Branch HQ v1.0.50

Branch HQ 1.0.50: new versions are offered again (copies from 1.0.39 to 1.0.49 could not see updates; install this one by hand once). The Health Check now reads Angular and NestJS code it used to skip, and catches cross-site scripting, open redirects, NoSQL injection, folder listings, open metrics pages and rate limits anyone can bypass, plus access-control problems. No false alarms on 20 well-made codebases.

Branch HQ v1.0.49

Branch HQ 1.0.49: the Health Check now checks access control: records anyone can reach by changing an ID, admin rights taken from the request, requests saved as they came, debug endpoints returning users, Supabase personal data readable by everyone, and Supabase functions that let anyone spend a paid AI key. Every documented access hole in VAmPI and the Python/JavaScript ones in crAPI and Juice Shop are caught, with no false alarms on 20 well-made codebases. New: an optional AI second opinion on each access finding, using the model you choose; with a local model your code never leaves your computer.

Branch HQ v1.0.48

Branch HQ 1.0.45: the Health Check scans whole codebases, raises far fewer false alarms and catches more real problems (passwords in database addresses, fallback secrets in JavaScript). Measured on 20 well-made codebases (5 never seen before), 10 insecure apps and 36 adversarial cases. Also: 'Check a repository's security' on the home screen, a cleaner client PDF, plain messages when no AI model is set up, and a fixed live-site check.

Branch HQ v1.0.47

Branch HQ 1.0.45: the Health Check scans whole codebases and raises far fewer false alarms (measured on 20 well-made codebases, including 5 never seen before; every known hole in 10 insecure apps still caught). New 'Check a repository's security' on the home screen, a cleaner client PDF, plain messages when no AI model is set up, the key field at the top of Settings, and the live-site check now handles sites in a folder.

Branch HQ v1.0.46

Branch HQ 1.0.45: the Health Check scans whole codebases and no longer reports internal SQL, messages, durations, error codes or demo files as serious (no false alarms on 15 well-made codebases scanned in full). New 'Check a repository's security' on the home screen, a cleaner client PDF, plain messages when no AI model is set up, the key field at the top of Settings, and the live-site check now handles sites in a folder.

Branch HQ v1.0.45

Branch HQ 1.0.45: the Health Check scans whole codebases (no 2,000-file limit) and no longer reports internal SQL, messages, durations, error codes or demo files as serious problems. Measured on 15 well-made codebases in full: no false alarms; every known hole in 10 deliberately insecure apps still caught.

Branch HQ v1.0.44

Branch HQ 1.0.44: security updates to the libraries Branch HQ is built on (Electron, undici, zod, nodemailer, ip-address; three rated high). The Health Check follows Supabase's 30 October 2026 change: tables created since then are reported as open only when the project grants visitors access.

Branch HQ v1.0.43

Branch HQ 1.0.43: choosing a different model in Settings now really switches the whole team. Before, an agent with its own model setting (Mitchell, Jamie, Dwayne, Penny or Riley) kept using the old provider, so choosing Claude left every agent on Gemini. Agents you set on purpose to the provider you chose, or to a local model, are kept.

Branch HQ v1.0.42

Branch HQ 1.0.42: the Health Check is built for apps made with AI app builders (Lovable, Bolt, Cursor, v0). It now finds Supabase tables anyone can read, database rules that let anyone change every row, the Supabase admin key in the code, secret keys sent to every visitor's browser, database functions that run any command, open Firebase rules and servers that accept logged-in requests from any website. Every finding shows the file, the line and the code (with keys hidden), and a Fix this button hands it to Projects. Measured on 94 real Lovable apps; no new false alarms on 17 well-made codebases.

Branch HQ v1.0.41

Branch HQ 1.0.41 (1.0.40 did not ship: a Windows test failed and is fixed here). The Health Check now covers every common attack type in six languages (JavaScript/TypeScript, Python, Java, Go, Ruby, PHP, C#): SQL, NoSQL, command and code injection, XSS, path traversal, unsafe deserialization, SSRF, open redirects, weak password hashing and hardcoded secrets. Measured on 27 codebases: 10 deliberately insecure apps caught, 17 well-made ones with no false alarms. Stop a conversation or a Projects change while it runs. While the team waits on Google's AI, it now says which model and for how long. A live site is only reported down after a second try.