Verilay 1.1: site setup checks with fixes, stronger dependency checks, security headers

What changed since 1.0.0. The full list, in plain English, is in CHANGELOG.md and at https://verilay.dev/changelog.

New

• Site setup, for live-address scans. After a free scan of a live address, Verilay now says what is worth fixing about how the site is set up, and how: plain http not sent on to https, the certificate's remaining days, unprotected sign-in cookies, headers that announce the server software, SPF and DMARC email records for your own domain, and a missing security.txt. Each item comes with plain steps for the host the site seems to run on and a prompt you can paste into your AI builder. It only reads what any browser is sent plus public DNS records, never looks for hidden files, and stays a checklist, not a grade.
• Security headers on every Verilay page, and a /.well-known/security.txt.
• A security policy (SECURITY.md) saying how to report a problem.

Improved: the dependency check

• When the vulnerability database does not answer, a report now says the check could not be completed. It no longer reads as "no known vulnerabilities".
• Every known problem is described, not just the first few, and each version of a package is checked.
• More package lists are read: yarn.lock, pnpm-lock.yaml, poetry.lock, uv.lock, Pipfile.lock and Bun's text bun.lock. Bun's older binary bun.lockb cannot be read, and a report says so and what to do.

Live at https://verilay.dev. Free, no account needed.