What's changed at detektd, day by day: the site and the scan engine.
0updatessince 26 Jul 2026
2026 · 22 updates
The main site, the help center (support.detektd.com) and the news section (news.detektd.com) now share one navigation, with dropdown menus into each section's categories. News got its own category pages, and both sections got a design pass (per-category visual identity, less generic article covers).
New section covering cybersecurity and "vibecoding" (AI-written code). Help center articles were rewritten with real technical depth (exact formats, code examples) instead of generic prose. Infrastructure bumped to Node.js 24.
support.detektd.com launched: help articles and a contact form. The dashboard now shows a real progress bar while a scan runs (the actual count of checks completed out of the total), not a generic animation.
Explanations and fixes for nearly all 190 checks are now written in both French and English (rather than defaulting to English), with the browser's language auto-detected. The dashboard shows live scan progress. New checks: account enumeration, unrestricted file upload, exposed Redis/Memcached/RabbitMQ.
Micro-interactions added to the sidebar and scan panels. The Settings page was reorganized around what an account actually has. Security fixes: two-factor being wrongly requested for accounts that never enabled it, and a risk of accidentally signing yourself out while closing other sessions.
Request pacing now adapts to the target site's latency, to go easier on small infrastructure. New check: an overly permissive SPF record (one that lets anyone send email as the domain).
New checks around AI features shipped in the app (prompt injection, leaked system prompts and agent tool schemas) and crypto (exposed private keys, Bitcoin/Solana wallets shipped to the browser). Also added CSRF/GraphQL bypass checks and browser-confirmed clickjacking.
The scan for secrets leaked into the browser console now also captures uncaught JavaScript errors, not just deliberate log messages.
A big expansion of the active scan: SQL/NoSQL/SSTI injection, JWT signature forgery, function-level authorization bypass, session fixation, tokens leaking into URLs, user enumeration, and more.
Active mode now drives a headless browser (renders single-page apps, confirms XSS for real), and handles login across a much wider range of sites (two-factor auth, CAPTCHA detected and reported clearly, GDPR consent banners, Google/GitHub-only login). The dashboard's score is now a single unified number.
You can now cancel or resume your subscription right in the app, no Stripe portal round-trip. Active mode becomes a per-scan choice instead of a global setting, with an "allow our IP" panel shown before your first scan so your firewall doesn't block it.
A scan your firewall blocks no longer shows a result that could look clean: it's now marked explicitly "blocked". Low- and info-severity findings are now shown in the report breakdown, not just critical and high.
A small configuration fix following the removal of an old pricing tier.
Supabase is no longer a special case: it's one module among others in a single scan flow, which guarantees a complete report on any stack. New checks: abandoned-subdomain takeover, reflected XSS, exposed private keys, and about a dozen more.
New checks: an exposed AWS AppSync key in Amplify config, publicly reachable Next.js build manifests, admin dashboards (Bull Board) left open.
New checks: publicly reachable vector databases, open Grafana dashboards, data leaks on Qwik apps, a dev server exposed in production.
The scan engine was rewritten for reliability (correct quotas, reliable alerts, non-blocking DNS). A site with no Supabase now gets an equally complete report, with the detected stack shown as proof of what was actually checked.
New checks targeting specific, recent CVEs (Next.js, Vite, the React2Shell CVE), plus the surface exposed by no-code AI tooling (agents, MCP endpoints, workflow builders like n8n).
The scan now detects the target app's tech stack and adapts its coverage accordingly. Dozens of new checks were added (public S3/GCS buckets, exposed admin keys, recent CVEs). Plans were renamed "Scan" and "Scan Pro".
The scan now crawls the entire target site, with adaptive rather than fixed request pacing. New checks: dependencies with known vulnerabilities, leaked AI provider keys, missing SPF/DMARC/TLS headers.
The Starter plan was dropped in favor of a one-time €19 detailed report; the free plan allows 1 scan per week. A big pass on Supabase coverage: deeper RLS findings, exposed third-party keys, unprotected GraphQL reads, and a hardened active scan.
The dashboard was rebuilt around a real sidebar and a consistent card system, with an animated background and unified typography (Mona Sans). A full pass on the mobile layout too.
2026 · 4 updates
The whole site moved to a unified type system, and generic stock icons were replaced with hand-drawn ones. Scan findings are now shown as a table. Mobile fixes (navigation, tap targets).
The app list moves from a dropdown into an always-visible rail, with a summary of your whole fleet of apps.
detektd's whole look changes: the landing page, dashboard, login and settings were rebuilt as real React components on a Tailwind v4 + Radix foundation. The pricing page was rebuilt too.
An internal audit fixed Pro features that were billed but not actually delivered, dead navigation buttons, and several accessibility issues.
2026 · 2 updates
The dashboard now separates passive and active results into two tabs, with a persistent banner when a scan fails. A failed scan no longer counts against your quota.
Fixes to dashboard loading and bot-protection (CSP), and to the Stripe configuration.
Where detektd began
The first commit of both the scanner and the site. Everything else in this log was built from here.
