Changelog

New releases, improvements, and bug fixes. Reverse-chronological.

Stronger transport security, broader coverage, CVE lookups

  • AddedHSTS module — checks Strict-Transport-Security header, max-age, includeSubDomains, and preload readiness.
  • AddedAuth-testing module — flags missing auth on common admin paths, weak session cookie flags, and predictable token endpoints.
  • AddedOSV.dev CVE lookup for third-party JS libraries, replacing the previous NVD-only check.
  • ImprovedCookie Security module now distinguishes SameSite=None without Secure from genuinely missing SameSite.
  • FixedFalse positive on the Security Headers module when CSP uses nonce or hash sources for script-src.

Trust page and security.txt

  • Added/security trust page covering dogfooding, subprocessors, encryption, retention, and certifications roadmap.
  • Added/.well-known/security.txt with safe-harbour terms, scope, and disclosure timeline.
  • ImprovedPrivacy Policy now spells out guest-scan retention and the audit log retention window.

MCP server for AI editors

  • AddedMCP server (v0.2.0) for Cursor, Claude Code, and Windsurf. Tools: scan, status, findings, propose_fix, apply_fix.
  • AddedPer-editor config snippets and a 4-step DevSecOps loop guide at /integrations/ai-edits.
  • ImprovedAI triage prompt slimmed down — same accuracy, ~40% fewer tokens per scan.
  • FixedWorker crash when a target returned a redirect chain longer than 5 hops.