What shipped, and when.

• Scan any URL. Security & Performance targets let you scan a staging or production site without writing a test suite first. Targets support multiple logins, so you can test what each role can reach.
• One consolidated report. All passive, active, threat-model and performance results for a target in one report, with severities, remediation and an executive summary written for you.
• From finding to fix. CodeReviewer now works out where in your code a security finding should be fixed, so you can fix it with one click like any review finding.

You can now run active OWASP ZAP scans that probe your app the way an attacker would. Because active scans send attack-style traffic, they only run against domains you’ve verified you own.

Verify a domain in Settings → Verified domains with a DNS TXT record or a small file on the site. Ownership is re-checked regularly, and scans stop if the proof disappears.

Test suites can now measure real performance on your signed-in pages. CodeReviewer replays a suite under throttling, takes the median of three runs for Core Web Vitals (LCP, CLS and INP), and adds a Lighthouse audit.

Set per-page budgets and get alerted the moment a change breaks one. Trends show how each page has moved over time. Performance runs don’t use AI, so you can re-run them as often as you like.

Every app you test now gets a passive security grade from A to F. The check sends no attack traffic. It covers:

• Transport: HTTPS and HSTS.
• Content Security Policy and clickjacking protection.
• Cookie flags on your session cookies.
• Front-end libraries with known vulnerabilities (CVEs).

Each finding explains what it is, why it matters and how to fix it.

CodeReviewer can now threat-model your app. It reads your repository together with your scan results and maps what an attacker would realistically try, categorized by STRIDE and linked to MITRE ATT&CK techniques. Threats backed by evidence from a live scan are marked, so you can tell observed weaknesses from theoretical risk.

Security findings can also be turned into issues with one click, straight into your normal triage flow.

• Live view. Watch CodeReviewer drive your app in real time while it authors a suite.
• Cases only. Generate a test-case plan without authoring the tests, which is useful when you want a reviewed catalog first. You can also add your own cases by hand.
• Excel export. Download a suite’s test cases as a spreadsheet to share with stakeholders or use for manual QA.

• Email invites. Invite teammates by email from Settings → Team. They get a link that brings them straight into your workspace.
• Notification preferences. Choose which alerts you receive on your profile, such as failed replays, broken performance budgets, active scan findings and finished explorations.
• Refreshed project overview. Each project’s front page now shows open bugs, failing suites, Bug Explorer finds, the spec gap, reviewed pull requests and features in progress in one place.

Bug Explorer is a new way to find bugs without writing tests first. Point it at your web app or Android app and it explores on its own: it maps where bugs are likely to hide, works through the app like a curious tester, and files issues with reproduction steps for what it finds. Run it on demand or on a schedule.

• Remembers across runs. Each run focuses on new ground and re-checks bugs it has already reported, so you don’t get duplicates.
• Already tracked? Bugs matching an existing issue are shown alongside that issue, not filed again.
• Promote by hand. Anything Explorer noticed but didn’t file can be promoted to an issue with one click.

Rough notes are now enough. The new magic rewrite button turns quick notes like “export broken for finance users??” into clear instructions that reference your code, for bug reports, fix instructions and test guidance. Review the result, adjust it if you like, and send it.

Form drafts are also saved as you type, so a long bug report survives an accidental refresh.

Admins can now decide exactly what members can do in a workspace. Each capability can be switched on or off: merging pull requests, applying AI fixes, triggering AI runs, managing test suites, QA, database connections, specs and repositories, and creating projects. The menu adapts, so people only see what they can use.

The project switcher has also moved into the top bar, so you can jump between projects from any page.

A set of improvements to keep suites trustworthy:

• Known failures are quarantined. A test that fails because of a bug you’re already tracking is benched until the bug is fixed, so it doesn’t hide new failures.
• Queued status. When authoring is waiting for capacity or a device, the suite says so instead of looking stuck.
• Busy devices. A phone in the middle of a run is marked busy, and new work waits its turn.
• Cancel validation. You can stop a validation run that’s no longer needed.
• Correct flow order on mobile. Flows replay in order, and the app is reset between flows, so one flow’s state doesn’t leak into the next.

You can now follow Android runs step by step as they happen, including installing the app and running each flow, and cancel a run or an authoring session mid-way.

The CodeReviewer Agent now updates itself: when a new version is available, the phone shows a notification and one tap installs it. You no longer need to re-download it by hand.

Test suites can now target Android apps as well as web apps. Upload your app build, choose the feature to cover, and CodeReviewer authors tests by driving the app on a real Android phone, then replays them on the same phone on a schedule or on demand.

• No root, no laptop. Phones run the CodeReviewer Agent app, which uses standard Android accessibility features to drive tests.
• QR pairing. Add a device in Settings → Devices and scan the pairing code from the agent app. The phone shows up online within seconds.
• Same pipeline as web. Test plans, validation, self-healing and flaky-test quarantine all work the same way on mobile.

Test suite authoring now works through the whole test plan. After you approve the plan, CodeReviewer keeps authoring until every case is covered, either with one click or automatically if you turn on the opt-in toggle.

• Validate before promote. Every new or repaired test is replayed against your app before it joins the suite. Tests that can’t pass reliably are fixed or held back, so they never reach your suite.
• Coverage by case. The suite page shows which planned cases are covered, which are pending and which were excluded.
• Repair with one click. Each failing case has its own repair button, and a progress view shows the repair as it happens.