v0.0.48

squirrelscan v0.0.48

squirrelscan grows up into a platform. This release makes it programmable — org-scoped API keys, a documented public REST API, and outbound webhooks — and CI-native — an official GitHub Action, build-gating exit codes, and token auth that just works in a pipeline. Plus auto-publish to your dashboard, faster re-audits, and a stack of sharp fixes. 🐿️

🔌 The squirrelscan API

• Org-scoped API keys with scopes — mint keys per org, scoped to exactly what they're allowed to do, with rate limiting built in. Create and revoke them from a new API Keys page in the dashboard (scope picker, presets, one-time secret reveal). (#154, #158)
• Public REST API — a documented, stable surface with an OpenAPI spec and a consistent error envelope, so you can drive audits and pull results from your own tooling. (#175)
• Outbound webhooks — get notified when audits happen; org-scoped delivery with retries. (#171)
• Developers hub — a brand-new docs section pulling REST API, CI/CD, webhooks, authentication, and Agents & MCP together in one place → docs.squirrelscan.com/developers (#183)

⚙️ Built for CI

• Official GitHub Action — uses: squirrelscan/audit-action@v1: install, audit, and gate your build in a few lines. (#168, #169)
• --fail-on build gating — fail the pipeline on a threshold you choose (score<90, score:perf<80, severity>=error, errors>0, …). Exit code 2 means a threshold tripped, 1 means the run itself broke — so CI can tell a regression from a crash. (#167)
• SQUIRREL_API_TOKEN env auth — set one env var and the CLI authenticates with no login step, fail-closed (no silent fallback) — built for CI secrets. squirrel whoami now shows your token's scopes. (#159)

✨ New

• Audits auto-publish to your dashboard — signed-in audits now publish automatically (unlisted + free by default), so your audit history is always there. Public reports cost 2 credits; opt out anytime with --no-publish / --offline. (#170)
• Sub-resource caching + a bad-caching rule — crawls now cache CSS, JS, images, and fonts like a browser would, so repeat audits are noticeably faster, and a new performance rule flags pages serving poor caching headers. (#107, #108)
• Smart audits (experimental, opt-in) — a local per-page finding store with union scoring across runs; off by default, enable with smart_audits = true in squirrel.toml. (#110)
• One up-front cloud consent prompt — logged-in audits now ask once, with a clear cost estimate, before spending any credits — no more per-step surprises. (#191)

🐛 Fixes

• Cleaner console output — run-relative timestamps and no more raw ISO date dumps cluttering the audit log. (#190)
• Hardened auto-update — skips CI, respects opt-out, configurable cadence, and a doctor health check, so background updates stay quiet and predictable. (#201)
• Rendered audits no longer 413 — technology detection now bounds its payload so large rendered pages don't blow the request size limit. (#192)
• musl / Alpine installs — the installer ensures libstdc++ is present, so the binary runs on Alpine out of the box. (#163)

🧹 Under the hood

• Live-sync foundation — a new org-scoped sync engine (Durable Object oplog + WebSocket push with ticket auth) lands behind a flag, paving the way for a real-time dashboard. (#205, #220)