This release focuses on safer, more accurate scanning. You will get earlier visibility into reachable vulnerabilities, and more reliable results from checks that depend on reading URLs from HTML.
Security coverage
Added automated vulnerability scanning using govulncheck, which reports issues your code can actually reach. This helps avoid both false alarms and missed vulnerabilities that simple version matching can overlook.
A scheduled scan is included so newly published advisories are still detected even when there is no new commit to trigger a run.
More reliable URL-based checks
Fixed an issue where URLs containing // could be mistakenly treated like comments during scanning. This could truncate attributes such as href="https://..." and prevent downstream checks from running.
As a result, canonical tag detection is now consistent for minified HTML, and og:image and twitter:image extraction works correctly for absolute and protocol-relative URLs, allowing image dimension validation to run as intended.
Local development URLs are still supported, but exemptions are now scoped to the exact configured targets so one local URL does not unintentionally relax protections for other URLs discovered during the scan.