WHAT'S NEW (v0.21)

SEE WHAT CHANGED SINCE LAST TIME
- Weblyzer now remembers each site's stack and tells you exactly what was added, removed or upgraded since you last looked, along with how the security, performance, third-party and vulnerability numbers moved.
- The baseline only moves forward when something actually changed, so re-scanning a site twice in a minute never wipes out a change from last week.
- History gained a Compare mode: pick any two analyzed sites and see what they share, what is unique to each, and how far apart their stacks are.

DETECTION: 639 -> 1,213 SIGNATURES ACROSS 27 CATEGORIES
- Four new categories: AI and LLM services, Web3 and wallet infrastructure, monitoring and APM, and shipping and fulfilment.
- Much deeper coverage of back-end frameworks and runtimes, web application firewalls and bot defence, community and learning platforms, headless content management, site builders, API documentation portals, game and 3D engines, state and data layers, consent platforms, accessibility tooling, and content management plugins.
- Payment, hosting, e-commerce and shipping coverage for Indonesia and Southeast Asia was expanded substantially.

MORE ACCURATE VERSIONS
- The exact version of the two most widely used front-end frameworks is now read even from production builds, where it is normally invisible to a detector - so version-based advisories finally apply to the frameworks most sites run.

SECURITY YOU CAN ACT ON
- The vulnerability database is now built from an open-source advisory repository: 716 advisories across 59 libraries instead of a handful, each with its CVE links and the version that fixes it. Still matched entirely offline.
- Exposure check (opt-in): one click tests a short list of paths that are public by convention on the site you are viewing, and reports the ones that answer with something they should not - a readable source-control directory, an environment file, a debug console, an open API specification, or unauthenticated account enumeration. It runs anonymously, once per click, on that site only.
- Keys and source maps in the bundle (opt-in): re-reads the JavaScript the page already loaded and reports credentials left in front-end code plus reachable source maps. Keys that are public by design are listed separately from the ones that should never ship, and values are always shown masked.
- Email authentication grade: SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC are read from public DNS and graded, with a plain answer to whether the domain can be spoofed.

PERFORMANCE, IN DETAIL
- New Page weight section: what the browser actually downloaded, broken down by resource type, first party vs third party, cache hits, compression ratio, the negotiated HTTP version, render-blocking resources and the heaviest files.

A REPORT YOU CAN NAVIGATE
- The full report is now organised into six tabs - Overview, Performance, Security, Network, SEO and History

WHAT'S NEW (v0.20)

DETECTION
- Around 230 more technologies are now recognised - 630+ in total. New coverage
spans more front-end and documentation frameworks, UI kits, rich-text and code
editors, JavaScript / graphics / 3D libraries, error-monitoring tools, no-code
site builders, icon / media services, and accessibility / translation widgets.

SITE INSIGHTS
- Toolbar badge: the number of detected technologies now shows on the extension
icon, before you even open the popup.
- JWT / auth-token inspector: decode the tokens in a page's storage locally
(header and claims only; never verified or sent anywhere).
- TLS version and server certificate in the Hosting & network section (Firefox).
- SEO & meta inspector: title, description, canonical, Open Graph / Twitter Card,
hreflang and Schema.org (JSON-LD) structured data.
- Cookie & request inspector: every cookie with its Secure / HttpOnly / SameSite
flags, plus a breakdown of all network requests by type and host.

FASTER & MORE RELIABLE
- The popup no longer gets stuck on "Scanning page..." on slow or unresponsive
sites - every analysis now finishes within a few seconds.
- Much faster on a tab that was already open: response headers are read from the
browser cache instead of a slow re-fetch, so results appear quickly.

Still 100% local by default - the only network calls are opt-in.