Changelog

If a paid scan fails partway through on our side, the credits go straight back to your account. Scans already running also keep going while we release updates, instead of starting over.

The customer report now shows which issues you've fixed since monitoring began, each confirmed by a later scan, and any risks you've accepted, with your reason. Accepted risks no longer count as open findings.

Listed prices no longer include sales tax or VAT. Where tax applies, it's added at checkout, and you see the full total before you pay. Existing subscriptions keep the price they started with.

Each finding now shows whether it's New, Open since a date, or Back again after being fixed. A "Fixed in this scan" section lists what you've resolved. Subscribers can also accept a risk with a reason, so it stops counting as open.

Subscribers can download a customer-ready PDF: what was tested and when, coverage against the OWASP Top 10, and open findings by severity. It leaves out exploit details, so it's safe to send to customers, partners or auditors.

When a check can't finish, for example because your site blocked or rate-limited it, the scan now says so instead of marking that area clean.

If your app calls an API on another host of the same site, like api.yourapp.com, scans now test that host as well and list it in the results.