# Changelog of SiteVerdict — Agency Lead Finder: score local business websites (`siteverdict/siteverdict-agency-lead-finder`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-agency-lead-finder/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-agency-lead-finder.md

## Changelog

### 1.1.9 (2026-10-16) — Proxy input security

- **Security: proxy input.** Only the proxy settings the input form offers are accepted: Apify Proxy, or custom proxy URLs starting with `http://` or `https://`. Other proxy options (for example `tieredProxyUrls`) and SOCKS proxies are refused before anything is loaded, with a clear message; nothing is charged. Previously a proxy given as `tieredProxyUrls` skipped the private-network check.
- **Security: https proxies.** A custom `https://` proxy is now connected to over TLS (certificate checked, default port 443), so your proxy password is never sent in clear text.
- Only Apify's own proxy host is trusted without a check (was: any `*.apify.com` name). Redirects followed by the built-in HTTP client no longer carry credentials to another site.
- No change to outputs or pricing.
- The user agent now points to this Actor's public Apify Store page instead of an e-mail address (bot name unchanged).

### 1.1.6 (2026-10-15) — Private-network (SSRF) protection

- Websites, `fileUrl` downloads, robots.txt / sitemap / link checks, the TLS probe and every browser request now refuse private, loopback, link-local, CGNAT, multicast, reserved and cloud-metadata destinations (169.254.169.254, metadata.google.internal, fd00:ec2::254 ...), internal names (localhost, \*.local, \*.internal, single-label names) and every IP encoding (decimal / octal / hex / IPv4-mapped IPv6 / NAT64 / 6to4). Every redirect hop is re-checked. DNS answers are checked at connect time and the connection is made to exactly the checked address (rebinding-safe).
- Refused websites get a `scan-failed` row whose note starts with "refused: private-network protection; not charged"; they are not loaded and not charged. A refused `fileUrl` fails the run before anything is scanned (nothing charged).
- All Playwright traffic (browser and HTTP client) goes through a local checking proxy. With Apify Proxy or custom proxies the checking proxy chains to the customer proxy; custom proxy URLs must themselves point at a public host.
- New SUMMARY fields: `refusedPrivateTargets`, `privateNetworkRequestsBlocked`. No change to inputs, pricing or the other output fields.

### Memory default (15 Oct 2026)

- 15 Oct 2026 (build after this entry): default run memory is now 2048 MB via `defaultMemoryMbytes` (was 4096 MB; peak 225-393 MB). Measured on the example input: same output, see the public-15 remediation log. You can still choose more memory per run. No change to inputs, outputs or pricing.

### 1.1 (2026-10-11)

**Accuracy.** We ran a 200-fact benchmark on 20 real Plymouth businesses against independent curl/dig/openssl ground truth. Results are now 100% correct with 0 false findings in both modes (see BENCHMARK.md).

Tiny hosting error pages served with HTTP 200, such as "Error. Page cannot be displayed", are now reported as `website-down`. They used to be scored as if they were the site, which produced wrong findings.

**Personal data off by default.**

- The new `includeBusinessPhone` input defaults to false. When it is off, phone numbers are removed from the output, from `original`, from the CSV and from the HubSpot file, and only `hasPhone` is kept.
- `original` also drops email, reviewer, owner and personal social fields.
- Emails are never collected.

**`targetService` + `onlyTargetService`.** Re-rank leads by the one service you sell, with a plain-English reason. Leads without an opportunity for that service can be skipped, and are not charged.

**Company details:**

- **From the site itself:** UK company number, VAT number, schema.org organisation data and company social pages.
- **From Companies House (optional, your own free key):** status, incorporation date, SIC codes, accounts type and registered office. Matching uses the number on the site, or an exact name match only. No officers are fetched.
- New event: `company-enriched`.

**AI pitch (optional).** One factual opening line per good lead, built from its measured issues, using your own Anthropic or OpenAI key. The default model is `claude-opus-5-5`. Use `aiMinLeadScore` and `aiMaxLeads` to cap spend. New event: `ai-pitch`.

**Exports:**

- New: `HUBSPOT_COMPANIES.csv`, a HubSpot Companies import file.
- New `LEADS.csv` columns: hasPhone, targetService, aiPitch, companyNumber, companyStatus, incorporatedOn, sicCodes, linkedinCompany.

**User-Agent.** Now `SiteVerdictLeadFinder/1.1 (+aman.thakran@bharatfare.com; website audit)`.

### 1.0 (2026-10-11)

First release.

- Inputs: Google Maps Scraper dataset ID or run ID (read through the Apify API), CSV / JSON / JSON Lines / URL-list file URL, JSON list of businesses, or plain website URLs. Automatic field mapping (`title`, `website`, `phone`, `categoryName`, `city`, `address`, `totalScore`, `reviewsCount`, closed flags and common CSV header variants). The Google Maps place URL is never used as the website.
- Filters: categories, cities, minimum reviews, minimum rating, with / without website, skip closed businesses.
- Full mode: one real mobile Chrome load per site (Fast 4G + 2x CPU): LCP, CLS with culprit elements, TBT, page weight, image savings, dead clicks, tap targets, tracking hits, cookies set before consent, consent tool (CMP) and visible cookie banner detection. Falls back to the browser when a host refuses the plain HTTP client.
- Quick mode: HTTP, TLS and DNS only (no browser) for large lists.
- Checks for every site: HTTPS and certificate expiry, HTTP to HTTPS redirect, robots.txt (Google, Bing and AI search crawlers), XML sitemap, contact page and up to 5 homepage links, SPF / DMARC / MX, SEO basics, LocalBusiness schema, outdated WordPress / jQuery / PHP, stale copyright year, parked domains, accessibility basics.
- No-website, social-only (Facebook, Instagram, Linktree...), directory-only and free-builder-subdomain leads.
- Lead score 0-100 (opportunity 0-70 + activity 0-30), tiers A-D, per-service opportunity flags, top 3 plain-English pitch points with evidence and a measured / estimated confidence flag.
- Outputs: dataset with 4 views, ranked `LEADS.csv` (formula-injection safe), HTML `REPORT`, `SUMMARY` JSON, optional mobile screenshots.
- Pay per event: `business-scored`, `business-quick-scored`, `no-website-lead`. Duplicates, blocked and failed scans are never charged; the maximum total charge per run is respected. State survives platform migrations without re-scanning or re-charging.