# Changelog of Website Tech Stack Detector (Bulk) · SiteVerdict (`siteverdict/siteverdict-tech-stack-detector`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-tech-stack-detector/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-tech-stack-detector.md

## Changelog

### Unreleased (prepared 2026-10-15, NOT pushed) — Private-network (SSRF) protection

- Target sites, robots.txt, extra pages, the `csvUrl` download, job-board lookups, the TLS probe, alert webhooks and every browser request now refuse private, loopback, link-local, CGNAT, multicast, reserved and cloud-metadata destinations (169.254.169.254, metadata.google.internal, fd00:ec2::254 ...), internal names (localhost, \*.local, \*.internal, single-label names) and every IP encoding (decimal / octal / hex / IPv4-mapped IPv6 / NAT64 / 6to4). Every redirect hop is re-checked; DNS answers are checked at connect time and the connection is made to exactly the checked address (rebinding-safe).
- A refused target gets a row with status `error` and error "refused: private-network protection; not charged" (no DNS, TLS or HTTP request is made; not charged). A refused `csvUrl` is skipped with a warning; a refused webhook disables alerts.
- Browser mode routes all Chromium traffic through a local checking proxy ('<-loopback>' so localhost is checked too).
- New RUN_SUMMARY fields: `refusedPrivateTargets`, `privateNetworkRequestsBlocked`. No change to inputs, pricing or the other output fields.

### Memory default (15 Oct 2026)

- 15 Oct 2026 (build after this entry): default run memory is now 1024 MB via `defaultMemoryMbytes` (the old defaultRunOptions 1024 MB was ignored so runs used 4096 MB; peak 249-308 MB). Measured on the example input: same output, see the public-15 remediation log. You can still choose more memory per run. No change to inputs, outputs or pricing.

### 1.1 (2026-10-11) — Sales lead signals

**Accuracy (30-site hand-verified benchmark, see BENCHMARK.md)**

- **False positives:** all 21 v1.0 false positives fixed. Precision went from 97.0% to 100% in HTTP mode and from 97.4% to 100% in browser mode.
- **Recall:** HTTP mode went from 76.1% to 86.5%, browser mode from 89.4% to 99.8%.
- **Versions:** 21 of 21 correct (was 18 of 21).
- **Fixes:**
  - GitHub Pages no longer triggers on `x-github-request-id` alone.
  - A link to an integration page no longer counts as Squarespace Commerce.
  - `vali.email` is now Valimail, not Proofpoint.
  - The Inertia SSR marker no longer counts as Vue.
  - `s0.wp.com` alone no longer counts as WordPress.com hosting.
  - An `MS=` TXT token is now "Microsoft 365 tenant (DNS verified)", not an email provider.

**Signatures**

- The set grows from 1,039 to **1,112 signatures in 77 categories**: 26 recruiting/ATS platforms and 14 new DNS verification tokens (Anthropic, HackerOne, Twilio, LiveRamp, SpyCloud, Mixpanel, Amazon SES, Fastly…).
- Also new or widened:
  - **email infrastructure:** Broadcom/MessageLabs, Cloudflare Email Security, HEY, Oracle Email Delivery, NetSuite;
  - **frameworks and hosting:** Statamic, Payload CMS, Laravel Cloud, Granian, Turbopack, Inertia/Vite builds;
  - **CMPs:** HubSpot and Shopify cookie banners, Sourcepoint on first-party hosts;
  - **WordPress/Joomla/Shopify add-ons:** Gutenberg, WPConsent, Perfmatters, Regular Labs, Redo, Ordergroove, Minmaxify.
- New signal type: outbound tenant links, for example `jobs.lever.co/acme` or `calendly.com/acme`. Links to a vendor's own marketing pages are ignored.
- Signatures with the same name now merge, so add-on files can extend a signature.

**Sales intelligence (new)**

- **Lead score 0-100 for your offer, with reasons.** The score adds up fit, need (category gaps and competitor displacement), budget and intent. There are 10 presets, and you can supply a custom offer as JSON. `minLeadScore` filters the output.
- **Spend tier.** An indicative list-price band from about 240 priced tools.
- **Hiring signals.** We find the careers page, then read the public Greenhouse, Lever or Ashby job-board API. You get open roles by function and the tools named in job ads. Event: `hiring-signals`.
- **Company details from the site itself:** UK company number, VAT number, schema.org organisation data and company social pages.
- **Optional Companies House record** with your own free key: status, incorporation date, SIC codes, accounts type and registered office. Matching uses the company number from the site, or an exact name match only. No officers are fetched. Event: `company-enriched`.
- **Monitor buying signals.** For example "Switched Email marketing: Mailchimp → Klaviyo", "Started using …" or "Stopped using … (open slot)". Alerts go to Slack or a webhook (HTTPS only; secrets are never logged).
- **Optional AI outreach angle.** One factual sentence per good prospect, written with your own Anthropic or OpenAI key. The default model is `claude-opus-5-5`, with a server-side refusal fallback. Nothing is sent to prospects. Event: `ai-outreach-angle`.
- **New exports:**

  - LEADS.csv (ranked);
  - HUBSPOT_COMPANIES.csv (HubSpot Companies import);
  - REPORT (self-contained HTML);
  - AGENT_SUMMARY (JSON for agents);
  - a "Prospects" dataset view.

  All CSVs are formula-injection safe.

**Personal data:** OFF. Individual emails, phone numbers, officers and personal social profiles are never output.

### 1.0 (2026-10-11)

- First release.
- Original SiteVerdict signature set 2026.10.11: 1,040 technologies in 76 categories. It is not derived from Wappalyzer or its forks.
- **Signals:**
  - HTML and generator meta tags;
  - script, link, iframe, img and form URLs;
  - inline scripts;
  - HTTP headers and cookie names;
  - global JS variables (browser mode);
  - MX, SPF includes, TXT verification tokens, the DMARC reporting address, NS and the CNAME chain;
  - the TLS issuer;
  - robots.txt.
- **Modes:** fast HTTP (`site-detected`) and Playwright browser (`site-detected-browser`).
- **Bulk input:** a domain/URL list, startUrls, a pasted CSV, a CSV URL or an Apify dataset, with the column or field auto-detected.
- **Filters:** only sites using X, categories, AND/OR, and exclude.
- **Monitor mode:** a per-site diff of technologies added, removed and version-changed, kept in the named KV store `siteverdict-tech-monitor`.
- **Outputs:** overview, flat technologies, changes and errors dataset views; `SITES_BY_TECH` (JSON and CSV), `TECHS_FLAT.csv` and `RUN_SUMMARY`.
- robots.txt is respected and bot-challenge pages are detected. Blocked sites, errors, empty results and filtered-out sites are never charged.