Changelog

Earlier releases

6 changes

GitHub Action Pro unlock, live demo repo, and pricing polish

  • +GitHub Action Pro unlock is live — add `api-key: ${{ secrets.XPLOITSCAN_API_KEY }}` to your workflow to run all 206 rules in CI (previously capped at the 30 free rules). Generate a key under Settings → API Keys. Also now accepts an optional `anthropic-api-key` input that routes findings through the AI false-positive filter on CI runs for ~$0.01 per scan.
  • +xploitscan-demo repo is live at github.com/bgage72590/xploitscan-demo — a deliberately-vulnerable Express app that scans on every PR. Linked from the Action's README so prospective users can see a real PR comment, real Security-tab alerts, and real inline annotations in one click.
  • +Action v1.3.1 published on the GitHub Marketplace — includes the api-key / anthropic-api-key inputs, an MIT LICENSE file (GitHub's license detector was reporting null), the belt-and-suspenders install fallback chain so a broken CLI publish can't block customer CI, and documented every output (previously `medium-count`, `low-count`, and `sarif-file` were exposed but undocumented).
  • +Settings → Billing now exposes the full upgrade/downgrade matrix. A Pro user can one-click downgrade to Indie, a Team owner can one-click downgrade to Pro or Indie, and every transition confirmation spells out exactly what you gain or lose so team-plan downgrades don't surprise anyone by deactivating members.
  • +Pricing page CTAs are now auth-aware. Signed-out users see 'Choose Indie' / 'Start Free Trial'; signed-in users on Pro see 'Current plan' on the Pro card, 'Upgrade to Team' on Team, and 'Downgrade to Indie' on Indie — with the CTA hitting Stripe checkout directly instead of bouncing through the sign-in redirect. Clicking a plan while signed in no longer lands you on the dashboard by mistake.
  • +Annual sticker prices rounded to conventional SaaS numbers: Indie $59/yr, Pro $119/yr, Team $699/yr (effective $5 / $10 / $59 per month). Savings still clear the 40% marketing claim on every tier (Pro is actually 48% off). No change to monthly prices.
9 changes

AST-based detection, benchmark grown to 151 fixtures, head-to-head with Bearer goes live

  • +Updated Nov 3, 2026: This entry originally said benchmark precision was 100%, with zero false positives across the 151-fixture corpus. That overstated it, because the method left out unexpected findings on clean fixtures. On today's 615-fixture benchmark, counting the findings a hand review judged to be false positives, precision is 81.4% (reviewed Nov 3, 2026). See /benchmark for the method.
  • +Detection benchmark expanded from 41 to 151 labeled fixtures across 25+ vulnerability classes — secrets, SQL injection, XSS, SSRF, SSTI, prototype pollution, mass assignment, deserialization (Python pickle, js-yaml, Java ObjectInputStream), path traversal, NoSQL injection, XXE, JWT alg confusion, weak hashing, hardcoded crypto keys, CSRF, TOCTOU, IAM wildcards, Docker root, Kubernetes privileged containers, GitHub Actions script injection, CORS wildcards, insecure WebSocket, sensitive data in URL params, plus 30 realistic multi-file mini-app fixtures (auth flows, file upload pipelines, payment webhooks, GraphQL APIs, OAuth callbacks, admin dashboards) that exercise rules in integration-level contexts.
  • +AST-based detection layer alongside the existing pattern matcher. Babel-parsed taint tracker recognizes user-controlled sources from Express (req.body / query / headers), Fastify (request.*), Koa (ctx.request.*), Next.js App Router (await request.json(), formData, text), Web Fetch API, process.argv, and AWS Lambda event.body. Taint propagates through const/let bindings, destructuring (including renames), assignments, template literals, and member access.
  • +Ten rules upgraded to dual-layer regex + AST: SSRF (VC041), prototype pollution (VC023), mass assignment (VC042), XXE option-object inspection (VC081), SSTI (VC082), timing-unsafe secret comparisons (VC043), log injection (VC044), weak password hashing across files (VC060), insecure RNG with security-context detection (VC034), and the schema-aware fix to VC030 that no longer false-positives on yaml.load with FAILSAFE_SCHEMA.
  • +Recall on that 151-fixture corpus was 80%+ on the 60+ rules with active fixtures; the remaining tracked-but-not-yet-detected entries are documented openly on the /benchmark page in a dedicated 'in progress' section with an amber badge so transparency replaces the previously confusing dashes.
  • +Bearer goes live on /benchmark — its real numbers are now visible in the head-to-head alongside Semgrep and XploitScan.
14 changes

VS Code extension, MCP server, public detection benchmark, Docker image, and SIEM exports

  • +VS Code extension — security scanning in your editor as you work. Scan on save, findings in the Problems panel with severity and fix suggestions, and a compact status-bar indicator with per-file counts. 206 rules, runs locally, nothing uploaded. Coming to the VS Code Marketplace shortly; the VSIX is available now from the repo's CI artifacts.
  • +XploitScan MCP server — install with `npx -y xploitscan-mcp` and wire it into Claude Desktop, Cursor, Windsurf, or any other Model Context Protocol client. Your AI coding agent can now call `scan_code`, `explain_rule`, and `grade_code` as native tools, so it can self-check its output before writing it to disk.
  • +Public detection benchmark at xploitscan.com/benchmark — precision, recall, and F1 scored on a labeled corpus of 41 vulnerability fixtures covering SQL injection across five database libraries, XSS, command injection, unvalidated redirects, missing pagination, reflected CORS, and service-specific secret detection (AWS, Anthropic, GitHub, Slack, Supabase). The runner is open source; the numbers regenerate on every commit.
  • +Head-to-head comparisons with Semgrep and Bearer on the same corpus, visible on /benchmark. See what each scanner catches and misses side by side, with full methodology and reproducibility instructions on the page.
  • +New blog post: 'We Ran Semgrep Against Our Benchmark. It Missed Half the Bugs.' — a walkthrough of where Semgrep's community rules fall short on the patterns AI coding tools produce by default, with specific examples for SQL injection via template literals across Prisma, Drizzle, Knex, pg, and mysql2.
  • +Docker image for on-prem environments: a multi-arch (amd64 + arm64) scanner image, rebuilt with each CLI release. It runs as non-root, and you mount your source read-only. Without an XploitScan API key or an ANTHROPIC_API_KEY, the only thing sent out is the list of dependency names and versions, which goes to OSV.dev for vulnerability checks. With an XploitScan API key, the scanner also checks your plan, downloads the Pro rules on a paid plan, and uploads the scan results, including the matched code snippets, to your xploitscan.com dashboard. With ANTHROPIC_API_KEY set, file contents are also sent to Anthropic for AI analysis. Use `docker save` to move the image into air-gapped environments.
16 changes

API keys, Cursor integration, privacy tools, and compliance exports

  • +API keys for CI — generate personal access tokens in Settings → API Keys and pass them to the GitHub Action via the new api-key input to authenticate CI scans with your Pro or Team plan
  • +XploitScan for Cursor — drop our security ruleset into any project with one command and Cursor will proactively avoid the most common AI-generated vulnerabilities (unprotected webhooks, hardcoded secrets, missing auth checks, SQL injection) as it writes. New landing page and step-by-step install guide
  • +Broader dependency coverage — the CLI now checks every pinned package against a comprehensive live vulnerability database in addition to our curated rule set. Covers npm, PyPI, and RubyGems
  • +Compliance exports: PDF and Markdown reports now include a rule-by-rule pass/fail breakdown for each mapped SOC 2 and ISO 27001 control. It is an informational mapping, not audit evidence that a control is satisfied.
  • +Download your data — new 'Export My Data' option in Settings creates a single JSON file with every record we hold for your account. Available under GDPR Article 20
  • +Delete your account — new self-service account deletion flow in Settings with type-to-confirm. Cancels any active subscription and removes all of your data in one step
19 changes

Interactive Guides, Animated Hero, Dashboard Polish, and SARIF Fixes

  • +Interactive guides — new /guides section with step-by-step walkthroughs for the web scanner, CLI, GitHub Action, and API. Persistent progress checkboxes, copy-to-clipboard code blocks, expected output panels, and troubleshooting per guide
  • +Animated hero terminal — homepage now demos a real scan in a typing terminal that loops every ~30 seconds, instead of a static screenshot
  • +No-login demo scan — visitors can run one real scan from /demo without signing in, persisted across reloads
  • +Top Fixes card on dashboard — surfaces the three highest-severity findings from your latest scan with deep links to each fix
  • +Bigger grade indicator with a click-to-open scoring modal explaining how grades are calculated
  • +Trial-end upgrade modal — prompts trial users to add a payment method when their trial has 2 days or fewer remaining
11 changes

Compliance Dashboard, Export Tools, and UX Polish

  • +Compliance page scorecards — at-a-glance pass/fail status for SOC2, ISO 27001, OWASP Top 10, and CWE
  • +Expandable compliance controls — click any control to see all mapped rules and their status
  • +Compliance export — copy as AI prompt, export as Markdown, JSON, or CSV
  • +Framework info tooltips — plain-English explanations of what SOC2, ISO 27001, OWASP, and CWE are and why they matter
  • +Severity tooltips on scan results — hover to learn what Critical, High, Medium, and Low mean
  • +Custom checklist items now work correctly — no longer stuck as N/A
9 changes

Security Hardening, Referral Program, and QA Fixes

  • +Referral program — earn 1 free month for every referral that subscribes
  • +Trial abuse prevention — one free trial per account
  • +Security hardening across CLI, web, and API
  • +Shared checklist links now expire after 30 days
  • +Team members properly recognized as paid across the app
  • +Viewer role fully enforced — Scan/Checklist hidden from nav, pricing hidden from billing
17 changes

XploitScan V1.0 — Production Launch

  • +Team Plan ($99/mo) — 5 seats included, shared scan history, RBAC, team invite management, and portfolio reports
  • +Annual billing with 20% discount — Pro $23/mo, Team $79/mo when billed annually
  • +In-app plan switching — upgrade, downgrade, or change billing interval with prorated billing
  • +Full team management — invite members by email, assign roles (Owner/Admin/Member/Viewer), remove members
  • +Role-based access control (RBAC) with granular permissions for each team role
  • +Team members inherit Pro features through the owner's subscription — no separate payment needed
10 changes

Auto-Fix Code, Exposure Badges, Impact Explanations, PR Comments

  • +Auto-fix code suggestions — top rules now show before/after code diffs with the secure version
  • +Exposure badges — every finding tagged as Public or Internal based on file path
  • +Impact explanations — 'Real-world risk' callouts in the 'Why it matters' section
  • +GitHub Action now posts a security report summary comment on pull requests
  • +CLI rule gating — free users get 30 core rules, Pro users get all 131
  • +Single upload button — auto-detects file type (individual files or ZIP)
6 changes

131 Rules, Rate Limiting, Compliance Mapping

  • +Added 15 new high-impact security rules: path traversal, PII logging, OAuth secrets, deprecated TLS, weak RSA, ECB encryption, Terraform state exposure, and more
  • +Total rule count now 131 across CLI, web, and API
  • +Server-side scan rate limiting — free users: 5 scans/day, Pro users: unlimited
  • +Scan limit banner with real-time usage counter
  • +SOC2/ISO 27001 compliance mapping for all rules
  • +GitHub Action verified end-to-end with SARIF upload to Security tab