Releases

Reliability and hardening release — bug fixes across Site Profile, cloud rules, and custom headers, plus a faster, cheaper cloud-audit default.

Fixes

• Site Profile capture fixed. Domain metadata (registrar, domain age, nameservers) captures reliably again — a rule-matching regression that could leave the Site Profile section blank on some audits is resolved.
• More reliable registrar/age lookups for .au and other ccTLD sites. Domain-fact lookups that were timing out from the cloud now retry with a proper user-agent and log the reason on failure, so Site Profile data shows up more consistently.
• Custom request headers are validated. Header values containing control characters (CR, LF, or NUL) are now rejected, closing a header-injection vector on the -H / [crawler] headers feature added in v0.0.60.
• Site-metadata cloud rule fixed on Google models. A schema-compatibility error (HTTP 400) that could make the site-metadata rule fail is resolved.
• Honest smart re-audit status. A smart re-audit whose first run crawls zero pages no longer reports itself as "completed" — it surfaces the real state instead.

Improvements

• Faster, cheaper cloud audits. Cloud audits now default to Gemini Flash 3.1, trimming latency and cost on the cloud-backed rules with no change to results.

New

• Custom request headers. Send any header on every crawl request with -H "Name: Value" (repeatable) or a [crawler] headers block in squirrel.toml — handy for auth tokens, feature flags, or getting past a WAF on a staging site. Header values are treated as secrets and redacted in output.
• Cloaking detection. A new opt-in differential probe re-fetches suspicious pages as a search-engine crawler and flags any that serve different content to bots than to real visitors.
• Threat-intelligence checks. New opt-in rules scan for known-bad indicators and exploit-kit signatures, so a compromised site gets caught early.

Improvements

• Accurate cloud spend on cache hits. A cached render now shows as its own line in the spend summary instead of the full render estimate, so the total matches what you're actually charged.
• Sharper author detection. A bare "Editor" or "Editorial" byline no longer counts as real author attribution (fewer false E-E-A-T author signals), while a genuine byline like "Jane Smith, Editor" is still recognized.
• Faster audits. Page rules now run on a synchronous fast-path, trimming per-rule overhead across the whole run.
• Recurring findings, badged. The dashboard Issues tracker now badges findings carried over from a previous audit, so you can see what keeps coming back.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

New

• Clearer audit outcomes. When a crawl is blocked by a bot wall or can't finish, the audit now reports its real state — blocked, failed, or partial — instead of showing a misleading health grade for a site it never fully reached. The CLI also exits non-zero on a blocked or failed audit, so it won't quietly pass in CI.

Improvements

• Tougher against bot walls. When cloud rendering hits a WAF or anti-bot challenge, squirrel now falls back to a direct fetch so the page is still analyzed instead of being dropped.
• Organic search positions, charted. HTML reports now render the keyword position breakdown as a clean bar chart instead of a plain text list.

Fixes

• Scheduled audits are off by default on every plan. Switching on a scheduled audit is always an explicit opt-in now — the dashboard and docs no longer imply Pro plans get one turned on for you.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

Fixes

• Signed-in Pro audits now run the full rule set by default. A bare squirrel audit <url> on a Pro account now defaults to surface coverage, so the cloud-backed rules (AI, E-E-A-T, blocking) and the editor's summary run automatically — no need to pass --coverage surface. Free and anonymous runs keep the fast quick default (no cloud calls). Pass --coverage (or set [crawler] coverage in squirrel.toml) to override either way.
• A Pro audit that can't reach the cloud (transient network blip) no longer silently drops to the smaller quick crawl — it keeps the full crawl depth while skipping the unavailable cloud steps.

New Audit Rules — Agent Experience (AX)

Three new rules in the Agent Experience category, focused on how well your site serves AI agents and crawlers (242 rules total):

• ax/llms-txt — detects /llms.txt (and /llms-full.txt) at the domain root and checks its basic Markdown format. An emerging standard that gives AI agents a curated, machine-readable map of your site.
• ax/markdown-response — checks whether your site serves text/markdown via content negotiation (or exposes a .md variant of the homepage). Agents increasingly prefer clean Markdown over rendered HTML.
• ax/content-without-js — flags significant main content that only appears in the JS-rendered DOM and is invisible to agents that read raw HTML.

Browse the full rule set → https://docs.squirrelscan.com/rules

Improvements

• MCP server — API-key authentication with scope-gated tools for the local stdio server.
• Faster cloud rendering — render submissions are batched and poll loops coalesced for quicker audits.
• Faster large-site crawls — URL dispatch and row cleanup are batched to cut overhead on big sites.
• More accurate domain detection — refreshed the bundled Public Suffix List snapshot.

Fixes

• Cloud audits that stall past their deadline are now finalized automatically instead of hanging.
• More efficient handling of error and empty pages during analysis.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

squirrelscan v0.0.56 — more signal, fewer surprises. 🐿️

📊 Domain Stats tracking

A new Domain Stats section in the dashboard surfaces your site's off-page footprint: backlinks, referring domains, organic keywords & traffic, and paid search — with month-over-month trend history so you can watch it move over time. Pro accounts get the full history and monthly auto-refresh; free accounts get a preview.

🎯 Per-website audit rule selection

Pick which audit rules run on a per-website basis (it used to be one setting for the whole account). Tune each site to the checks that actually matter for it.

☁️ Cloud audit reliability

Fixed a bug where a cloud audit could fail at the very last step — publishing the report — for some sites, so the crawl and analysis ran but no report ever appeared. Cloud audits now publish reliably.

---

Install or upgrade: https://squirrelscan.com/download · squirrel self update

squirrelscan v0.0.55

A reliability-focused patch — better technology detection, sturdier crawling, and more accurate reporting.

Fixes & improvements

• Technology detection on every audit. Your site's detected stack — CMS, framework, CDN, analytics and more — now appears in the CLI output, the report, and the dashboard for every audit, including quick scans. Previously it only showed up on some runs.
• Sturdier crawling. Audits no longer skip pages when a server sends malformed or mislabeled compression, and a crawl can no longer get stuck on an unresponsive connection — a hard time budget always finalizes with the pages collected.
• Accurate render credits. Cached page renders now report the credits actually charged instead of the full estimate.
• Cleaner run history. Interrupted or cancelled audits are recorded correctly instead of lingering as phantom "timed out" failures in your dashboard.

squirrelscan v0.0.54

A new Agent Experience audit category and smarter signed-in audits. 🐿️

New

• Agent Experience (ax) audit category — checks for how well your site serves AI agents and crawlers, starting with ax/ai-crawlers (does your robots.txt allow or block the major AI bots?). More ax rules are on the roadmap.

Audits & accounts

• Signed in? You get the full audit by default. Logged-in and Pro audits now run the complete cloud rule set + site profile automatically — no extra flags or prompts. Pass --http any time you want a local-only run.
• Detected technologies now appear in your dashboard for signed-in audits, even before you publish a report.

Under the hood

• Default models updated to Gemini Flash 3.1, plus reliability and telemetry fixes.

---

Update with squirrel self update (or it'll auto-update within 24h).

squirrelscan v0.0.53

Incremental crawling you can toggle, hardened webhooks, and faster repeat audits. 🐿️

New

• Incremental crawls — re-audits now skip pages that haven't changed since the last run, so repeat scans are faster and gentler on the sites you audit. Toggle with --incremental / --no-incremental, and crawls stay politeness-aware with per-host rate limits and staggering.

Webhooks

• Hardened delivery — outbound webhooks are now protected against SSRF and DNS-rebinding, so a webhook URL can't be pointed at private or internal addresses.
• Secret rotation — roll a webhook signing secret without downtime.
• Polished settings — edit existing webhooks, see delivery status at a glance, and get URL validation up front.

Performance

• Faster cloud audits — cloud prefetch now runs in parallel after the first stage instead of strictly one-at-a-time.
• Single-pass parsing — each page is parsed once and reused across crawl and audit rather than twice.
• Leaner rules — removed redundant overhead in the per-page rule loop.

Reliability & fixes

• API errors now return a consistent, typed shape across endpoints.
• Switching a report between public and private no longer errors out when you're low on credits — it tells you clearly instead.

---

Update with squirrel self update (or it'll auto-update within 24h).

squirrelscan v0.0.52

New

• Local MCP server — squirrel mcp runs squirrelscan over stdio so any MCP-compatible agent (Claude, etc.) can crawl and audit directly.
• Per-website crawl & audit config — set max pages, depth, and coverage per site, with trigger attribution on every run.
• Redesigned report header + one-click "open report" from the dashboard.

Cloud

• Smart audits — cross-audit finding merge with a union rescore, so a partial re-audit carries prior findings forward instead of inflating your score; removed findings are retired cleanly.
• More reliable cloud-render crawls — interruptible fetches, a crawl-phase watchdog, a stale-run reaper, and an HTTP-first hybrid mode for faster runs that no longer stall.

Reliability & fixes

• Publishing no longer fails when a site's own security findings look "code-like"; a failed publish is now recorded as an error audit with a clear status instead of vanishing silently.
• Website title/description are taken from the page's real metadata rather than an AI paraphrase.
• Existing reports pick up renderer changes when their HTML is regenerated.
• Crawler: quick-mode sitemap discovery is restored when resuming a crawl.

Performance

• Faster crawls — lower hot-path overhead and higher single-host throughput with politeness-aware staggering.
• Rules & reports — Core Web Vitals hints computed once per page, O(N²)→O(N) result accumulation, and batched result persistence.

squirrelscan v0.0.51

Your audits now show up live, your scores stop fibbing on partial re-runs, and repeat audits got cheaper. 🐿️

🔴 Live audits in the dashboard

Signed in? Your audit now appears in the dashboard the instant it starts — not just when it finishes.

• Live page-by-page progress as a run crawls.
• Org "running now" feed — see every audit in flight across all your sites, plus your live credit balance.
• Richer run details — who ran it, the source/runner, and coverage mode, right on the run card.
• The dashboard "Reports" surface is now Audits (an audit is the run; the report is its output).

📊 Smart audits — no more score inflation on partial re-audits

Run a quick re-audit of a few pages and your health score used to jump because the pages you skipped silently dropped out. Not anymore.

• Issues on pages you didn't re-crawl carry forward, so your score reflects your whole known site — not just what you scanned this run.
• Pages that 404/410 get their old issues retired automatically.
• Reports tag each finding as fresh vs carried and show an "audited N of M known pages" coverage line.

⚡ Faster, cheaper repeat audits

Cloud render results are now cached across audits. When a page hasn't changed since last time, we reuse the stored render instead of re-rendering — repeat audits are quicker and cost 1 credit instead of 2 for each unchanged page.

🧹 Under the hood

• Org-homepage audit-status loads in one batched query (no more per-site N+1).
• Expanded API + CLI test coverage; settings tests no longer touch your real ~/.squirrel.

---

Update with squirrel self update (or it'll auto-update within 24h). Full diff: v0.0.50…v0.0.51.

squirrelscan v0.0.50

A speed-and-polish release: audits default to fast mode, reports are deterministic, the rule set is leaner, and published reports are CSP-ready. 🐿️

⚡ Fast by default

• quick is now the default coverage mode — audits run fast, local, and free by default (seed + sitemaps, no link discovery, ~25 pages) with no credit prompt. Opt into deeper crawls + cloud rendering/enrichment with -C surface or -C full. (#259)

🐛 Fixes

• Deterministic reports — finding and affected-URL ordering is now stable across repeat audits of the same site, so report diffs reflect real changes instead of nondeterministic ordering churn (a side effect of concurrent rule execution). (#150)
• CSP-safe screenshots — the published-report screenshot's hide-on-error now uses a single static, hash-whitelistable <script> instead of a per-element inline onerror, so reports keep working under a Content Security Policy. (#254)

🧹 Under the hood

• Page-finding compaction — the local smart-audit finding store now prunes terminal (resolved/stale) findings and removed pages on churny sites, keeping the store bounded over time; open and carried findings are never touched. (#197)
• Dead-code removal — deleted an unregistered legacy SEO rule module whose title-length threshold had drifted from the active rule. (#249)

Full changelog: https://github.com/squirrelscan/squirrelscan/compare/v0.0.49...v0.0.50

squirrelscan v0.0.49

A polish release with one big headline: real-time dashboard sync goes live. Alongside it, a focused report-quality pass makes audits sharper and more honest — clearer blocking warnings, cache reframed, sitemap 4xx false-positives gone, technologies that actually sync, screenshots in public reports, and a smarter title-length rule. Plus -C quick is now genuinely free. 🐿️

⚡ Real-time dashboard sync is live

• Live-sync enabled — audits and website add / edit / delete now reflect in the dashboard instantly, no refresh. Org-scoped, WebSocket-pushed, ticket-authenticated. (#204, #211)

🐛 Report fixes

• Blocking section, fixed — now one warning per blocked script (vendor-labelled) with accurate "pages affected" counts, instead of a single lumped "0 pages affected" warning. (#240)
• Cache, reframed — demoted from a headline figure to subtle metadata in the report, dashboard, and CLI output; it's a feature of the audit, not a score. (#239)
• Sitemap 4xx false-positives gone — a Range request was making some servers answer 416, which looked like a broken page. (#235)
• Technologies sync to the dashboard — tech detected during an audit now appears in the dashboard Technologies view on publish, and broken tech icons are fixed. (#238, #234)
• Screenshots in public reports — published reports now show the site screenshot alongside the category breakdown. (#241)
• Smarter title-length warning — the "title too long" threshold relaxed 60 → 75 chars to match Google SERP truncation, so good titles stop tripping it. (#236)

✨ CLI

• -C quick is truly free — quick coverage now skips all cloud services, so there's no credit prompt and nothing to spend. (#237)
• Sturdier cloud preflight — hardened coverage validation, a NaN guard on the update-check cadence, and a more resilient preflight. (#226, #227)
• Install fix — install via squirrelscan.com/install (the old install.squirrelscan.com host was NXDOMAIN). (#222)

🧹 Under the hood

• Render-cache foundation — schema, credit accounting, R2 blob storage, and live-path wiring land behind a flag for repeat-audit speedups (rolling out separately). (#193, #217, #218)
• Legacy consent migration — existing cloud_render_consent users migrated to the newer disclosing prompt. (#215)

Full changelog: https://github.com/squirrelscan/squirrelscan/compare/v0.0.48...v0.0.49