Billing: a site that cannot be fetched (DNS failure, refused, timeout) is now a free row (status unreachable); no AI fix is generated for it.
Unreachable sites get status: "unreachable", grade: null, score: null instead of a letter grade, and no "HTTPS not available" finding when nothing answered. They no longer overwrite the monitoring snapshot, so an outage does not report every earlier finding as "resolved".
TLS: ECDSA certificates are no longer reported as "Weak certificate key (256 bits)" on TLS 1.3 (key type now read from the certificate, tls.certificate.keyType).
A run whose budget exactly covers all sites no longer reports stoppedAtChargeLimit: true; the run stops before scanning a site it cannot afford.
User-Agent and README contact now use hello@webrevenuescan.com. TLS handshakes refuse private/reserved IP literals directly (defence in depth).
Budget stop is reported honestly: every site not scanned because the max total charge was reached gets a free row (status: "skipped_budget", charged: false, no grade); OUTPUT has notScannedBudget; the status message adds "N not scanned (max total charge reached)".
Accurate row status for every target: scanned, tls-invalid (certificate failed validation: expired, self-signed, wrong host; certificate findings reported, httpChecksRan: false, free), unreachable (DNS/refused/timeout), refused (private/loopback/metadata/reserved input, DNS answer or redirect; refused inputs now get a free row instead of only a warning), skipped_budget. OUTPUT adds tlsInvalid and refused; the status message names every non-zero count, so "0 errors" never hides unsuccessful checks.
Dependencies: follow-redirects pinned to 1.16.2 via overrides (patch bump; fixes high advisory GHSA-mrwp-f3q8-3g9p, transitive via apify-client/axios). .actor/actor.json version 1.1.
1.0.3 (15 Oct 2026)
Pre-filled form (example.org, no authorisation tick) now returns the free, clearly labelled sample (simulated fictional sites, no network) instead of failing. Real sites without the tick are still refused.
Sample mode now always reports on the fictional sample sites only, so simulated findings are never shown against a real domain.
Rows carry isSampleData; sample status messages start with SAMPLE DATA; nothing is charged in sample mode.
Outdated JS libraries via the Retire.js repository (Apache-2.0, bundled trimmed copy): URL, filename and file-banner matching.
Exposed files (fixed list, one GET each, strict signatures, contents never output) and directory listing; robots.txt respected by default.
Grade A+ to F with fixes (nginx/Apache snippets), HTML report per site in the key-value store.
Monitoring (new/resolved findings, grade and certificate changes, onlyChanged), Slack/webhook alerts, optional AI fix snippets on the user's Anthropic key.
SSRF guard on input, every redirect and at connect time; authorisation tick required.
Pay-per-event: site-scanned, ai-fix. Sample mode with two simulated fictional sites.
