OurToolsChangelog
Everything here is live on ourtools.app. Work in progress is not listed, because a changelog that lists intentions is a roadmap wearing the wrong hat.
Scans no longer wait for ever
A scan that did not finish on the instance that booked it had nothing to pick it up again, so the report page could sit on "Waiting to start" indefinitely. Queued scans are now run on a schedule.
A scan that never started now says so
The report page used to show "Waiting to start" indefinitely whether a scan had just begun or had never been picked up at all. It now tells you which, and never lets an unstarted scan read as a clean result.
A changelog that keeps itself up to date
What shipped is now listed at ourtools.app/blog/changelog, generated from the commits themselves, so it stays current instead of going stale.
The scan no longer reports other people's apps as yours
A company whose name is a common word, or whose domain is a government or similar suffix, could be shown apps belonging to somebody else. Matching is stricter, checked against the real certificate logs so that nothing genuine was lost.
The scan now searches public certificate logs
It could previously only find apps your own DNS or website already pointed at, which missed exactly the apps nobody had linked to. It now also reads the public certificate logs the hosting platforms publish, which is where an app appears the moment it is created.
Connecting GitHub proves you run the account
Connecting an organisation now requires that you are an owner of it, checked with GitHub rather than assumed. Being a member of an organisation is no longer enough, because connecting gives the workspace every repository in the installation.
The app scan, inside the product
Signed in, the scan runs as you: no work email to retype, and the report opens straight away instead of arriving by email. The public scan at /scan is unchanged for anyone without an account.
Upload and GitHub are equal ways to add an app
Deploy from GitHub sits beside the drop zone rather than under it. Connecting a repository redeploys the app whenever you push.
A repository deploy leaves your secrets behind
A repository with a committed .env had that file deployed with the app. Repository deploys now apply the same exclusions an upload does, so dependencies, build output and env files never leave your repository.
Uploads are filtered before they are measured
Dropping a project folder now leaves out node_modules, build output, caches and .env files, reads your own .gitignore, and shows you both numbers. The size limit applies to what is left, so a large project folder is usually fine.
Scan reports are tiered by who is asking
Anyone can scan any company and see the counts by platform. An address at that company sees the full report with addresses. Anyone else can send the full report to someone who works there.
Deploy from a GitHub repository
Connect a repository, pick a branch, and the app redeploys itself when you push.
Uptime on the status page
ourtools.app/status now shows measured uptime per component, from probes run every five minutes outside the platform. A day with no data is shown differently from a day that was down.
See what your own team has already put online
The free scan looks for apps published on the tools people build with, using nothing but public information. No account needed.
Run the free scan