Fresh from
the kitchen.

Released updates, newest first. Planned features are listed separately below.

October 21, 2026

• Scanner edition 10 adds eight passive response checks: cookie prefix and SameSite validity, browser-policy restrictions for forms, embedded objects and framing, HSTS syntax, password form methods and exposed runtime traces. The catalog now contains 170 conditional check types, including 130 public types. These checks analyze already-fetched responses without submitting forms or triggering errors. Private reports include explanations, retest steps and matching downloads.

October 19, 2026

• Scanner edition 9 catalogs 162 conditional check types, with clearer per-mode counts and coverage. The homepage puts interactive website and Supabase reports first; the video is removed for now and future-alert previews are optional.
• The interactive sample now includes real Supabase before/after results: anonymous access, reads between two test users, and owner-only isolation. Includes matching sample downloads and hand-over previews, with clear limits and synthetic data only.
• Reports now explain impact and how to verify each fix, put priority findings first, and distinguish completed, limited and unassessed coverage. PDFs include a decision brief and a separate optional builder-prompt appendix.
• Added private PDF report downloads with confidence labels, scope, passed checks and coverage notes. Reports now have a compact overview, section links and expandable AI fix prompts.
• Scans, full reports and fix prompts are now permanently free. Builder, Pro and Agency automation plans are previews and are not on sale.
• Findings now distinguish directly observed conditions from possible issues, with a confirmed-only report filter and matching confidence labels in downloads.
• Added a full interactive public sample with real controlled-app scan snapshots, before/after comparison, downloads, a sample fix receipt and a customizable hand-over preview. Refreshed the short scanner video with the Lunchbox test app and current report layout.
• Expanded the compact platform list and added a separate list of AI builders and coding tools. Clarified scan scope and highlighted private reports, fix prompts, cross-user checks and shareable proof.
• Improved report form layout, mobile account fields and decision-control accessibility; fixed missing hand-over report sections and report-decision submissions.
• Firebase evidence privacy. Realtime Database findings omit returned key names and values while recording that an anonymous read succeeded.
• Is one user’s data visible to another? With two test accounts, StackSnack checks whether signed-in users can read each other’s Supabase rows. Test passwords are not saved to reports or our database.
• Self-service database checks. Prove control of Supabase with an owner-created verification function. Firebase checks continue to require separate manual project approval.
• Fix receipts. Share proof that a rescan confirmed a fix, without sharing your report.
• Hand-over reports. A print-ready document with your name and logo for clients.
• What passed. Reports now list the checks your app passed, not just problems.
• New checks: Content-Security-Policy quality, cookie flags, cross-origin access, mixed content, security.txt, email spoofing protection (SPF and DMARC) and TLS certificate expiry.
• Fix prompts for your builder: Lovable, v0, Bolt, Replit, Base44 and Bubble.
• False positives and accepted risks. Mark a finding with a reason. It stays in the report but leaves the adjusted score and monitoring alerts.
• SARIF export for GitHub code scanning, with CWE and OWASP Top 10 tags on findings.
• Clear firewall messages when bot protection blocks the scanner, and a scanner information page.
• Optional email when your report is ready. We delete the address after sending it.
• Fixed: a Firebase app that also used another library’s API key could be told its own public Firebase key was exposed.
• Published a security contact file at /.well-known/security.txt.
• Simpler scan notices on the homepage, with the Terms linked from the scan acknowledgment.

October 18, 2026

• Published the free-testing Terms of Service.
• Added the interactive AI app launch checklist.
• Replaced the homepage slideshow with a capture of the real scanner.
• Turned the Lovable and Supabase pages into practical security tutorials.
• Newsletter signups now need email confirmation.

October 17, 2026

• Reports became private to the browser that created them.
• Added report downloads in JSON, CSV, Markdown and plain text.
• Added known-vulnerable library checks and coverage warnings when a check could not finish.
• Full reports and fix prompts became free during testing.

October 16, 2026

• StackSnack launched: checks for exposed credentials, source maps and security headers, website ownership verification, Supabase and Firebase checks, and rescans after fixes.

Current monitoring plans

Scans, full reports and fix prompts are always free. Builder, Pro and Agency add weekly monitoring when offered for purchase.

When offered for purchase, Builder covers up to three ownership-verified websites, weekly checks, email alerts for new or worsening confirmed high or critical findings, and 90 days of monitoring report history. Pro provides the same monitoring for up to ten ownership-verified websites and 365 days of monitoring report history. Agency, when offered for purchase, includes the Pro monitoring and history features for up to thirty websites across up to thirty owner-managed client workspaces, text and color branded HTML handover reports, and calendar-month client summaries to export and send manually. Client workspaces do not provide client logins or invitations. Website limits apply across the account.

Compare the current plans and website limits ↗.

Next on the menu

Website ownership and backend approval remain separate. These monitoring plans do not include scheduled database or two-account tests, deploy blocking, Slack, API or MCP integrations. Any feature or plan labeled planned remains a preview until offered for purchase. Deploy checks are planned for Builder. If we release them, they will be included in Builder at no extra cost for Builder subscriptions active at that time. We have not set a release date and do not promise one.

Something missing? Tell us what you need.