10 changes
Scanning the same code twice now gives you the same answer
- +Scan results are reproducible. Both AI-assisted steps — the false-positive review that removes findings, and the optional contextual analysis that adds them — now run at a fixed sampling setting, so scanning unchanged code returns the same findings and the same grade every time. Both previously ran at the model's default sampling, where a second scan could quietly differ from the first with nothing in your code having changed.
- +Scanning a subdirectory now respects the .xploitscanignore at your project root. Previously that file was only read when it sat directly in the directory you scanned, so xploitscan scan src/ — and any CI job pointed at a single package in a monorepo — quietly scanned everything you had excluded. Paths are matched relative to the file that declares them, and a nested .xploitscanignore still takes precedence, exactly like .gitignore.
- +The GitHub Action's outputs (grade, score, findings-count, the per-severity counts, and sarif-file) now carry real values, so you can branch on them in later workflow steps. They previously resolved to an empty string.
- +Your Trust Page can now show how your app compares to the Vibe Security Index. When your latest scan supports it, the scanning section adds a line like "Fewer findings than 62% of the 25 Lovable apps we scanned for the Vibe Security Index" — matched to the builder that scaffolded your project where we can tell, and to the whole round where we can't. The sample size is always in the sentence, the methodology is one click away, and the line simply doesn't appear when the sample is too small to support it. It is a comparison, not a badge or a certification.
- +The inline "I've reviewed this" comment now works where you most need it. Marking a single finding as accepted with // VC003-OK: <reason> or // ENTROPY-OK: <reason> had no effect on those two checks — the endpoint-authentication check and the high-entropy-string check — so the only way to quiet one intentionally-public endpoint or one published verification token was to exclude the whole file. Both now honour the marker, and your explanation can run across several lines instead of having to fit on one.
- +New: scan a URL, no signup. Paste your app's address at /url-scan and see what your deployed build already tells every visitor. Top of the list is whether your source maps are publicly served — if they are, anyone can read your original file names and, where a map embeds its source, your original TypeScript, comments and all. Below that: whether your backend configuration ships to the browser, which AI builder the bundle looks like it came from, and which security headers are missing.
- +The URL scan reads only what your site already serves any browser — its HTML, its JavaScript bundles, its response headers. It never sends attack payloads, never attempts a login, and never queries anyone's database. It is deliberately a smaller question than a code scan: it can tell you your source maps are public, but it cannot see the authorization check missing from an API route, because that code never reaches the browser.
- +When a builder is detected, the report quotes that builder's Vibe Security Index rate beside it — how often apps built with the same tool turned out to have a critical finding, with the sample size printed next to the number so you can see what it is worth. The report holds nothing back: it names the exact source maps it confirmed and the backend project it found, because every one of those values is already served to anyone who opens your site in a browser. Find it under Scan a URL in the nav.
- +The navigation menus are now fully keyboard-operable. Open a menu with Enter, Space or the arrow keys, move through it with Up and Down, jump with Home and End, and close it with Escape — which puts you back on the button you opened it from. The mobile menu closes on Escape too, and it no longer stays stuck open when you widen the window past the point where its button disappears. Screen readers now get the menu behaviour they were already being promised.
- +New: What Lovable apps get wrong, at /for/lovable. If you build with Lovable, this is the security findings that actually repeat across the 25 Lovable projects in the latest Vibe Security Index round — and for each one, why building this way produces it, the prompt change that stops it coming back, and the command that proves it's gone. It also says where our own detection is weakest on this kind of code, because a scanner that only advertises what it catches isn't much help in deciding whether to trust it. Aggregate only, every rate shown with the count behind it, no repository ever named. More builders to follow.