Changelog

A few checks depend on a source that is not your site. Certificate history, for example, is looked up through the public certificate transparency service crt.sh.

Those checks now declare it directly when the third-party source is the thing that did not answer. Coverage attribution reads that declaration, so a third-party outage is recorded against the third party.

Scores and letter grades are not affected by this change.

Score Breakdown is now shorter and easier to scan.

• ▸Category cards are now the main source of detail.
• ▸Confirmed findings, partial checks, checks that did not run, and checks that did not complete are clearly separated.
• ▸Methodology and coverage details remain available on demand.

Scanning, scoring, findings, and publication rules are unchanged.

Public scans are now bounded and do not publish an official grade until current ownership is verified. Findings and fixes remain deterministic, optional AI is limited to an executive summary, and account data exports now include a broader set of account-linked records through credential-safe projections.

Verified domain owners can now see UNPWNED's current dedicated scanner IP, scanner identity, and narrow Cloudflare, Vercel, or WAF setup steps before starting a Deep Scan. Already verified owners are recognized automatically and are not asked to verify again. Access preparation improves coverage but does not guarantee that every check will complete or that a grade will be published.

We improved how UNPWNED distinguishes target protection from incomplete checks. Protected subdomains now appear as protection context instead of live findings, and HTTP refusal status alone never creates a finding.

Three things about repository scanning, and the first two are corrections rather than features.

**Go and Rust dependency scanning had never run.** The parsers for `go.mod` and `Cargo.lock` existed, were tested, and were unreachable: a list of filenames further upstream decided which files were kept from your repository, and neither of those two was on it, so their contents were discarded before anything could read them. Every scan of a Go or Rust project reported zero dependency issues, and that was not a result, it was silence. Both are read now, and their advisories come from OSV like every other ecosystem.

**A finding in a test file is no longer announced as an exposed secret.** A scan that turns up a private key in a fixture used to headline "35 findings" with "high severity is the one to fix first", and the alert email put "35 secrets exposed" in red. The prompt built from the same scan already knew better and said "every one of them is in a test file, do not rotate anything". Two surfaces, one scan, opposite instructions, and the alarming one was the one a person reads. The header now says how many sit in test files and, when they all do, that the right action may well be none. Nothing is hidden and no number went down: a real key does get committed to a test, and that is your call to make, not ours to quietly file away.

**We say more about what we do with your code.** The Privacy Policy now states plainly that scanning includes private repositories, names GitHub, npm, PyPI and OSV.dev in the cross-border transfers section, and separates the public lookup services from the processors we hold contracts with, because claiming a legal safeguard over an endpoint you cannot sign anything with is not a safeguard. It also corrects a sentence that said package names and versions were the only thing leaving our systems; our error monitoring records request URLs on a sample of traffic, and a repository archive URL contains the repository name.

Terms Section 7b now covers repository fix prompts, coding agents that apply changes without your review, and credential rotation by name. Nothing you were responsible for changed. That section already covered any change you make by running one of our prompts in an external tool, but it was written in the vocabulary of DNS records and server configuration, and it now says the same thing in the vocabulary of source code. It also states something worth having in writing: we do not confirm with any issuer whether a credential we report is still live.

When a deep monitoring scan was stopped because something in front of your site challenged our scanner, we switched monitoring off and told you to go fix your scanner access. That happened on the first occurrence, with no second chance.

We caught this on our own site. A monitoring scan of unpwned.io was stopped part of the way through by a single challenge. Monitoring was switched off, and the very next scheduled run completed in full with nothing changed on either side. So the thing we had reported as a standing problem with scanner access was a passing moment, and switching monitoring off was the wrong answer to it. The message also sent the owner to go change a firewall rule that was never the problem.

**Monitoring now gets a second chance.** One blocked scan leaves monitoring running, and it tries again on its next scheduled run. Only a second blocked scan in a row pauses it, which is the point where something really does look like it needs you. Any scan that completes clears the count.

**The notification now says which of the two happened.** Either monitoring is still active and will retry, or it is paused and needs you. Before, it always said paused, because it always was.

Two things deliberately did not change. A blocked scan still fails and is still refunded to your quota, because a scan stopped part of the way through is not a report. And a monitor that is blocked every time still pauses, because that pause is what stops us going back at a site that has refused us.

Four things on the Repositories page and the dashboard, and the first one is a regression we introduced ourselves two days ago.

**The dashboard tile was invisible unless you had already connected GitHub.** That tile is the only place in the product that tells you repository scanning exists, and its copy for people who have not connected, "Connect GitHub to scan your source code", had become unreachable. The one person who most needed to find the feature was the only one who could not see it. It renders for everybody again.

**The tile could also say NEVER SCANNED when it had simply failed to read.** If the query behind it timed out, an empty answer and a real zero looked identical, so an account with findings in three repositories could be told its source code had never been looked at. The tile now says nothing at all rather than a confident zero, which is the same rule we hold our scanners to: we would rather leave a gap visible than fill it with a reassuring number.

**One repository is now offered first, with a reason.** Twenty six rows carrying twenty six identical buttons is not a choice, it is a place to stop. The page now leads with your most recently pushed repository, says why it picked that one, and gets out of the way permanently once you have scanned anything.

**And two small things in the menu.** The GitHub mark is back where it belongs, and a duplicate row that pointed at the same page has been removed.

A follow-up to this morning's upgrade-advice fix, in the part of the system that decides whether a CVE applies to the version you are running.

**Prereleases now sort correctly.** A version like `16.2.11-canary.3` was treated as NEWER than `16.2.11`, which is backwards. If you run a prerelease of anything, we could tell you no fix had been published when one had. Build metadata like `+build.456` no longer affects the comparison either, and Go pseudo-versions now sort by their timestamp instead of all looking identical.

**Vendor and distro version suffixes no longer hide a match.** A CVE range written against something like `5.7.44-rds.20251212` was excluding plain `5.7.44`, which would have been a missed vulnerability rather than a false alarm. Where a suffix is involved we now check the version both ways and report it if either reading says you are affected. Ranges without a suffix, which is almost all of them, are unchanged.

**Findings in test files now say so.** If a scan flags a secret that lives in your test fixtures, the finding carries a "test file" label. It is still reported, because a real key does sometimes get committed to a test, but you can now tell the difference at a glance instead of reading every path.

We also removed a dependency we were shipping and never using, which had been holding an image library on a version with a published advisory.

Three things, all of them found by pointing our own scanner at ourselves.

**Disconnecting GitHub now exists.** There was a button's worth of promise and no button. You can now disconnect from the Repositories page, and the dialog tells you the cost before you confirm: how many repository monitors go, how many scan results go, and that every finding in them is deleted with them. We would rather not keep a map of your code after you have told us to stop reading it. It also says the part a reassuring dialog would leave out: disconnecting here does not remove the app from your GitHub account, so there is a link to do that too.

**Upgrade advice was pointing at older versions.** When a dependency had a known vulnerability, we read the first fix listed in the advisory. Advisories list a separate fix for each release line, so somebody on Next.js 16.2.6 was told to "upgrade" to 15.5.21, which is a downgrade off their major version. The same flaw meant an advisory covering several packages could hand you a version number belonging to a different package, or invent one for a package that was never fixed at all. Every recommendation now belongs to your package and to your release line, and we would rather say "no fixed version published" than point you backwards.

**Fewer false alarms in secret detection.** A line in a README telling you to generate a random value is no longer reported as a credential, and neither is a constant whose value simply repeats its own name. Both changes were tested against the opposite mistake: a real key sitting next to those same words is still reported.

Pressing Connect sent you to GitHub's install screen. If the app was already installed on your account, GitHub forwarded that link to its own settings page instead, and nothing sent you back. The connection was never recorded and the button looked like it had done nothing.

Connect now identifies you with GitHub first, so you always come back to us, installed or not. If you have nothing installed yet you are taken straight to the screen where you choose repositories, rather than being told something went wrong.

Manage repositories now works from the dashboard. You pick which repositories UNPWNED may read, you can add or remove them whenever you want, and saving a change brings you back with a confirmation.

Two other corrections. The consent dialog said GitHub would ask for the broad `repo` scope. It does not: the app asks for read access to code and metadata, and read and write access to issues, with no write access to your code at all. The dialog now says exactly that. The Privacy Policy has been updated to describe both the app and the older token-based connection, which existing connections still use until they reconnect.

Repository scans used to stop after the first 300 files, in tree order. On a repository of any size that meant most of your code was never opened, and the result still said the scan was complete. A scan now reads every scannable file and tells you plainly when it could not.

What changed:

• ▸**Full coverage.** Every scannable file is read, and the result shows how much was read against how much was there. A file we skip by design is shown separately from a file we could not get to, because those are different facts.
• ▸**A partial scan says so.** It can no longer be mistaken for a clean one. The headline carries the number of files that went unread.
• ▸**Known vulnerabilities in your dependencies.** Versions are read from your lockfile and checked against the OSV database, with severity and the version that fixes each one. This check did not exist before.
• ▸**Better secret detection.** Secrets in comments, several on one line, SSH and PGP private keys, and a much wider set of providers. Supabase keys are now decoded, so a service_role key is reported as critical while a public anon key is not reported as a leak.
• ▸**Far less noise.** Test fixtures, placeholder values and shell variables are no longer reported as credentials.
• ▸**Scan history.** Results are kept, so they survive a refresh, and each scan shows what changed since the last one.

We also narrowed what we ask of GitHub. New connections use a GitHub App with read-only access to the contents of the repositories you choose, instead of the broad access GitHub's older integration required. Existing connections keep working and move over when you reconnect.

The block at the top of the dashboard showed a score, the platform average and a ranking, and finished with "Your site scores N points below the platform average".

On an account with more than one domain, all of that was misleading. The score belonged to whichever domain happened to be scanned most recently, so it moved for reasons that had nothing to do with your security posture. The ranking was computed from that single scan while reading as a position for the whole account. And "your site" is the wrong noun for six of them.

The domain is now the label on the score itself, so it is immediately clear which site the number describes. The ranking says it is that one scan. And the block now tells you how old the number is, in the same words the list underneath already uses, with a note when a re-scan is worth it. Across the platform most graded domains carry a grade older than a month, so the age of a score matters nearly as much as the score.

The monitoring page listed what you had configured. It now shows what monitoring has actually done: how many scans ran, how many changes it caught, how many issues closed, the score over time, and exactly what opened and closed since the previous run.

A run that could not be scored comparably appears as a gap in the line rather than a dip, because a partial run is not the same measurement as a complete one.

Two new settings per domain. "Only email me when something changed" suppresses the email on a run that found exactly what the last one found. And "Allow intrusive probing on scheduled scans" is a new switch that is off for everyone.

That second one matters. Some deep checks send real exploitation attempts at your site, such as reading a system file through a crafted request path. They are read-only, but your own server logs record them as attack traffic. Until now, verifying your domain was treated as agreeing to them. It is not, so we stopped: every existing monitor is switched off until its owner turns it on. The Terms now describe exactly what these requests are.

A CVE alert used to be titled "CVE-1234 affects Next.js on your-site.com" while the message below it said we could not confirm which version you run. The headline claimed more than the evidence behind it.

An alert now states the technology plainly, because the CVE record does, and hedges the part about your site: "CVE-1234 in Next.js may affect your-site.com". When we did read a version and it falls inside the affected range, the wording goes back to being direct.

Whether a CVE is on the CISA actively-exploited list is stated either way, since that is a fact about the vulnerability and not about your site.

Nothing changed about who receives alerts or how often.

CVE Radar had two answers: a version was checked and matched nothing, or there was nothing to check. It had no way to say the third thing, which is that we saw a technology on your site and could not establish which version it runs.

That gap could read as reassurance. An account with one version-checked technology on one domain was shown as having no known CVEs, even when other domains it owned had never been version-checked at all.

A third state now appears wherever that is true, and it says plainly that we could not establish a version and therefore cannot say whether known CVEs apply. It is never shown in green.

Nothing about your score or your existing findings changed.

The menu is now grouped by what you are trying to do: Product, Data and Learn. A locked feature takes you to that feature and explains it, instead of bouncing you to the pricing page. Every page in the app now opens with one line saying what it is for.

Light theme text was too pale to read. Every foreground colour was re-derived from measured contrast, so light now reads as clearly as dark.

The Cloudflare access card on your domains used to stack a heading, a description, a badge and a button that all said the same thing, and in some states it offered a button Cloudflare always refused. It now shows one status and at most one action, and it never says your firewall turned us away unless something actually did.

Fix instructions for Vercel, Netlify, Render, Cloudflare and CloudFront no longer bury an English note inside a value you paste into a config file, which browsers silently ignored.

The paid security assessment is no longer offered.

A grade earned from a surface scan and a grade earned from a full deep scan used to look identical. They answer very different questions, and that difference now travels with the score.

WHAT CHANGED

• ▸Under the grade you now see how many checks ran and how many did not. A surface scan runs a smaller set than a verified deep scan, and the number says so.
• ▸Areas we could only examine in part no longer say "Clean". They say the checks that did run found no issues, at surface depth.
• ▸Sign-in, database access rules and API routes cannot be reached from outside your site. Verifying that you own the domain is what runs those checks.
• ▸A result served from our 24-hour cache now carries the same detail as the scan it came from.

WHY IT MATTERS An area we did not fully examine is unknown, not clean. Saying otherwise is the one mistake a security tool should never make. Nothing about how we score has changed, and no existing score moved.

This morning's update scored each area of your report on its own evidence. Today's follow-up makes sure those areas tell you the truth.

WHAT CHANGED

• ▸Areas are now judged against the checks your scan actually runs. A public check runs a smaller set, so areas that had finished were marked "Not checked" against a list that never applied to them.
• ▸We no longer name your firewall as the reason a check did not finish unless the scan actually watched it turn us away.
• ▸A scan that meets bot protection keeps checking. It slows down and stops retrying the refused check instead of stopping altogether, so more of your site is covered in one run.
• ▸The exposed-files check no longer reads as blind on sites that answer every path with the same page.
• ▸The Domains page no longer offers a Cloudflare fix for a block that did not come from Cloudflare.

No score or grade changed. Existing reports pick up the area and wording fixes next time you open them.

Until now the score was all or nothing. If too much of a scan was turned away by a firewall, the whole report came back with no score and no grade, even when several checks had completed perfectly. You were shown a blank result while real, finished findings sat behind it.

WHAT IS NEW

• ▸Your report now scores each of the seven areas separately: Secrets & Credentials, Security Headers, SSL/TLS, Auth & Access, DNS & Email, Database Exposure, and Dependencies & CVEs.
• ▸An area we were able to check completely gets its own score, even when the rest of the scan was blocked. In practice that usually means you still get a full result for DNS, email and TLS, because those checks do not depend on reaching your site directly.
• ▸An area we could not finish is labelled "Not checked" with a dashed ring. It is never counted as a pass.
• ▸An area where we found real issues but could not finish every check keeps its findings and is marked "Partial", so you can read its score as a floor rather than a full picture.
• ▸The breakdown is available on every plan, including Free.

WHAT HAS NOT CHANGED The overall score and letter grade still follow the same rules and the same thresholds as before. Nothing was loosened. We would rather show you nothing than show you a clean score for something we could not actually see, and that principle now applies area by area instead of to the whole report at once.

WHAT TO DO Open any report and look under the score. If areas are marked "Not checked", verifying your domain gives the scanner the access it needs to complete them on the next run.

Firewalls, WAFs and bot protection cannot tell an owner-authorized security scan apart from unknown traffic. Parts of a scan could be turned away, and the report came back incomplete with no way for you to fix it, because the scan never arrived from an address you could identify.

That changes today.

WHAT IS NEW

• ▸Scans of a domain you have verified now leave from a single fixed UNPWNED address instead of a shared pool that changes.
• ▸The current address is published at /scanning-ips.json, and any report that needs it shows it next to the exact hostname it applies to, ready to copy.
• ▸If you have connected Cloudflare, the allow rule is created for you automatically, scoped to that one hostname and that one address.
• ▸On every other provider, the report now walks you through adding the same narrow exception in your own firewall, step by step.

WHAT THIS IS NOT This is not a way around your protection. The address is identified, published and permanent, and nothing changes on your side until you approve it. Scans continue to honour robots.txt. We will never ask you to disable your firewall, your bot protection or your rate limits, and any exception you add should stay limited to one hostname and one address.

WHAT TO DO Verify the domain, then allow the published address for that exact hostname. Verifying alone routes the scan correctly, but the exception is what removes the gaps. Your next scan should come back complete instead of partial, with a full letter grade rather than a partial score.

Always confirm the current address at /scanning-ips.json before you create a rule.

CVE Radar alerts are now limited to domains you have verified you own, matching what your CVE Radar dashboard already showed. Previously an alert could reference any host you had scanned in the last 35 days, including one-off scans of sites you do not run. Scheduled monitors are unaffected and keep alerting on every domain you monitor.

Your dashboard can now answer a question it could not answer before: what of yours is actually reachable from the internet.

ATTACK SURFACE (new, in the sidebar)

• ▸Every subdomain, open port, certificate, technology, endpoint, exposed file and third-party service found on your verified domains, grouped into four layers.
• ▸A map that places what you hold at the centre and what you rent at the edge, so your most sensitive exposure sits where your eye lands first.
• ▸A change summary against your previous scan: what appeared, what disappeared, what moved.
• ▸A layer we could not measure says so. It is never shown as an empty, clean layer.
• ▸Free plans see every count on every layer. Paid plans open the full inventory, the change summary and export.

A DASHBOARD THAT SAYS WHAT IT IS MEASURING

• ▸Your domains are now listed by what needs attention first: critical, then high, then never scanned, then overdue for a re-scan. A clean result from three months ago now ranks below a clean result from this week.
• ▸The score trend follows a single domain instead of interleaving several, so the line means something.
• ▸CVE Radar counts only the domains you have verified as your own.

PLANS AND BILLING

• ▸Plan changes, upgrades and proration are handled reliably end to end.
• ▸Clearer billing information, and safer handling of subscription events.

POLISH

• ▸One icon and colour language across the dashboard, the report and the live scan view.
• ▸Contrast and layout fixes on the homepage and the feature sections.

UNPWNED now handles modern hosting and traffic protection more intelligently, with better coverage across Cloudflare, Vercel, and other managed platforms.

• ▸Adapts scan pacing to the detected hosting environment and honors Retry-After.
• ▸Respects robots.txt and records denied checks instead of silently treating them as clean.
• ▸Prevents overlapping scans of the same target from throttling each other.
• ▸Retries temporary network failures safely while keeping scans within their authorized scope.
• ▸Shows exactly which checks succeeded, were blocked, or remained inconclusive.
• ▸Gives clearer setup guidance when a firewall limits access.

Scores now reflect only the checks we could actually assess. If a target still restricts security testing, the report is marked partial instead of guessing or presenting a misleading clean result.

Run a check at unpwned.io/check and you'll now see one of the actual findings from the scan right in the results, plus an honest breakdown of what an account unlocks (every medium and low finding, re-scans after each fix) versus Pro (critical and high findings with step-by-step fixes). Scanning a site behind a firewall? You can now verify ownership straight from the results to unlock the full picture, and clean scores get a one-click path to the deep scan included with your account. Not ready to decide? Use "Email me this report" and we'll send your report link - one email, that's it.

Every scan now checks the software running on your site against known CVEs, not just deep scans. When we find one, the report shows it in full: the CVE ID linked to the official advisory, its CVSS severity, whether it is on CISA's actively-exploited list, how likely it is to be exploited in the wild, and the version that fixes it. Pro reports and PDF exports include the exact CVE IDs and patch versions. Behind the scenes we refreshed our vulnerability database to sync newly-exploited and newly-updated CVEs daily, and made monitoring alerts smarter, so you only hear about a CVE when the version we actually detected on your site is affected.

We published our live research page at /research: aggregate security data from 800+ production websites, comparing AI-built (vibe-coded), modern-stack, and traditional sites. Key finding: AI-built sites expose secrets at 3.8x the rate of traditional sites and ship critical vulnerabilities 2.8x as often, while average scores look almost identical. The numbers update automatically as the dataset grows. Aggregates only: no individual site is ever identified, and groups under 30 sites are hidden.

UNPWNED is now built around the domains you protect. Solo (1 domain), Studio (5 domains), and Scale (15 domains) each include unlimited re-scans, continuous monitoring with alerts, full finding details, and AI fix prompts. Free still shows what is exposed on any site, and now lets you re-check the same domain once a month.

Already on a paid plan? Nothing changes. Your price and access stay exactly the same.

Launch offer: 25% off your first payment with code LAUNCH25, applied automatically at checkout through August 31.

Settings and Findings were tightened across desktop and mobile: compact stats, cleaner menus, better Sand/Dark contrast, and more reliable mobile navigation. Cloudflare can now connect through one-click OAuth for domain verification, DNS fixes, and scanner access. OAuth is ideal for quick scans and fixes; use an API token when you need a persistent 24/7 monitoring connection.

We shipped a Cloudflare scanner access update. UNPWNED now uses published static scanner IPs with one-click Cloudflare IP Access Rules, pre-checks whether the rules already exist, preserves the last reliable score when WAF blocks monitoring, and shows Cloudflare guidance in blocked scan reports. If you connected Cloudflare before this update, reconnect it in Settings so the token includes Firewall Access Rules permission, then use Allowlist scanner IPs.

Fixed an issue we flagged? Pro now re-scans the same site and shows a before/after diff: what is fixed, what is still open, and any new regressions introduced by the change. Your first scan of any domain stays free; re-scanning the same domain to verify a fix is part of Pro.

This update focuses on privacy, accessibility, and transparency.

**AI suggestions control (new).** You can now turn AI-generated fix suggestions on or off in Settings. When off, your scans still run and show scanner-based findings, but no scan data is sent to an AI provider.

**Accessibility.** Improved text contrast and keyboard focus across the app for better readability and screen-reader support.

**Privacy by design.** Our security analysis sends only technical findings to AI providers, never your secrets, credentials, or personal data. We also clarified your cookie and data controls.

**Updated Terms and Privacy Policy.** Clearer wording on email preferences, billing, and your rights, plus a Hebrew summary of the key consumer terms for users in Israel.

You can manage AI suggestions and cookie preferences anytime in Settings.

Two improvements to scoring and reporting:

• ▸CSP rating calibration: `unsafe-inline` alone in script-src is now rated High (was Critical), matching Mozilla Observatory, OWASP, and Google csp-evaluator. Critical severity is reserved for `unsafe-eval` or proven XSS.
• ▸Cleaner reports: HSTS and clickjacking findings no longer appear twice under different titles in some reports.

You can now upgrade or switch your Pro plan directly from the pricing page or your billing settings — no need to cancel and resubscribe. Upgrades take effect immediately with a prorated charge. Downgrades take effect at your next billing cycle, so you keep your higher limits until then.

When a domain has been scanned recently, you now see those results instantly. No waiting. Verified domain owners and Pro users always get fresh scans on every request.

We rebalanced how grades are calculated. Common best-practice gaps (missing CSP, DNSSEC, SPF, security headers) no longer push your score down as harshly. Critical risks like exposed secrets, open databases, and cloaking still trigger an instant F. Most sites will score 5-10 points higher under the new model.

What changed:

• ▸Severity weights softened: high (-10 → -8), medium (-5 → -3), low (-2 → -1).
• ▸Critical raised slightly (-20 → -25), but more importantly the F cap is now applied LAST in the pipeline so no bonus can bypass it.
• ▸Grade thresholds lowered: A 88+, B 78+, C 65+, D 50+. F is now <50 (or any critical/cloaking finding).
• ▸A+ now requires 95+ score, 2 bonuses, and zero high/critical findings.
• ▸Your last scan has been re-graded automatically with the new methodology.

Read the full methodology at /methodology

Scan accuracy is significantly more trustworthy. When a scanner can't complete (timeout, blocked, or target unreachable), it is now reported as a coverage gap instead of silently passing as "clean", so your score reflects what was actually verified, not what was assumed. Telemetry and reporting have been hardened to match.

Monitoring is now watching the global vulnerability feed for you, not just rescanning your site.

What's new on your Monitoring page:

• ▸Live CVE feed from the NIST National Vulnerability Database — 113+ vulnerabilities tracked, updated nightly.
• ▸"Match Your Stack" counter — we compare every new CVE against the technologies we've detected on your scanned domains, and show only the ones that matter to you.
• ▸Per-domain attribution — when a vulnerability is relevant, you see exactly which of your domains is affected. No more guessing which site to patch.
• ▸New CVE Inventory page (/monitoring/cves) — full list of every matched CVE with severity filters, domain filter, and search.
• ▸Email alerts — the moment a new vulnerability is published that affects your stack, you get an email with the details (Pro) or a heads-up (Free).

Data source: NIST NVD. This product uses the NVD API but is not endorsed or certified by the NVD.

This is our biggest scoring update yet, rebuilt from the ground up after listening to real user feedback.

**What's new**

1. **Fair scoring for sites behind Cloudflare / WAFs.** If our scanner is blocked by active protection, you now earn a bonus - no more getting penalized for doing security right.

2. **Transparent A-F methodology.** Every point is explained on the new /methodology page. No black box, no hidden weights.

3. **Sub-score breakdown.** Every report now shows 7 category gauges (Secrets, Headers, SSL/TLS, Auth, DNS/Email, Database, Dependencies) so you see exactly where to improve.

4. **Peer benchmarking.** Every score shows where you stand against hundreds of real scanned sites ("Beats 87% of scanned sites").

5. **Bonuses toward A+.** HSTS, strict CSP, WAF, rate limiting, and SRI each earn a bonus. Stack them to reach the top grade.

6. **Clear share link.** Turning your report public is now a one-click action at the top of the report - no more hunting for it.

**What this means for your existing reports**

Reports scanned before April 18, 2026 show a small "Scored with methodology v0.9" banner. Your grade was computed under the old rules - rescan the domain to see your current grade under v1.0.

**Why we did this**

Users with Cloudflare kept getting punished for having good security. Users couldn't understand where their score came from. A+ felt meaningless when any clean scan could earn it. We fixed all three.

Thank you for the feedback that shaped this release.

UNPWNED now syncs vulnerability data nightly from the National Vulnerability Database (NVD). Scans automatically detect known CVEs matching your tech stack and version. Pro users get real-time alerts when new vulnerabilities affect previously scanned domains. Free users receive upgrade prompts for full details.

Connect your Cloudflare account to UNPWNED and unlock:

• ▸**One-click domain verification** - No more manual TXT records. Connect Cloudflare and verify your domain instantly.
• ▸**Auto-fix SPF & DMARC** - Found a missing SPF or DMARC record? Click "Auto-Fix" and we'll create it for you via Cloudflare.
• ▸**Inline auto-fix buttons** - SPF/DMARC findings now show an orange "AUTO-FIX" button right in your scan report.

**How to connect:** Go to Settings > Cloudflare Integration, or look for the Cloudflare tab when verifying a domain.

Your API token is encrypted with AES-256-GCM and never leaves our servers.

Added 9 new legal clauses to our Terms of Service: anti-scraping protection, feedback ownership, class action waiver, force majeure, assignment rights, export control and sanctions compliance, publicity rights, severability, and entire agreement. These additions bring our legal framework in line with industry-leading security platforms and provide stronger protections for both UNPWNED and our users.

New scanning policy page with full transparency on what our scans do, how to identify our scanner, and opt-out options for domain owners. Updated Terms of Service with expanded indemnification and scan risk disclosure. Enhanced scan authorization checkbox with clearer legal language.

Setting up monitoring just got way easier.

• ▸Enable weekly monitoring directly from your scan report - one click, no extra steps.
• ▸Full scan monitoring no longer requires domain verification. Just scan and monitor.
• ▸Deep scan monitoring (cloaking detection, HTTP method testing) still requires verification for legal compliance.
• ▸New scan type selector on the Monitoring page: choose between Full and Deep scan monitoring.

Previously, only 1% of users set up monitoring because it required domain verification first. That barrier is gone for standard scans.

**S3 Scanner Fix:** Eliminated false positives where well-known sites received unrealistically low scores. The scanner no longer reports access-denied (403) cloud storage buckets as security findings - only truly accessible buckets are flagged.

**More accurate results:** Scores now better reflect real security posture. Sites that were previously penalized for non-issues will see improved, more realistic grades.

We're excited to announce UNPWNED 2.0 - our biggest update yet.

Here's what's new:

• ▸Deeper scanning engine - even the standard scan now covers more ground and catches more issues
• ▸Improved stability - faster, more reliable scans across the board
• ▸Stronger platform security - we've hardened our infrastructure to keep your data safe
• ▸Better user experience - smoother flows and refined UI throughout
• ▸New knowledge pages - explore our growing library of security guides and resources

This release wouldn't have been possible without you. Your trust, feedback, and support drive everything we build. Thank you for being part of the UNPWNED community.

We're just getting started.

Your first scan now includes the complete Pro experience - detailed findings, fix instructions, compliance readiness, and PDF export. We also upgraded the PDF report design with improved layout and branding. Rate limit scanner improved with 2-phase detection (parallel warmup + sequential probing), broader header recognition, and smart handling of PWA/SPA sites that use catch-all service workers.

Deep scans now detect SEO spam injection and content cloaking. The scanner compares what your site serves to regular visitors vs search engine crawlers (Googlebot), flags suspicious sitemap counts, and identifies hidden text patterns. Available for verified domains only.

The feedback button is now "Support" - ask questions, report bugs, or share ideas and we'll reply by email. Monitoring is now limited per plan: Pro 5 gets 1 domain, Pro 20 gets 5, and Pro 100 gets 15 (domain + GitHub combined).

Major update: You can now schedule automatic security scans of your GitHub repositories. Get alerts via email, webhooks, and automatic GitHub Issues when secrets, vulnerable dependencies, or exposed config files are detected.

New scanning capabilities:

• ▸Config file detection (sensitive files like .env, credentials, private keys)
• ▸4 new deep scan checks added in V1.6 (CVE fingerprinting, error disclosure, form security, open redirect)
• ▸Deep scan reports now visually distinguished with premium design
• ▸Dashboard improvements: real-time last scan time, issues found counter

GitHub Monitoring is available for Pro users in the Monitoring page.

The deep scan engine just got a major upgrade with 4 new security scanners:

• ▸CVE Fingerprinting — Detects server and library versions, matches them against known CVE vulnerabilities. Now you'll see exactly which CVEs affect your stack.
• ▸Error Disclosure Detection — Probes your error handling for stack traces, database errors, and debug info leaks that expose internal architecture to attackers.
• ▸Form Security Audit — Analyzes HTML forms for missing CSRF tokens, insecure password fields, and unsafe form actions.
• ▸Open Redirect Detection — Tests redirect parameters to find phishing vectors that abuse your domain's trust.

Deep scan now runs 34 security checks (up from 30). Upgrade to Pro to unlock all deep scanners.

Email security checks (SPF, DMARC, DKIM) now correctly resolve to the root domain when scanning subdomains. Previously, scanning a subdomain could incorrectly report missing email records. You can now permanently delete your account and all associated data from Settings - fully GDPR compliant. Text readability improved across all marketing pages.

The platform selection step now remembers your choice - returning users skip straight through with one click. You can also switch the fix prompt tool directly from the results page without re-scanning. Fixed an issue where the Terms checkbox could not be tapped on mobile devices during signup.

Dismiss irrelevant findings from your report (Pro). Partial scan banner now shows how to whitelist the scanner. Cloud bucket detection improved to prevent false positives. Signup honeypot fix for browser autofill. Responsive UI improvements on mobile.

Notification cards now expand in-place to show the full message. View button navigates separately for a better reading experience.

Upgraded scoring algorithm for better accuracy, especially for sites behind firewalls or authentication. Added 5 new scanner checks: CORS, rate limiting, cloud storage, source maps, and cookie security. New security badge designs - gold (A+), silver (A), green (B). All existing reports have been recalculated.

30+ security scanners covering headers, DNS, SSL, CSP, CORS, privacy & compliance. AI-powered analysis with actionable fix instructions. Continuous domain monitoring with real-time alerts. Security badges (A+/A/B) to showcase your security score. PDF reports, GitHub integration, and promo code support.