# Changelog of SiteVerdict — Passive Website Security Scanner (`siteverdict/siteverdict-passive-security-scanner`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-passive-security-scanner/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-passive-security-scanner.md

## Changelog

### 1.1 (2 Nov 2026)

- Billing: a site that cannot be fetched (DNS failure, refused, timeout) is now a free row (status `unreachable`); no AI fix is generated for it.
- Unreachable sites get `status: "unreachable"`, `grade: null`, `score: null` instead of a letter grade, and no "HTTPS not available" finding when nothing answered. They no longer overwrite the monitoring snapshot, so an outage does not report every earlier finding as "resolved".
- TLS: ECDSA certificates are no longer reported as "Weak certificate key (256 bits)" on TLS 1.3 (key type now read from the certificate, `tls.certificate.keyType`).
- A run whose budget exactly covers all sites no longer reports `stoppedAtChargeLimit: true`; the run stops before scanning a site it cannot afford.
- User-Agent and README contact now use hello@webrevenuescan.com. TLS handshakes refuse private/reserved IP literals directly (defence in depth).
- Budget stop is reported honestly: every site not scanned because the max total charge was reached gets a free row (`status: "skipped_budget"`, `charged: false`, no grade); OUTPUT has `notScannedBudget`; the status message adds "N not scanned (max total charge reached)".
- Accurate row status for every target: `scanned`, `tls-invalid` (certificate failed validation: expired, self-signed, wrong host; certificate findings reported, `httpChecksRan: false`, free), `unreachable` (DNS/refused/timeout), `refused` (private/loopback/metadata/reserved input, DNS answer or redirect; refused inputs now get a free row instead of only a warning), `skipped_budget`. OUTPUT adds `tlsInvalid` and `refused`; the status message names every non-zero count, so "0 errors" never hides unsuccessful checks.
- Dependencies: follow-redirects pinned to 1.16.2 via `overrides` (patch bump; fixes high advisory GHSA-mrwp-f3q8-3g9p, transitive via apify-client/axios). `.actor/actor.json` version 1.1.

### 1.0.3 (15 Oct 2026)

- Pre-filled form (example.org, no authorisation tick) now returns the free, clearly labelled sample (simulated fictional sites, no network) instead of failing. Real sites without the tick are still refused.
- Sample mode now always reports on the fictional sample sites only, so simulated findings are never shown against a real domain.
- Rows carry `isSampleData`; sample status messages start with SAMPLE DATA; nothing is charged in sample mode.

### 1.0.0 — 2026-10-11

- First release.
- Passive checks: TLS (protocol, cipher, certificate expiry/trust/hostname/key, TLS 1.0/1.1 acceptance), HTTP→HTTPS, security headers, CSP analysis, cookie flags, mixed content, insecure forms, SRI, version disclosure, security.txt.
- Outdated JS libraries via the Retire.js repository (Apache-2.0, bundled trimmed copy): URL, filename and file-banner matching.
- Exposed files (fixed list, one GET each, strict signatures, contents never output) and directory listing; robots.txt respected by default.
- Grade A+ to F with fixes (nginx/Apache snippets), HTML report per site in the key-value store.
- Monitoring (new/resolved findings, grade and certificate changes, onlyChanged), Slack/webhook alerts, optional AI fix snippets on the user's Anthropic key.
- SSRF guard on input, every redirect and at connect time; authorisation tick required.
- Pay-per-event: site-scanned, ai-fix. Sample mode with two simulated fictional sites.