Releases

squirrelscan v0.0.48

squirrelscan grows up into a platform. This release makes it programmable — org-scoped API keys, a documented public REST API, and outbound webhooks — and CI-native — an official GitHub Action, build-gating exit codes, and token auth that just works in a pipeline. Plus auto-publish to your dashboard, faster re-audits, and a stack of sharp fixes. 🐿️

🔌 The squirrelscan API

• Org-scoped API keys with scopes — mint keys per org, scoped to exactly what they're allowed to do, with rate limiting built in. Create and revoke them from a new API Keys page in the dashboard (scope picker, presets, one-time secret reveal). (#154, #158)
• Public REST API — a documented, stable surface with an OpenAPI spec and a consistent error envelope, so you can drive audits and pull results from your own tooling. (#175)
• Outbound webhooks — get notified when audits happen; org-scoped delivery with retries. (#171)
• Developers hub — a brand-new docs section pulling REST API, CI/CD, webhooks, authentication, and Agents & MCP together in one place → docs.squirrelscan.com/developers (#183)

⚙️ Built for CI

• Official GitHub Action — uses: squirrelscan/audit-action@v1: install, audit, and gate your build in a few lines. (#168, #169)
• --fail-on build gating — fail the pipeline on a threshold you choose (score<90, score:perf<80, severity>=error, errors>0, …). Exit code 2 means a threshold tripped, 1 means the run itself broke — so CI can tell a regression from a crash. (#167)
• SQUIRREL_API_TOKEN env auth — set one env var and the CLI authenticates with no login step, fail-closed (no silent fallback) — built for CI secrets. squirrel whoami now shows your token's scopes. (#159)

✨ New

• Audits auto-publish to your dashboard — signed-in audits now publish automatically (unlisted + free by default), so your audit history is always there. Public reports cost 2 credits; opt out anytime with --no-publish / --offline. (#170)
• Sub-resource caching + a bad-caching rule — crawls now cache CSS, JS, images, and fonts like a browser would, so repeat audits are noticeably faster, and a new performance rule flags pages serving poor caching headers. (#107, #108)
• Smart audits (experimental, opt-in) — a local per-page finding store with union scoring across runs; off by default, enable with smart_audits = true in squirrel.toml. (#110)
• One up-front cloud consent prompt — logged-in audits now ask once, with a clear cost estimate, before spending any credits — no more per-step surprises. (#191)

🐛 Fixes

• Cleaner console output — run-relative timestamps and no more raw ISO date dumps cluttering the audit log. (#190)
• Hardened auto-update — skips CI, respects opt-out, configurable cadence, and a doctor health check, so background updates stay quiet and predictable. (#201)
• Rendered audits no longer 413 — technology detection now bounds its payload so large rendered pages don't blow the request size limit. (#192)
• musl / Alpine installs — the installer ensures libstdc++ is present, so the binary runs on Alpine out of the box. (#163)

🧹 Under the hood

• Live-sync foundation — a new org-scoped sync engine (Durable Object oplog + WebSocket push with ticket auth) lands behind a flag, paving the way for a real-time dashboard. (#205, #220)

squirrelscan v0.0.47

A big one — the overnight batch plus a couple of sharp fixes. Faster re-audits, a new site-integrity category, an editor's-style summary for Pro, and brand-impersonation detection that finally understands every TLD on the planet. 🐿️

✨ New

• Editor's-style audit summary (Pro) — logged-in Pro audits now include a short prose summary with point-form big-ticket items, written like a quick email to management. (#101)
• Site-integrity checks — a new integrity category flags signs of a compromised or abused site: brand-impersonation sign-ins, obfuscated inline scripts, fake auth overlays, template discontinuity, orphan pages, and SEO doorways. Findings require ≥2 corroborating signals before they escalate, so false positives stay low. (#116)
• Browser-like crawl caching — repeat audits now reuse fresh cached resources (honoring cache-control / conditional GET 304 / content-hash), so a second run is dramatically faster. Sub-resources (CSS/JS/images/fonts) are cached too, and a new performance rule flags pages with poor caching headers. (#104)

🐛 Fixes

• Brand-impersonation now handles every TLD — registrable-domain (eTLD+1) detection uses the real Public Suffix List, so multi-label suffixes (.com.au, .co.uk, …), deeper tiers, and free-hosting platforms no longer let an off-brand sign-in slip past the check. (#144)
• Clearer auth & cloud behavior — auth login errors now name the server and tell you how to fix them; an expired session no longer silently drops you into a degraded run — the audit keeps working with local checks only, prints why on the Account line, and (in an interactive terminal) asks before continuing. Cloud steps skip cleanly when signed out — no more confusing "failed" noise. Agents and CI proceed automatically. (#161)
• More resilient crawling — TLS / status-0 fetch failures fall back to a standard fetch, with clearer logging. (#119)
• Better E-E-A-T detection — about/contact/privacy pages with .html or non-English URLs are recognized, as are author bylines and dates in Kadence hCard / Yoast @graph markup. (#121, #122)
• No more hang when every sitemap URL is filtered — link discovery re-enables so the crawl proceeds instead of stalling at zero pending. (#123)

⚡ Performance

• Faster audits — content-walk, link-position, and rule-execution optimizations. Output is identical; the run is just quicker. (#114)

🧹 Internal

• Site-metadata and cloud results are now threaded per-run (no more process globals), making concurrent audits safe. (#126)
• Retired the deprecated ai/site-type rule in favor of the Stage-0 site-metadata profile. (#127)
• squirrel audit --max-pages is now documented with a limit-reached hint. (#124)

Site profiles land — squirrelscan now figures out what kind of site it's auditing and tailors both its cloud analysis and its audit rules to match. Plus a dashboard polish pass and unified scoring everywhere.

New: Site profiles

• squirrel audit now resolves a per-domain site profile — site type, business category, primary country & audience, the publisher/business behind the site, contact details, social profiles, languages, and domain age/registrar (via RDAP). Logged-in audits resolve it automatically (12 credits/scan); it's report-only and never affects your health score, and shows up as a dedicated Site profile section in every format (console, HTML, Markdown, JSON, XML, LLM).

Smarter, site-aware rules

• Audit rules now run only when they apply to your site. Privacy & legal checks gate by jurisdiction, E-E-A-T checks by whether the site is YMYL (your-money-or-your-life), local-business checks by whether it's actually a local business, and social-presence checks by the profiles we detect. Rules that don't apply are shown as a visible skipped check — never silently dropped.
• Fully backward-compatible — offline audits, low-confidence profiles, or sites without a resolved profile run exactly as they did before. New rules.ignore_applicability config escape hatch turns gating off entirely.
• Two new rules — legal/subprocessor-disclosure and social/social-match (verifies the social links on your site actually point back to your profiles). (partly addresses #15 — Legal Compliance)

Publish

• Publishing a report now auto-fills its public page with the site's title and description pulled from the resolved profile, so shared reports read cleanly without manual editing.

Dashboard

• New read-only Site profile page for each website, surfacing everything the audit detected.
• Unified scoring across the whole product — a single source of truth for score thresholds (90 / 70), colors, grades, and bands, now shared by the CLI, every report format, the dashboard, audit emails, and GitHub PR comments.
• Settings redesigned — website, org, and user settings are now full-width, independently-savable section cards.
• Track Issue surfaced at the top of report findings (create-or-open the linked issue), and notifications are now correctly org-scoped.

Under the hood

• The older ai/site-type check is superseded by the richer site profile — it's now report-only (weight 0) and no longer double-charges.
• Cloud analysis moved to a two-stage decision graph: the site profile resolves first (Stage 0), then gates which downstream cloud services run — so cloud features no longer fire indiscriminately. Spend is confirmed before any charge.

Technology detection lands, cloud rendering turns on by default for logged-in audits, scheduled audits move to Pro, and a batch of community-requested audit fixes — plus a ~3 MB smaller binary.

New: Technology detection

• squirrel audit now identifies the tech behind any site — 385 fingerprints across CMS, frameworks, CDN & hosting, analytics, tag managers, payments, chat, and security/consent tools, rendered as a dedicated Technologies section in every format (console, HTML, Markdown, JSON, XML, LLM) with logos. Logged-in audits run it automatically (5 credits/scan); it's report-only and never affects your health score. (Partly addresses #10 — thanks @wildfiremedia.)
• Per-domain history — squirrelscan remembers what it last saw on each domain and flags what changed since. The current snapshot is free; the historical timeline is a paid-plan feature.

Cloud rendering, on by default

• Logged-in audits now render pages in a real cloud browser by default, after a one-time consent prompt — so JavaScript-heavy and SPA sites are audited the way users actually see them, no extra flags. Your choice is remembered. --render forces rendering for a single run, --http forces a plain fetch, and non-interactive runs stay on HTTP until you've opted in (--yes alone doesn't grant consent).

Scheduled audits

• Recurring scheduled audits are now part of the Pro plan — free orgs see an upgrade prompt where scheduling used to be.
• Every audit carries a source badge — cli, cloud, scheduled, or github — across the CLI, report lists, and dashboard, so you can see at a glance where each run came from.

Audit rules

• New "Blocking" category — the old ad-blocker check is now its own Blocking section with two sub-groups, ad blocking and privacy blocking, surfaced everywhere reports render. Blocked-link and privacy-tracker findings are now warnings (previously informational). --category adblock still works as an alias and older saved reports normalize automatically.
• LCP hints read cleanly across pages (#16 — thanks @wildfiremedia) — the LCP Optimization Hints check now shows a per-page count ("3 likely-LCP images loaded without preload") instead of dumping every image URL into one confusing cross-page list.
• Sharper response-header checks (#20 — thanks @wildfiremedia) — HSTS max-age=0 is now flagged as "HSTS disabled" (it tells browsers to stop enforcing HTTPS) rather than "0 days too short", a malformed HSTS header with no max-age is caught, and sites advertising only HTTP/2 get a nudge toward HTTP/3.

Dashboard

Alongside this release, the dashboard moved its org, settings, website, and schedule pages onto the shared component kit — consistent cards, forms, inputs, badges, and loading/empty/error states, with proper disabled-during-submit behavior on every form.

Under the hood

• The binary is ~3 MB smaller — the bundled EasyList/EasyPrivacy filter lists and their parser were dead weight (ad/privacy detection runs in the cloud now), so they're out of the download.

Release v0.0.44

Faster rendered crawls and honest cloud-coverage reporting.

Performance

• Streaming crawl frontier — the crawler no longer processes pages in lock-step batches where one slow page stalls everything behind it. A fixed pool of workers now pulls the next page the moment a slot frees up, and newly discovered links become crawlable immediately instead of waiting for the current batch to drain. Rendered audits benefit the most: one slow 35-second browser render used to hold up the whole batch.
• render_concurrency default raised 4 → 6 — combined with the streaming frontier, large rendered audits finish meaningfully faster out of the box. The cap stays at 8, and per-host politeness is unchanged.
• A wedged page now times out individually instead of failing its entire batch.

Cloud analysis

• Partial coverage is no longer silent — when a cloud analysis batch fails, the audit output now says so ("AI analysis covered 20/40 pages") with the actual cause, instead of quietly reporting reduced coverage. Failed batches were never charged, but you also were never told.
• Fixed the failure that caused most of those drops — analysis batches were sized by page count only, so sites with very heavy pages could push a request past the server's payload limit and lose the whole batch. Batches are now sized by actual payload bytes, and a single oversized page ships alone so a rejection costs one page, not twenty.

Dashboard

Alongside this release, the dashboard picked up: in-app notifications for published audits, a list/grid toggle on the websites view, audits and reports merged into a single Reports surface, a proper 404 page, and a noticeably faster initial load.

Big quality-of-life release: a new fully-offline mode, much faster rendered audits, honest per-audit credit accounting, and a pile of fixes for auditing very large sites.

New: --offline

• squirrel audit <url> --offline runs a completely local audit — no cloud analysis, no publishing, no telemetry, no update checks, and no probing of third-party links. The only thing squirrel talks to is the site you're auditing. Results land in the local database as usual, so squirrel report, history, and all export formats work exactly the same. --offline can't be combined with --publish or --render (both need cloud access), and the CLI says so instead of guessing.
• Clearer logged-out messaging — audits without an account now print "not signed in — run 'squirrel auth login' to enable cloud features" instead of a confusing "offline — 0 credits".

Performance

• Rendered audits are ~2.3× faster — cloud browser-render jobs now run concurrently (new [cloud].render_concurrency setting, default 4, max 8) instead of effectively one at a time. A 100-page rendered audit that previously timed out now finishes comfortably.
• Mega-site sitemaps no longer stall audits — sites with giant sitemap indexes (TechCrunch's lists 400k+ URLs across 2000+ child sitemaps) used to grind a 100-page audit past 15 minutes just ingesting sitemap entries. Sitemap ingestion is now capped relative to your page budget with round-robin sampling across child sitemaps; the same audit completes in ~3 minutes.
• Rules phase up to 2× faster — the HTTP→HTTPS redirect checks ran serially with long delays between probes; they now run in a small concurrent pool while keeping the politeness stagger.

Credits & Reporting

• The "Cloud credits used" line now tells the whole truth — browser rendering, bulk dead-link checks, and report publishing are included alongside AI analysis, so the CLI total matches your ledger. The dashboard shows the same per-audit figure in the audit and report lists.
• Rendered pages no longer report fake TTFB — render queue + browser time was being counted as server response time, flagging perfectly fast sites with "Very slow server response (15000ms)". Rendered fetches now skip the TTFB check instead of lying about it.

Publishing & Dashboard

• Published audits now populate the dashboard Issues page — CLI-published reports previously showed issue counts but an empty Issues tab.
• Publishing very large sites no longer fails validation — oversized sitemap entry lists, extremely long rule-item identifiers, and huge robots.txt files (looking at you, nytimes.com) are trimmed to server limits instead of rejecting the whole report.
• Website screenshots capture on the first published audit — new websites created by --publish now get their screenshot immediately, and the dashboard refreshes automatically while the first capture is in flight instead of showing a permanent placeholder.
• Dead-link cloud checks work again — a server-side query bug made every bulk dead-link call fail (you were never charged; the CLI silently fell back to slower local checks). Cloud-cached link checking is back.
• Dashboard "Run New Audit" now shows you the CLI command to copy instead of failing — audits run from the CLI and publish to the dashboard.

cloud-powered audits 🐿️☁️

The big one: audits can now call squirrelscan cloud for checks that are impossible to run locally. Log in (squirrel auth login) and these run automatically alongside the local rules — logged-out audits stay 100% local, free, and unlimited, forever.

New cloud rules

• ai/site-type, ai/page-type-match, ai/llm-parsability (upgraded), eeat/authority-signals — AI analysis of how parsers and LLMs see your pages
• adblock/blocked-links, adblock/element-hiding, adblock/privacy-blocked — find resources and markup that EasyList/EasyPrivacy ad blockers will nuke
• links/dead-links — bulk external dead-link checking against a shared cloud cache (way faster than hammering every URL yourself)
• gaps/keywords, gaps/content — competitor keyword & content gap analysis (opt-in)

Cloud browser rendering

• New --render flag (or [cloud] rendering = "browser" in squirrel.toml) crawls JS-heavy sites with a real headless browser instead of plain HTTP.

Credits & spend controls

• New squirrel credits command — balance, plan, and per-feature pricing.
• Audit start now shows who you're logged in as and your credit balance (offline — 0 credits when logged out).
• Spend guardrails in [cloud] config: max_credits_per_audit (default 200), confirm_threshold (default 50, prompts before spending), enabled master switch. End-of-run summary shows exactly what was spent.
• Published reports record the credits an audit used; it shows in the dashboard report view.

Pricing

• Free accounts now get 500 credits every month — no card required.
• Starter ($19/mo) now includes 5,000 credits/month (up from 2,000).
• Credit packs are gone; paid plans can top up any amount from $10 (100 credits per $1, never expire).

Fixes

• content/broken-html now emits stable item ids, so publishing reports for sites with malformed HTML no longer fails validation.

Local audits never cost credits. Run squirrel self update to grab this release.

Bug-fix release focused on false positives, publish reliability, and binary compatibility. Huge thanks to @AnkitClassicVision, @MoriNo23, @wildfiremedia, and @v2lightingintl for the detailed reports that drove this release.

Audit Rule Fixes

• E-E-A-T rules now understand @graph JSON-LD (#21, thanks @AnkitClassicVision) — author bylines, content dates, and LocalBusiness data nested in Yoast-style @graph wrappers (most WordPress sites) are now detected. Previously these rules reported "no author / no dates" on fully-marked-up sites.
• Contact, About, Privacy, and Terms pages are always crawled first (#21) — large sitemaps no longer crowd them out of the page budget, fixing false "No Contact page found" / "No Privacy Policy found" warnings.
• Leaked-secrets rule no longer flags public client-side keys — Stripe publishable keys, Google Maps/Firebase browser keys, GTM/GA tag IDs, OAuth client IDs, Sentry DSNs, Mapbox public tokens, and Supabase anon keys are now reported as informational (public by design) instead of errors. Real secrets (e.g. sk_live_…, AWS keys, private key blocks) still fail.
• Fixed a11y/duplicate-id-aria rule error (#21) — "CSS is not defined" no longer crashes the rule.
• Issue severity now reflects what actually happened — a rule whose checks all came back as warnings reports as a warning, not an error.
• mailto:?subject=… share links are no longer flagged invalid (#17, thanks @wildfiremedia) — address-less mailto links are a legitimate email-share pattern.
• Shopify's native hCaptcha is now detected (#24, thanks @v2lightingintl) — the form-captcha rule recognizes the captcha-bootstrap inline loader and CDN script.
• social/og-image-size now names the image (#18, thanks @wildfiremedia) — warnings include the og:image URL instead of just the page.

Publishing & Crawling

• Fixed "Invalid report format" publish failures — relative links like href="index.html" no longer resolve to bogus hosts, duplicate source-page lists are deduplicated, and validation errors from the server now show the exact field and reason.
• Publish no longer hangs forever — the upload has a 30s timeout and retries transient connection failures.
• Crawler watchdog (#13) — a wedged crawl batch can no longer hang an audit indefinitely; the crawl finishes with partial results instead.

Compatibility & Updates

• Linux/Windows x64 binaries now run on older CPUs (#22, thanks @MoriNo23) — built without AVX requirements, fixing "Illegal instruction" crashes on pre-2013 hardware (e.g. Sandy Bridge).
• Self-update fixes (#14, thanks @wildfiremedia) — draft releases are never offered as updates, and answering "y" to an update prompt that can't proceed now explains why instead of silently doing nothing.

Fixed: squirrel auth login (important)

Login was broken for everyone — sessions always reported as expired due to a timestamp comparison bug in the API. This release fixes the full flow end to end:

• squirrel auth login works again — complete sign-in via browser and the CLI picks up your token reliably
• After signing in with Google you now land back on the CLI auth page instead of being redirected away mid-handshake
• Re-running a used login link now gives a clear "session already used — run squirrel auth login again" message instead of hanging
• The expiry date shown by squirrel auth status now matches your actual token

If you're signed out or your login previously failed, just run squirrel auth login.

Published reports now link to your website projects

• squirrel audit <url> -p and squirrel report -p now automatically create (or find) the matching website project in squirrelscan cloud
• Published reports appear in the website's audit history with health score, issue counts, and report link
• Reports that exceed the 5 MB publish limit now get a clear error instead of a generic failure

Other Improvements

• Leaner, faster CLI: removed the experimental built-in agent — squirrel is now a focused deterministic scanner built to pair with Claude Code, Cursor, and your own agents
• Dependency refresh across the board

Release focuses on report generation and published reports. New HTML format that is more concise based on feedback.

The published report urls will now return text, llm format, markdown etc. based on request header negotiation.

See an example report and the different formats you can request:

Improvements

• Redesigned HTML reports: Rules now collapse by default with a scannable summary line showing name, severity, and affected page count
• Report package — Report generation logic (HTML, Markdown, text, XML, JSON, LLM formats)
• Fixed report grouping — Meta title, meta description, OG tags, and button name checks now group correctly across pages instead of creating one row per unique value
• API content negotiation — Report endpoint now supports Accept: text/plain, Accept: application/xml, and Accept: text/x-llm headers for alternative output formats
• --publish flag now on audit subcommand along with --visibility

# Publish a public report
squirrel audit example.com --publish

# Publish a private report
squirrel audit example.com --publish --visibility private

Fixes

• Smaller published reports: Publish payload reduced by ~60% by trimming bulk data
• Fixed long URL overflow: Report links no longer break layout when URLs are very long
• Accessibility fix: Fixed duplicate ID detection for IDs containing special characters
• Shell completions updated: Added completions for new --publish and --visibility flags in bash, zsh, and fish

Lots of performance improvements and resilience in crawling and analysis - especially with larger crawls on larger websites. llm output format further optimized.

Improvements

• WAF Challenge Page Detection: Audit now detects bot-protection interstitial pages (Cloudflare, Imperva, PerimeterX, etc.) and excludes them from page-level scoring to prevent false positives. A new crawl/waf-challenge-pages warning surfaces when challenge pages are detected.

• SQLite Lock Handling: Improved error messages and warnings when database lock conflicts occur from parallel CLI commands. Added 15-second busy timeout to reduce lock failures.

• Smarter Audit Selection:

  • analyze command now selects the latest completed crawl instead of potentially picking a still-running one
  • report command blocks incomplete or non-analyzed audits with clear error messages
  • Latest audit lookup now matches apex/www domain aliases (e.g., example.com matches www.example.com)

• LLM Report Output Improvements:

  • Affected pages are now sampled breadth-first (shallower paths first) and capped at 5 per issue
  • Evidence item lists capped to prevent oversized reports
  • Object metadata now serializes properly instead of showing [object Object]

• Documentation: Added warning about avoiding parallel crawl, audit, analyze, or report commands against the same workspace database

New Audit Rules

1 new rule added to help catch user-facing issues:

Links

• Tel/Mailto Mismatch Detection — Warns when the displayed phone number or email doesn't match the href value (e.g., <a href="tel:+1555111">+1555222</a>), preventing users from contacting the wrong number/address (thanks @wildfiremedia via https://github.com/squirrelscan/squirrelscan/issues/11)

View all rules →

Other Improvements

• Reduced false positives for empty anchor text — Now checks aria-label, aria-labelledby, title, SVG titles, and role="img" before flagging links as empty
• Image dimension warnings now show HTML snippets — Easier to identify which <img> tags are missing width/height
• Fixed 0% rounding bug in E-E-A-T rules — Author byline and content date checks now correctly report "No pages have..." instead of "0% of pages"
• Privacy policy check is now site-scoped — Scans all crawled pages for a privacy link instead of just one page
• Improved console output formatting — Report sections now display with cleaner box-drawing borders
• Reserved command protection — Added agent to reserved names to prevent CLI conflicts

New Audit Rules

1 new rule added to help optimize your site's performance:

Performance

• https://docs.squirrelscan.com/rules/perf/js-file-size - Detects oversized JavaScript files that block the main thread and delay interactivity

Other Improvements

• Overhauled asset size rules - Image, CSS, and PDF size checks now use tiered warn/error thresholds instead of single limits:
  • Images: warn at 200KB, error at 1MB (https://docs.squirrelscan.com/rules/images/image-file-size)
  • CSS: warn at 150KB, error at 500KB (https://docs.squirrelscan.com/rules/perf/css-file-size)
  • JavaScript: warn at 250KB, error at 1MB (https://docs.squirrelscan.com/rules/perf/js-file-size)
  • PDFs: warn at 30MB, error at 60MB (https://docs.squirrelscan.com/rules/crawl/pdf-size)
• Fixed React SSR compatibility - Rules now correctly detect attributes like charset, tabindex, nomodule, colspan, and rowspan regardless of casing — handles React's camelCase SSR output like charSet, tabIndex (https://docs.squirrelscan.com/rules/core/charset). Thanks to https://github.com/EnkiYouTube-ui for reporting https://github.com/squirrelscan/squirrelscan/issues/8!
• Updated Googlebot limits - PDF truncation limit corrected to 60MB (was 64MB) (https://docs.squirrelscan.com/rules/crawl/pdf-size)

New Audit Rules

Two new crawl rules to help ensure Googlebot can fully index your content:

• crawl/html-size - Warns when HTML documents approach or exceed Googlebot's 2MB truncation limit
• crawl/pdf-size - Checks linked PDFs against Googlebot's 64MB limit via HEAD requests

View all rules →

Other Improvements

• Query string support in paths - URL output now includes query strings (e.g., /search?q=test instead of just /search)
• Improved console output - Category breakdown now shows visual progress bars with pass/warn/fail counts per category
• HTML report polish - Redesigned score card with circular progress ring, human-friendly dates, colored category counts, docs links for each rule, and improved typography. See example published report
• Better category sorting - Report categories now sort by priority rather than issue count
• Updated thin content guidance - Word count rule solution text updated to reflect Google's June 2025 core update deindexing behavior