 97.2% recall on 649 labeled fixtures, and 7/8 blind / 15/16 after fixes on the third-party held-out set.
+Complimentary Pro from the feedback survey is a month of the full product with no card and nothing that renews. When the month ends you return to Free automatically; your scans stay. Complimentary accounts have a 50-scan daily fair-use limit.
+Settings → Team now describes the roster you can see, and only talks about inviting when you can actually send an invite.
+Terms §6 now says audit logs are deleted with your account, and the record of your agreement is kept for 3 years after deletion and then purged.
5 changes
+A leftover team membership on a canceled Team plan no longer unlocks Settings → API Keys. Those accounts see the same upgrade note as any other free plan.
The Referral tab is now Pro and Team only (owner or admin on a team), matching the server — Indie still gets API keys, but not the referral program.
+Free accounts that open Settings → API Keys now see a short upgrade note and a link to pricing, instead of the key generator.
+A free scan now says it ran the free rule set — not the whole catalog — and shows what the rest covers, with a working upgrade button.
+The scan page no longer paints a full pricing box next to your daily count. Under the cap you see how many scans you have left; near it, a small upgrade button; at it, a Pro upgrade card in place of the dropzone. The free dashboard also notes that the free plan runs the free rule set.
+A scan on the website, the CLI, or MCP now runs the same engines and skips the same generated and demo files. Config and cross-file checks that only the CLI ran are included everywhere. Unusual files go through those checks in linear time. Paying CLI users get a download test that loads the full Pro catalogue.
2 changes
+Files that are large or unusually shaped — very long lines, generated code, strings that never close — now go through the SQL injection, open redirect, SSRF and regex denial-of-service checks in milliseconds, where some could take seconds. What those checks find is unchanged.
+Three of the new rules now catch more: JWTs decoded by hand (`JSON.parse(atob(token.split(".")[1]))`) are treated like any other unverified token, Django projects that allow every origin with credentials are flagged like FastAPI and Flask ones, and AI endpoints running as Cloudflare Workers are checked for a missing caller check.
1 change
+Nine new rules for the places AI-built apps leak most often: Supabase migrations that switch off row-level security or open writes to everyone, Firebase rules left open, AI and secret keys shipped to the browser, Base44 functions using the service role without checking the caller, roles read from user-editable metadata, unauthenticated AI endpoints, sessions trusted without verification, Python CORS wildcards with credentials, and prefix-only path checks. TanStack Start server functions are now checked for missing auth on the free plan.
6 changes
+Scanning a public GitHub repository by URL from the Scan page works again. The browser was
blocking the requests to GitHub, so every GitHub URL scan stopped with "Failed to fetch".
+Install commands now end in `@latest` (`npx xploitscan@latest scan .`, `npx -y xploitscan-mcp@latest`). Without it, npx can keep running whichever version it cached the first time, so fixes never reach you. If your MCP config or scripts use plain `xploitscan-mcp` or `xploitscan`, add `@latest` to get current rules and fixes.
+A Pro or Team free trial includes everything on the plan you are trying, including all 214
rules in the CLI, GitHub Action, VS Code extension and MCP server. Free trials are limited to
one per person.
+SQL injection detection now works in Express files that use route parameters. A route like
`/users/:id` used to switch the SQL injection check off for the whole file, so a query
built from `req.params` went unflagged. Update to CLI 1.12.4 or later; the web scanner and
GitHub checks pick it up automatically.
The homepage scanner now judges pasted code on its content. It used to label every paste as a
demo file, which could lead the AI false-positive filter to dismiss real findings as example code.
+Fewer false alarms on static sites and browser games. Namespaced storage keys like `myapp.settings` are no longer reported as secrets. Rate-limit findings need a real server, and N+1 findings need a database call inside the loop. SRI isn't suggested for vendor scripts that update in place, like Stripe.js. The CSP fix is built from your page's own scripts, and the nosniff and clickjacking fixes name the HTTP header. `// VC###-OK` markers now work on the website, as they already did in the CLI.
+The VS Code extension and the MCP server now work like the CLI: 30 free rules with no
account, all 214 on a paid plan. Generate an API key under Settings → API Keys on an Indie,
Pro or Team plan, then run "XploitScan: Enter API Key" in VS Code, or add
`XPLOITSCAN_API_KEY` to the MCP server's `env` block. Scans still run locally; your code is
never uploaded. This arrives in VS Code extension 1.3.0 and MCP server 1.6.0;
earlier versions still run every rule without a key.