What we shipped.

Scanner capacity now distinguishes running instances from remaining RAM slots, so healthy queued scans no longer remain pending behind an impossible shrinking maximum. The admin view separates running, queued, and paused scanner work. Graceful restart handoffs no longer terminalize active Supabase rows. If resumed work finishes before SaaS observes its active window, the stopped row self-heals only after an exact, backend-bound scanner snapshot proves both completion and a restart-only stop reason.

The desktop header now keeps its navigation and account controls on one 56px row. Core destinations remain visible, secondary links move into a compact More menu, and narrower viewports switch cleanly to the complete mobile navigation without horizontal overflow.

Published a primary-source briefing on ZBT factory firmware implants, AshGraphQL resource exhaustion, exploited SQL Server CVE-2019-1068, CISA vulnerability trends, and governed AI cyber defense, with credited VulnCheck and CISA visuals.

Added a persistent English / Simplified Chinese language switcher and translated public pages, authentication, dashboard, scans, findings, billing, organization, settings, and administrative workflows.

Stopping a scan no longer marks the SaaS row stopped until the scanner confirms cancellation. Active scanner instances can also restore an exact missing or silently stopped ownership row, keeping real activity and Supabase state aligned.

Subscription reconciliation now preserves provider cancellation state and paid-through access, while reliably repairing stale active subscription rows without shortening a customer's purchased period.

Scan completion no longer remains stuck when a large or WAF-sensitive log payload is rejected upstream. The sync path degrades safely while preserving completion state and finding totals.

Added a transparent hosted-versus-self-hosted guide with a total-cost calculator, operational tradeoffs, and direct paths to either run the open-source engine or start a managed scan.

Operators can launch multiple targets from one submission and attach source, API, architecture, or other security context files that seed the engine's assessment.

Team-focused homepage messaging plus a new Enterprise tier — SSO/SAML & SCIM, self-hosted deployment, volume credits, annual invoicing, RBAC, DPA/SLA, and dedicated support. Added Talk-to-sales CTAs across the site.

The dashboard API page now has an endpoint picker, an editable request, live curl / JavaScript / Python snippets, and a zero-side-effect dry-run for the scan-start call — integrate without opening the docs.

Launched the Xalgorix blog with inline diagrams, per-article Open Graph images, and BlogPosting structured data. First post: “Detection is not proof — inside exploit-verified pentesting.”

Register HTTPS endpoints to receive a signed scan.completed event (HMAC-SHA256), with a delivery log and one-click Send test.

Public Trust Pages now expose an SVG status badge (status / findings / severity / last-scan, with a custom label option) you can drop straight into a README.

Run a scan from CI against a deployed target and fail the build on exploit-verified findings above a severity threshold. Public REST API also gained a findings endpoint and source-repo (whitebox) support.

Added an opt-in **Notify on scan completion** setting for Discord and Telegram (`XALGORIX_NOTIFY_SCAN_COMPLETE`, default `false`). Queue-level and report-level completion summaries now respect the setting while per-vulnerability alerts remain unchanged. Live setting updates are race-safe, and the README and architecture guide document the new behavior.

Added macOS ARM64 support and multi-architecture container images.

The CLI now reports LLM token usage at scan completion and explains hosted-service cost coverage. Documentation also adds a direct, practical comparison of self-hosted and hosted Xalgorix.

MiniMax-backed scans now use MiniMax's native web_search capability.

Fix: reporting now rejects fabricated or unreachable non-findings and no longer infers proof from a description alone.

Brand and UX milestone: a new transparent logo and icon set, Light / Dark / System dashboard themes, and multi-file Postman uploads with collection, environment, variable, and authentication resolution. No breaking changes.

Added a persisted Light / Dark / System theme and multi-file Postman upload with variable and authentication resolution.

Fix: removed a flaky scan-acknowledgement test cleanup race.

Completed the red-emblem brand refresh across the logo, README banner, screenshots, and issue templates.

Fix: eliminated data races on shared resolver and agent-runner globals.

Redesigned PDF export with a card-based layout and pagination fixes, and expanded README screenshots and sponsorship metadata.

Discord and Telegram vulnerability alerts now include exploitation evidence. Docker images always ship the latest Nuclei engine and templates, and Gemini safety thresholds are configurable for authorized testing.