VulnVerify
Changelog

Product updates

Every shipped feature, fix, and infrastructure change — newest first. Longer write-ups live on the blog. We don't run a mailing list: the only email we send customers is transactional, plus scan reports and alerts about findings on your own domain.

  • October 12, 2026v2.0.0
    Launch

    Weekly authorized scanning — VulnVerify becomes scan-first

    • Weekly external scanning of the domain you own. Prove ownership with a DNS TXT record, a file on your website or an administrative mailbox, sign the scan authorization, and VulnVerify scans the domain every week under a published safe profile — see the scanning policy.
    • Your first report is free — every finding and the PDF, with no card.
    • Fix verification: every open scan finding is tested again on the next run, and so is an intelligence finding that carries a CVE the scanner has a check for. One that no longer reproduces on a host that still answers is marked fixed and verified, with the date and the run that proved it.
    • Verifiable reports: each weekly report is a PDF with a SHA-256 fingerprint anyone can check on the verify page.
    • One plan: Weekly Scan at $159/month, or $1,590/year (two months free). Enterprise covers several domains and MSP portfolios, with custom pricing.
    • Compliance evidence: findings, verified fixes and reports mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls, and pushed to Drata or Vanta with your own API key.
    • Findings our intelligence pipeline holds for your domain appear in the same dashboard and report. The Monitor and pentest plans and the one-time finding unlock are retired; existing subscribers keep their plan and everything it includes.
  • May 29, 2026v1.5.0
    Feature

    Pricing simplified — every plan is paid

    • Retired the $0 Free tier — VulnVerify is paid plans only. The count-only free domain check stays as before.
    • Monitor ($499/mo) — continuous dark-web monitoring of your domain, with full PoC + remediation reports on every finding.
    • Monitor + Pentest ($1,999/mo) — everything in Monitor, plus a monthly authorized pentest of your own domain.
    • Intelligence (Custom) — license verified findings at scale: data feed, API, multi-domain.
  • May 15, 2026v1.4.0
    Feature

    Billing, integrations, audit log

    • Self-service billing page wired to hosted checkout + customer portal (mocked in dev, real with API key set).
    • Slack delivery for alerts — configure per-tenant on the Alerts page.
    • Vercel cron jobs: alert delivery daily at 09:00 UTC, plus the research-sheet sync and the weekly digest.
    • Full audit log at /admin/audit capturing login attempts, lockouts, suspensions, billing events, alert deliveries, re-verifications.
    • Account lockout after 5 failed login attempts (15-minute cooldown).
    • Stronger password policy: 12+ chars, 3-of-4 character classes, common-password + email-inclusion blocks.
    • Self-service account deletion in Settings danger zone (with last-admin guard).
    • Full CSP + HSTS + Permissions-Policy headers in next.config.
    • Cookie consent banner + GDPR-aware essential-only mode.
  • May 15, 2026v1.3.0
    Feature

    Dark-web positioning + 4-stage pipeline

    • Landing rewritten around the “signal in the noise” positioning — dark-web monitoring for vulnerabilities, the way LeakRadar does it for credentials.
    • New dedicated /how-it-works page walking through the 4-stage pipeline: collect → triage → verify → alert.
    • Vulnerability detail page gained PoC payload + reproduction steps and source attribution (broad category, OPSEC-vague).
    • Per-finding report download on the detail page, served from the researcher's PDF.
    • Comparison table swapped: now contrasts against LeakRadar, Shodan/Censys, and generic vulnerability scanners.
  • May 14, 2026v1.2.0
    Feature

    Admin panel + tenant detail pages

    • Admin company detail page at /admin/companies/[domain] — registered users, vulnerabilities, and an activity timeline.
    • Sidebar gained lock badges on tier-gated nav items (Watchlist / Alerts).
    • Plan badge is now consistent across all routes (admins always show Staff · Admin).
    • Free-tier /alerts shows only the upgrade prompt — no half-empty form.
  • May 14, 2026v1.1.0
    Feature

    B2B pricing tiers

    • Pricing rebuilt for the B2B audience — single-domain plans plus Custom.
    • Tier matrix now covers root domains, subdomains, vendor-risk slots, compliance reports, review cadence, support response targets.
    • Landing pricing teaser shows the plans; the full grid lives on /pricing.
  • May 13, 2026v1.0.0
    Launch

    Launch

    • First working build of the platform — the data model, the tenant boundary, and the finding pipeline end to end.
    • Findings are scoped to critical and high severity only; nothing below that is published.
    • Email + password authentication with email verification and password reset.
    • Multi-tenant data model — each user sees only findings on their company's domain.
    • Public landing, pricing, legal, and security pages shipped.