What we shipped.

Heavy-scan billing now kicks in earlier and scales with scan depth: the first credit covers up to 40 million tokens (was 50M), a second credit is consumed once a scan passes 40 million tokens, and a third once it passes 80 million — no scan ever costs more than 3 credits. Most scans still finish within their first credit. If a scan fails, the base credit is still refunded; band charges reflect analysis work already performed.

Every scan now costs at most 2 credits, no matter how deep the target is. The AI token budget per credit doubled from 20M to 50M tokens, and the extra-band charge for heavier scans is capped at exactly one additional credit — a 100M-token scan costs the same 2 credits as a 60M-token scan. Most scans still finish within their first credit. If a scan fails, the base credit is still refunded; the band charge reflects analysis work already performed.

One-time credit packs now follow the same proportional pricing as subscriptions: 10 credits for $10, 50 for $45 ($0.90/credit), 200 for $175 ($0.875/credit), and a new 500-credit pack at $425 ($0.85/credit) replaces the retired 1000-credit pack. Existing pack credit balances are unaffected — credits never expire. Prices better reflect the AI analysis work behind every scan, including the heavy-scan token bands introduced alongside this change.

Rebalanced subscription allowances to keep plan pricing aligned with the real cost of deep autonomous testing: Hacker now includes 60 monthly credits (was 75), Pro 150 (was 220), and Max 360 (was 600). Prices, concurrency limits, and features are unchanged. Together with heavy-scan token banding — where scans beyond a 20-million-token AI budget consume an additional credit per band — credits now track the analysis work each scan actually performs. Light and typical scans still finish within a single credit.

Launched our streamlined 3-tier subscription model: Hacker ($49/mo, 75 monthly credits, 2 concurrent scans) for solo security researchers and indie founders; Pro ($119/mo, 220 monthly credits, 4 concurrent scans, scheduled scans, webhook alerts) for AppSec engineers; and Max ($279/mo, 600 monthly credits, 6 concurrent scans, full API access, white-label reports, hourly scheduling) for high-volume consultants and agencies. Recurring monthly credits top up automatically on billing cycle renewal.

Replaced the legacy trial pack with non-expiring one-time credit packs: 10 credits ($10), 50 credits ($40), 200 credits ($150, Most Popular), and 1,000 credits ($700, Best Value). Monthly subscription credits are automatically consumed first; credit pack balances cover peak scan volume without changing your active subscription's concurrency limits.

Added an extensive 13-point comparison breakdown detailing why security teams run on Xalgorix Cloud: frontier AI reasoning models with enterprise throughput, zero 429 token stalls or surprise LLM bills, dedicated bare-metal headless browser clusters, and pre-wired out-of-band (OOB) listener infra for blind SSRF and RCE verification.

Upgraded hosted scan clusters to engine release v4.6.77. Features slash-separated custom model ID preservation (e.g. zai-org/GLM-5.3, meta-llama/Llama-3.1-70B-Instruct), direct LLM client propagation to delegated subagents, strict proof-integrity guards preventing synthesized HTTP response bodies, and clean loopback proxy lifecycle teardown.

Scanner capacity now distinguishes running instances from remaining RAM slots, so healthy queued scans no longer remain pending behind an impossible shrinking maximum. The admin view separates running, queued, and paused scanner work. Graceful restart handoffs no longer terminalize active Supabase rows. If resumed work finishes before SaaS observes its active window, the stopped row self-heals only after an exact, backend-bound scanner snapshot proves both completion and a restart-only stop reason.

The desktop header now keeps its navigation and account controls on one 56px row. Core destinations remain visible, secondary links move into a compact More menu, and narrower viewports switch cleanly to the complete mobile navigation without horizontal overflow.

Published a primary-source briefing on ZBT factory firmware implants, AshGraphQL resource exhaustion, exploited SQL Server CVE-2019-1068, CISA vulnerability trends, and governed AI cyber defense, with credited VulnCheck and CISA visuals.

Added a persistent English / Simplified Chinese language switcher and translated public pages, authentication, dashboard, scans, findings, billing, organization, settings, and administrative workflows.

Stopping a scan no longer marks the SaaS row stopped until the scanner confirms cancellation. Active scanner instances can also restore an exact missing or silently stopped ownership row, keeping real activity and Supabase state aligned.

Subscription reconciliation now preserves provider cancellation state and paid-through access, while reliably repairing stale active subscription rows without shortening a customer's purchased period.

Scan completion no longer remains stuck when a large or WAF-sensitive log payload is rejected upstream. The sync path degrades safely while preserving completion state and finding totals.

Added a transparent hosted-versus-self-hosted guide with a total-cost calculator, operational tradeoffs, and direct paths to either run the open-source engine or start a managed scan.

Operators can launch multiple targets from one submission and attach source, API, architecture, or other security context files that seed the engine's assessment.

Team-focused homepage messaging plus a new Enterprise tier — SSO/SAML & SCIM, self-hosted deployment, volume credits, annual invoicing, RBAC, DPA/SLA, and dedicated support. Added Talk-to-sales CTAs across the site.

The dashboard API page now has an endpoint picker, an editable request, live curl / JavaScript / Python snippets, and a zero-side-effect dry-run for the scan-start call — integrate without opening the docs.

Launched the Xalgorix blog with inline diagrams, per-article Open Graph images, and BlogPosting structured data. First post: “Detection is not proof — inside exploit-verified pentesting.”

Register HTTPS endpoints to receive a signed scan.completed event (HMAC-SHA256), with a delivery log and one-click Send test.

Public Trust Pages now expose an SVG status badge (status / findings / severity / last-scan, with a custom label option) you can drop straight into a README.

Run a scan from CI against a deployed target and fail the build on exploit-verified findings above a severity threshold. Public REST API also gained a findings endpoint and source-repo (whitebox) support.

Preserves slash-separated model identifiers (e.g. `zai-org/GLM-5.3`, `meta-llama/Llama-3.1-70B-Instruct`, `deepseek-ai/DeepSeek-V3`) when routing through custom OpenAI-compatible endpoints or cloud gateways; propagates cloned LLM configuration and custom resolvers to delegated subagents; enforces proof-integrity rules forbidding LLMs from synthesizing HTTP response bodies; adds loopback bridge teardown and hop-by-hop header cleanup.

Introduces `XALGORIX_PROXY_REQUIRED=true` enforcing that scan traffic routes strictly through a single upstream proxy without silent fallback; adds a local loopback HTTP bridge for headless Chromium instances and subprocesses; and masks credentials across logs, subprocesses, and errors.

Added an opt-in **Notify on scan completion** setting for Discord and Telegram (`XALGORIX_NOTIFY_SCAN_COMPLETE`, default `false`). Queue-level and report-level completion summaries now respect the setting while per-vulnerability alerts remain unchanged. Live setting updates are race-safe, and the README and architecture guide document the new behavior.

Added macOS ARM64 support and multi-architecture container images.

The CLI now reports LLM token usage at scan completion and explains hosted-service cost coverage. Documentation also adds a direct, practical comparison of self-hosted and hosted Xalgorix.

MiniMax-backed scans now use MiniMax's native web_search capability.

Fix: reporting now rejects fabricated or unreachable non-findings and no longer infers proof from a description alone.

Brand and UX milestone: a new transparent logo and icon set, Light / Dark / System dashboard themes, and multi-file Postman uploads with collection, environment, variable, and authentication resolution. No breaking changes.

Added a persisted Light / Dark / System theme and multi-file Postman upload with variable and authentication resolution.

Fix: removed a flaky scan-acknowledgement test cleanup race.

Completed the red-emblem brand refresh across the logo, README banner, screenshots, and issue templates.

Fix: eliminated data races on shared resolver and agent-runner globals.

Redesigned PDF export with a card-based layout and pagination fixes, and expanded README screenshots and sponsorship metadata.

Discord and Telegram vulnerability alerts now include exploitation evidence. Docker images always ship the latest Nuclei engine and templates, and Gemini safety thresholds are configurable for authorized testing.