Fifty phases, in public.
AppScan was built in numbered phases, each one verified before the next one started. This is that list, newest first, with the date each phase was released.
- 12 Sept 2026Phase 50
A platform operator screen behind a role
Operations moved out of shared tokens and into a role: who can see platform-wide state is now an account fact, auditable like everything else.
PlatformSecurity - 9 Sept 2026Phase 49
Runtime and repository screens, separated
A site now keeps what it learned from the live app apart from what it learned from GitHub, so the two stop competing for the same page.
App - 3 Sept 2026Phase 48
Unfinished security, weak crypto, logged secrets, leaked internals
Four new source rules: the auth TODO nobody came back to, a weak primitive, a secret written to logs, and a stack trace returned to the caller.
RulesSource - 30 Aug 2026Phase 47
Scheduled audit-log exports
The audit trail can now leave on a schedule rather than only when somebody remembers to click export.
Audit - 28 Aug 2026Phase 46
Audit trail streaming to a SIEM
For teams that already have somewhere central to put security events, the trail can be streamed there as it is written.
AuditIntegrations - 25 Aug 2026Phase 45
A scanner that actually finds something
The signed-out pages got a hero that runs a real scan animation: a shield, a sweep, and detections tied to the line that found them.
Design - 20 Aug 2026Phase 44
Split-layout signed-out pages
Log in, register and recovery share one layout, with a loading indicator that reads as measurement rather than as a spinner.
Design - 18 Aug 2026Phase 43
Wait out holding pages, show the stack
Sites that answer with an interstitial are given time to settle before conclusions are drawn, and the detected stack appears on the site overview.
Scanning - 14 Aug 2026Phase 42
Pagination, .txt exports and wider detection
Fixed runaway pagination, added plain-text exports, and widened technology detection to more of what people actually deploy.
AppScanning - 11 Aug 2026Phase 41
A scan says what each step looked at
Every step now records its own coverage, so “we checked headers” became “here is what we read, and here is what we could not”.
Scanning - 9 Aug 2026Phase 40
Each AI task routed to the model it needs
Classification goes to the cheap model, a critical judgement is escalated, and the router explains its choice in the usage record.
AICost - 6 Aug 2026Phase 39
On-demand deep scan and deep review
Read the whole application at once, priced up front, kept afterwards so you never pay twice for the same judgement.
AI - 31 Jul 2026Phase 38
Fix with AI opens a draft pull request
A fix stopped being advice. The patch is written against your file and arrives on a branch as a draft for review.
AIGitHub - 27 Jul 2026Phase 37
Server-side sorting and search for issues
Issue lists and change-set diffs are sorted, searched and paged by the server, so a busy repository stays usable.
App - 25 Jul 2026Phase 36
Pagination everywhere, visible background work
Long lists page properly and work happening in the background is shown while it happens rather than after.
App - 22 Jul 2026Phase 35
Complimentary plans, operator only
A plan can be granted without a payment - for a partner or a case we want to support - and the grant is recorded.
Billing - 17 Jul 2026Phase 34
A free trial, once per organization
Fourteen days of Pro with no card. It ends by itself, and nothing is charged when it does.
Billing - 15 Jul 2026Phase 33
Refunds and disputes with credit clawback
When money goes back, the credits it bought go back with it. The ledger stays honest in both directions.
Billing - 11 Jul 2026Phase 32
Commit-message secrets and personal-data classification
Secrets pasted into commit messages are caught, and probe results say when what came back was personal data.
RulesPrivacy - 8 Jul 2026Phase 31
WebSocket runtime analysis
Insecure sockets, credentials in socket URLs, reconnect loops and chatter, all observed in a real browser.
RulesBrowser - 6 Jul 2026Phase 30
Per-user notification preferences
Each person narrows what reaches them on top of the organization setting, instead of muting everything.
Notifications - 3 Jul 2026Phase 29
GitHub Actions workflow analysis
Untrusted checkouts, script injection, over-permissioned tokens and unpinned actions - the pipeline is attack surface too.
RulesInfrastructure - 27 Jun 2026Phase 28
Report PDF export
A report you can hand to a client or attach to a security questionnaire without editing it first.
Reports - 23 Jun 2026Phase 27
Core Web Vitals and the request waterfall
Performance became measurable per route, with a waterfall that shows where the serial time actually goes.
RulesPerformance - 21 Jun 2026Phase 26
Application redesign
Grouped navigation, per-site sections and a screen for each thing you might want to check, behind a lint gate.
Design - 18 Jun 2026Phase 25
Cold load versus client navigation
The browser pass records both, because a single-page app misbehaves in ways a cold load never shows.
Browser - 13 Jun 2026Phase 24
Two-factor authentication
TOTP with recovery codes and a proper login challenge.
Security - 11 Jun 2026Phase 23
Authenticated scan stream
Live progress inside the app, over tokens bound to a single scan rather than to your session.
AppSecurity - 7 Jun 2026Phase 22
Runtime and source correlated
One problem became one finding: the code finding is canonical and the live observation rides along as proof.
Findings - 4 Jun 2026Phase 21
Permissions-Policy, COOP and CORP
Isolation headers joined the header rules, judged on quality rather than presence.
Rules - 2 Jun 2026Phase 20
Docker and infrastructure analysis
Dockerfile, Compose, nginx, Kubernetes and Terraform: the files that decide how the app is really exposed.
RulesInfrastructure - 30 May 2026Phase 19
Live scan progress over SSE
The landing page stopped being a form that waits and became a scan you can watch.
Scanning - 24 May 2026Phase 18
Free network pass and an access-control probe
One page recorded in a real browser, provider-agnostic network rules, and a read-only probe that proves world-readable data APIs.
ScanningRules - 20 May 2026Phase 17
Prometheus metrics
API and worker expose scrape endpoints: HTTP, jobs, queues, GitHub, AI spend and scan outcomes.
Operations - 18 May 2026Phase 16
Bounded git history secret scan
History is walked once after inventory, recorded as scanned-through, and rotate-and-purge findings are raised for what it finds.
RulesSource - 15 May 2026Phase 15
Security invariants
The rules your code already follows are derived, persisted, reconciled on pushes and checked on pull requests.
FindingsSource - 10 May 2026Phase 14
Injection, SSRF and upload rules from taint analysis
Request input is tracked through the code to the sink it reaches, instead of matching on dangerous-looking names.
RulesSource - 8 May 2026Phase 13
Runtime performance rules
Duplicate requests, N+1, storms, third-party weight, render-blocking scripts, uncached assets, oversized images, failures.
RulesPerformance - 4 May 2026Phase 12
Audit log and exports
An append-only trail with a screen of its own, plus CSV, Markdown and JSON exports of reports and findings.
AuditReports - 1 May 2026Phase 11
Grouped alerts, digests and Slack
Instant when it matters, grouped and cooled down so one bad deploy is one message; a digest for everything else.
Notifications - 29 Apr 2026Phase 10
Pull request verdicts as check runs
The verdict is posted where the review already happens, not in a second place nobody opens.
GitHub - 26 Apr 2026Phase 9
App overview and per-site health
One read model that answers “is my app safe right now” without opening anything else.
App - 20 Apr 2026Phase 8
Pull request checks and regression detection
NEW versus UNCHANGED verdicts, security regressions raised on their own, runtime confirmation of code findings.
GitHubFindings - 16 Apr 2026Phase 7
Teams, invitations and roles
Owner, admin, member and viewer, with email verification, password reset and change.
Accounts - 14 Apr 2026Phase 6
Headless Chromium runtime stage
Route discovery and clustering, timings and baselines, mixed content, insecure forms, JavaScript errors, rate-limit observation.
Browser - 11 Apr 2026Phase 5
Billing behind a port
Stripe with signed idempotent webhooks, normalized subscription state, and a credit ledger wired into manual scans.
Billing - 6 Apr 2026Phase 4
The AI gateway
Explanations and fixes behind one gateway with budgets, an adapter per provider, and a mock provider as the default.
AICost - 4 Apr 2026Phase 3
Application Brain and source analyzers
Facts and a profile per application, TypeScript analyzers, and advisories re-evaluated daily against what you actually use.
SourceFindings - 31 Mar 2026Phase 2
GitHub App and change sets
Webhook ingress, push coalescing, change-set analysis and repository inventory.
GitHub - 28 Mar 2026Phase 1
The free scan, end to end
A walking skeleton with tenancy, the cost firewall and scanner safety in place from the first line rather than added later.
ScanningPlatform
Everything on this list is running right now.
Nothing here is a roadmap item. Point the free scan at your app and you are using all of it.