September 9, 2026 — Deeper secret detection
Repository scans now inspect a bounded set of removed lines from the newest default-branch commits, separately from the current source tree. Credential values remain redacted, and incomplete history coverage is clearly marked as capped.
August 24, 2026 — Introducing securePilot
securePilot brings repository, Firebase, and passive application security checks into one daily monitoring view. Findings include severity, evidence, the affected asset, and a recommended next action.
- Secret, dependency, supply-chain, and secure-code checks for connected GitHub repositories
- Authentication, Firestore, Storage, and configuration posture for connected Firebase projects
- TLS, DNS, security-header, exposed-file, and redacted same-origin JavaScript credential checks for approved public application URLs
- Daily scheduled checks and focused email alerts when risk appears or returns
Teams and client access
Workspace roles keep each app’s findings limited to assigned members. Client viewers can review assigned apps without seeing other customer work, and ownership remains locked to the creator who authorized the workspace connections.
Plans from one to thirty apps
Starter includes three connections, Team includes fifteen, and Studio includes sixty. Each GitHub repository, cloud project, or public website counts as one connection. Every plan includes the same core GitHub, Firebase, passive web, and alert coverage; plan differences are based primarily on capacity and collaboration.