Changelog
What's changed at detektd, day by day - the site and the scan engine.
One shared nav across the site and its subdomains
The main site, the help center (support.detektd.com) and the news section (news.detektd.com) now share one navigation, with dropdown menus into each section's categories. News got its own category pages, and both sections got a design pass (per-category visual identity, less generic article covers).
News section launches, help articles rewritten
New section covering cybersecurity and "vibecoding" (AI-written code). Help center articles were rewritten with real technical depth (exact formats, code examples) instead of generic prose. Infrastructure bumped to Node.js 24.
The help center goes live
support.detektd.com launched: help articles and a contact form. The dashboard now shows a real progress bar while a scan runs (the actual count of checks completed out of the total), not a generic animation.
Every fix is now bilingual
Explanations and fixes for nearly all 190 checks are now written in both French and English (rather than defaulting to English), with the browser's language auto-detected. The dashboard shows live scan progress. New checks: account enumeration, unrestricted file upload, exposed Redis/Memcached/RabbitMQ.
A livelier dashboard, Settings reorganized
Micro-interactions added to the sidebar and scan panels. The Settings page was reorganized around what an account actually has. Security fixes: two-factor being wrongly requested for accounts that never enabled it, and a risk of accidentally signing yourself out while closing other sessions.
The scan goes easier on fragile sites
Request pacing now adapts to the target site's latency, to go easier on small infrastructure. New check: an overly permissive SPF record (one that lets anyone send email as the domain).
AI and crypto-focused checks
New checks around AI features shipped in the app (prompt injection, leaked system prompts and agent tool schemas) and crypto (exposed private keys, Bitcoin/Solana wallets shipped to the browser). Also added CSRF/GraphQL bypass checks and browser-confirmed clickjacking.
Secret scanning now covers JS errors too
The scan for secrets leaked into the browser console now also captures uncaught JavaScript errors, not just deliberate log messages.
20+ new active checks in one day
A big expansion of the active scan: SQL/NoSQL/SSTI injection, JWT signature forgery, function-level authorization bypass, session fixation, tokens leaking into URLs, user enumeration, and more.
The active scan now drives a real browser
Active mode now drives a headless browser (renders single-page apps, confirms XSS for real), and handles login across a much wider range of sites (two-factor auth, CAPTCHA detected and reported clearly, GDPR consent banners, Google/GitHub-only login). The dashboard's score is now a single unified number.
One-click billing, active mode per scan
You can now cancel or resume your subscription right in the app, no Stripe portal round-trip. Active mode becomes a per-scan choice instead of a global setting, with an "allow our IP" panel shown before your first scan so your firewall doesn't block it.
A blocked scan now fails cleanly
A scan your firewall blocks no longer shows a result that could look clean - it's now marked explicitly "blocked". Low- and info-severity findings are now shown in the report breakdown, not just critical and high.
Stripe setup adjustment
A small configuration fix following the removal of an old pricing tier.
The scan engine moves to a single flow
Supabase is no longer a special case - it's one module among others in a single scan flow, which guarantees a complete report on any stack. New checks: abandoned-subdomain takeover, reflected XSS, exposed private keys, and about a dozen more.
AWS key and build-manifest exposure checks
New checks: an exposed AWS AppSync key in Amplify config, publicly reachable Next.js build manifests, admin dashboards (Bull Board) left open.
Exposed vector databases and dashboards
New checks: publicly reachable vector databases, open Grafana dashboards, data leaks on Qwik apps, a dev server exposed in production.
A deep reorganization of the scan engine
The scan engine was rewritten for reliability (correct quotas, reliable alerts, non-blocking DNS). A site with no Supabase now gets an equally complete report, with the detected stack shown as proof of what was actually checked.
Checks for recent, specific CVEs
New checks targeting specific, recent CVEs (Next.js, Vite, the React2Shell CVE), plus the surface exposed by no-code AI tooling (agents, MCP endpoints, workflow builders like n8n).
Automatic tech-stack detection
The scan now detects the target app's tech stack and adapts its coverage accordingly. Dozens of new checks were added (public S3/GCS buckets, exposed admin keys, recent CVEs). Plans were renamed "Scan" and "Scan Pro".
The scan now crawls the whole site
The scan now crawls the entire target site, with adaptive rather than fixed request pacing. New checks: dependencies with known vulnerabilities, leaked AI provider keys, missing SPF/DMARC/TLS headers.
New pricing, wider Supabase coverage
The Starter plan was dropped in favor of a one-time €19 detailed report; the free plan allows 1 scan per week. A big pass on Supabase coverage: deeper RLS findings, exposed third-party keys, unprotected GraphQL reads, and a hardened active scan.
Dashboard redesign
The dashboard was rebuilt around a real sidebar and a consistent card system, with an animated background and unified typography (Mona Sans). A full pass on the mobile layout too.
A real type system and hand-drawn icons
The whole site moved to a unified type system, and generic stock icons were replaced with hand-drawn ones. Scan findings are now shown as a table. Mobile fixes (navigation, tap targets).
The dashboard swaps a dropdown for an app rail
The app list moves from a dropdown into an always-visible rail, with a summary of your whole fleet of apps.
A full visual redesign
detektd's whole look changes: the landing page, dashboard, login and settings were rebuilt as real React components on a Tailwind v4 + Radix foundation. The pricing page was rebuilt too.
Audit: billing and accessibility
An internal audit fixed Pro features that were billed but not actually delivered, dead navigation buttons, and several accessibility issues.
Scan / Active scan tabs
The dashboard now separates passive and active results into two tabs, with a persistent banner when a scan fails. A failed scan no longer counts against your quota.
Stability fixes
Fixes to dashboard loading and bot-protection (CSP), and to the Stripe configuration.
Where detektd began
The first commit of both the scanner and the site. Everything else in this log was built from here.