v0.25.0

The release before 1.0. It fixes the regressions v0.24.0 introduced, so configs written for earlier versions scan the way they used to, and it settles the last parts of the output contract that 1.0 will freeze.

Regression fixes:

• A config with checks.emailAuth enabled and no domain failed to load in v0.24.0 and v0.24.1 (exit 64), so every config written before v0.24.0 with email authentication on could not scan at all. It loads again. Without a domain, email_auth checks the production URL's domain as it did before v0.24.0 and says so; with no production URL it is skipped.
• A checks block without enabled (for example healthEndpoint with only a path, or seoMeta with only mainLayout) turned the check off. A missing enabled now keeps the default; only enabled: false turns a check off. The healthEndpoint block older versions of preflight init wrote without asking (enabled: false, path: /health) keeps its earlier meaning and prints a note, and init no longer writes it.
• Debug statements behind dev guards in Twig, ERB, Blade, Django, Go templates, and other non-JavaScript code were reported again. Same-line && and ternary guards count too.
• Keys documented only in .env.example count as documented again, so declared services and Stripe no longer warn in CI, and every .env variant (.env.local, .env.development.local, and so on) is read.
• Placeholder private-key lines in .env.example are no longer reported as secrets. Files over 2MB are skipped again.
• Configs v0.23 accepted load again: a groq service key (read as grok) and a bare word in ignore (like vendor) load with a note.

Security:

• The vulnerability check no longer lets a scanned repository run its own code through its package manager: cargo-audit and bundle-audit are called directly, Composer runs without plugins or scripts, Yarn 1 ignores yarnPath, Yarn 2 and later is not audited when the project has a .yarnrc.yml, govulncheck runs without cgo and cannot rewrite go.mod, and pip-audit only runs on a fully pinned requirements.txt, without installing anything. Scanning untrusted code is still best done with --skip vulnerability; see SECURITY.md.

False positive fixes:

• favicon finds icons declared in layouts and in Next.js metadata, and a missing favicon is a warning, not an error.
• legal_pages falls back to your source when the deployed site is down or blocks the probe, and a page with a per-request nonce no longer makes every legal path look found.
• sitemap finds Next.js Pages Router, Astro, and SvelteKit sitemap endpoints.
• SvelteKit, Remix, and Nuxt are detected as their own stacks instead of Vite, so their SEO checks run.
• seo_meta finds a Next.js metadata title and description written on one line.
• A Content-Security-Policy with 'unsafe-inline' is reported as weak, with a suggestion, instead of missing.
• The vulnerability check skips workspace members covered by a parent lockfile and directories git ignores, applies your ignore globs, and audits Go at the version the project builds with.
• ssl skips local URLs, and a host whose DNS also lists a private address is checked over its public one.

Behavior changes:

• Pre-0.22 camelCase check IDs (seoMeta, robotsTxt, and the rest) are now rejected (exit 64), with one error that names the new ID for every old one. preflight ignore rewrites an old entry in place. The v0.22.0 notes said they would keep working through 1.x; we changed that so 1.x has exactly one name for each check.
• index_now trusts the deployed key file over filename hints when a URL is configured, so a key that is not actually served is now reported.
• Published runs carry real finding messages again (scrubbed of URLs beyond their origin, keys, and paths) for checks whose messages are safe to send, so dashboard fixes have the detail they need. Apps scanned from a subdirectory of a monorepo publish to their own dashboard project.
• Skipped is now set by each check rather than inferred from its message, which fixes a check whose message mentioned skipped files being counted as skipped.
• preflight help works, history --format json carries schema_version and cli_version, and unknown config keys are named by their YAML path.

Release:

• Built with Go 1.26.10. Prerelease tags no longer become latest on GitHub, GHCR, Homebrew, or npm, and GHCR images are also tagged by major and minor version.

Contract: JSON stays at schema_version 2, now pinned by tests for skipped and inconclusive results. Exit codes unchanged. camelCase check IDs are removed from ignore, --only, and --skip.