This release focuses on scan reliability, safer output, and clearer results. You should see fewer false alarms on slow-starting sites, and more actionable details directly in the terminal.
Quality of Life
Scans now run checks concurrently and use a longer per-request timeout, which helps avoid “unreachable” results caused by cold starts on common hosting platforms.
Network-based checks now fall through from staging to production when staging is down or missing a route. This helps ensure you get answers about the live site instead of being blocked by a local or unavailable staging URL.
When a host is already known to be unreachable, related checks skip repeated probes. This reduces waiting and keeps results consistent across checks.
Fixes and Safety Updates
Terminal output now shows Suggestions (like file and line locations) so you can act on findings without switching formats. Output also strips terminal control characters to prevent hostile project content from affecting your terminal.
Update notifications now print to stderr instead of stdout. This keeps scan --format json output as a single valid JSON document when you pipe it to other tools.
Several safety checks were tightened to reduce risky behavior:
- Only http and https URLs are handed off to the system browser opener.
- More IP ranges are treated as private, including 0.0.0.0/8 and shared address space (CGNAT).
- Redirect DNS lookups are now bounded by the same request timeout.
SSL failures are now classified more clearly (expired, hostname mismatch, or untrusted), and the SSL check fails appropriately. Certificate expiry grading is also enforced with dedicated tests.
Service detection and check listings are now generated from a single catalog, reducing drift between what is supported, what runs, and what is shown in listings.
The Stripe webhook check now optionally probes the configured webhook URL with a GET and reports whether the route appears reachable (including valid “route exists” responses like 405).
Config parsing now rejects unknown keys instead of silently ignoring them. This helps catch typos that previously caused checks to not run without any clear explanation.
Exit codes are now documented more fully, including codes for “could not run” and “cancelled.” History output also correctly treats the “warn” severity value as a warning.
Publishing and history now use the API origin that originally issued your login, and will warn if your current environment points somewhere else. This prevents scans from being sent to an unexpected host.