Changelog

Your reports and purchased deep scans now live in clean, collapsible sections — tap to expand just the one you need. The page also finally uses the full width of the screen instead of a narrow centre column, and every link opens in its own tab so you never lose your place.

Verilay now checks for weak password hashing, insecure encryption modes, hardcoded encryption keys, and undersized RSA keys — reported alongside your existing findings, with the same plain-English explanations.

Dependency findings are now weighted more precisely against the public vulnerability database, and build-only tools (your test runner, bundler, and similar) no longer count toward your critical/warning score the way a real runtime dependency does — verified against an independent second opinion from another AI tool on a real app.

Every report now includes a visual map of your app — Auth, Database, API, Frontend and more, laid out and labelled specific to what you actually built, not generic categories. A plain-English breakdown of what each part does sits right underneath.

Ask a real question about your report — "why is this critical?" or "how do I fix the database one?" — and get an answer grounded in your actual scan, not a generic response. Right there on the report page.

While your scan is running, you'll now see a real progress indicator and a clear note that nothing needs your input — instead of just a spinner and no sense of how much longer it'll take.

Bigger repositories now scan reliably instead of occasionally failing with a "try ZIP" error. Findings also come back more complete — a token-limit issue was occasionally cutting an analysis short partway through.

A one-off, deeper review of your app for $19 AUD plus applicable tax: reads far more of your code than the free scan, gives exact package names and fixes for every dependency vulnerability, and includes unlimited re-scans of the same app for 30 days so you can confirm a fix actually worked. Runs in the background — close the tab and come back, your report is saved and waiting when it's done.

If you've bought a deep scan, there's now a quiet Sign in link on the homepage so you don't have to hunt for the URL to see your saved reports. A Pricing link now points to the full free-vs-deep-scan comparison too.

The Recommended Fixes and Second Opinion sections now reference your actual findings rather than just a summary — more useful, specific guidance instead of one generic suggestion.

In some cases the critical/warning counts shown while your analysis was still running didn't match what got saved to your report afterward. Both now always agree.

A vulnerability that's catalogued under two different public reference numbers was being counted twice, making the total look worse than it really is. Each one is now counted once.

Every scan — including the free one — now checks the code libraries your app depends on against OSV.dev, a public database of documented security vulnerabilities. If something's affected, you'll see how many issues were found; the deep scan shows exactly which ones and how to fix them.

Reopening a report you'd saved or shared previously left out the exposed-keys check and the dependency check, even though they'd run. Both now show up properly whenever you come back to a report, not just the moment it first finishes.

Reports now include a plain-English breakdown of your whole app — grouping every file into simple categories like visual pages, data & logins, settings and building blocks. It shows that most of an app is safe internal machinery, and that the parts which matter for security are a smaller set — the ones Verilay checks first. There's a simple view for non-developers and a developer view for more technical detail.

Verilay now reads far more of each file before grading. Previously, large single-file apps could be cut short, so the scan sometimes only saw the styling and missed the JavaScript or backend logic further down — occasionally misreading a working app as an incomplete one. Your scans now take in much more of the actual code, so the analysis is based on what your app really does.

Re-running the same app now gives you the same grade. Your score is calculated directly from the findings, so the headline grade and verdict always match the detailed results below them.

Every report now shows how many of your files were analysed, with the full list a click away — so you always know precisely what the scan covered.

Every critical issue now gets its own advice prompt, with the most important issues listed first — so you always know what to tackle, and in what order.

Verilay no longer treats minified or bundled JavaScript as a problem. Shipping minified code is how every production app is built — it's a sign things are working, not a security risk. It will never lower your score or show as a warning again.

Added Blog at /blog, Privacy policy, Terms of use with AI disclaimer, About page with the story behind Verilay, and this Changelog. Verilay now feels like a proper product.

All fix prompts changed to advice prompts. Every prompt now asks your AI builder to investigate and advise before making any changes. "Copy fix prompt" became "Get advice prompt". "Fix in Lovable" became "Ask Lovable about this". Safety warning added before copying.

Mark any finding as verified by pasting your AI builder's response. Score recalculates based on unverified findings only. Layer dots turn green when all findings are verified. Report becomes a living document.

Verilay now reads package.json first to identify your exact stack before analysing. Files are selected by security relevance not just filename. Added awareness for Drizzle ORM, NextAuth, Clerk, Prisma, Flask, Gunicorn and more.

Waitlist popup after 3 analyses to capture demand for Pro features. Score guide now shows exactly what's needed to reach each grade — including a checklist to go from B to A.

Learner mode explains each layer in plain English with analogies specific to your app. A travel app gets travel analogies. A legal app gets legal analogies. Never generic "think of it like a bouncer" explanations.

Added 30+ platform-specific rules to prevent false positives. Supabase anon keys, Replit OIDC auth, Lovable auto-managed env vars and TanStack Query patterns are now correctly recognised as valid — never flagged.

First public release. GitHub and URL analysis, plain-English security reports, layer map with Expert and Learner modes. Free, no login required.