Changelog

What changed in yof

Shipped changes only, newest first. Plans and work in progress are not listed here.

  • Guard now reads .yof.yml from the base branch of a pull request, so a pull request can't add ignore rules that silence Guard on its own change. A pull request that edits .yof.yml is told its rules apply after merge.
  • Accepted risks: accept one finding with a reason, or reopen it. Accepted findings stop counting in your score, your open findings and your daily email.
  • Patch watches your domain's nameservers, checks your app after a production deploy that GitHub reports, shows alerts in the app and re-tests your assistant after a deploy at most every six hours.
  • The cloud browser keeps partial results when a page fails, and a run that opened no page counts as failed instead of clean.
  • Patch can open a fix pull request from a finding card or with fix <id> --pr in the Terminal, using safe templates only: security headers, security.txt and the .env lines in .gitignore. Patch never merges.
  • Every Patch event shows its proof: what it noticed, the before and after, its verdict and what it did.
  • Terminal round two: --json on the data commands, fix <id> for a ready-to-paste fix, export for a yof-rules.md file, and Tab completion for hosts and finding IDs.
  • The Terminal in the yof app: apps, check, findings, ask, guard, install and whoami on your own account. A host that isn't yours is refused.
  • The terminal on yof.io now shows a real run of the published CLI instead of an illustration.

  • The open-source CLI, @yof/cli 0.1.0 (Apache 2.0): leaked keys and made-up packages on your machine, a pre-commit hook and the GitHub Action yof-dev/yof@v0.1.0.
  • Guard on GitHub: the App yof by sotem leaves one comment and one yof Guard check on each pull request. Patch opened as early access.
  • yof.io shows the real CLI commands and the Guard install link, and drops claims about features that aren't built.
  • A proven owner can now test their own chatbot with about 12 mild messages, read with fixed rules. Evidence is masked.
  • More key patterns (Stripe webhook secrets, GitHub, Slack, Hugging Face, Groq, Replicate, Mailgun, Twilio), a package check for made-up, brand-new, lookalike and vulnerable packages, Guard's code rules, and the website check with a real browser.
  • Guard keeps the full list of repositories when you add or remove one from the App.

  • The API check: personal data served to anyone, keys in API addresses, error details, CORS with credentials, open API docs and plain http.
  • Protection for site owners: keys stay locked until you prove a site is yours, owners hear when another account proves their site, and checks of unproven sites are capped per site.
  • yof has its own app address, app.yof.io, with its own sign-in and emails.
  • yof.io became yof's home, with its own sitemap and robots file.

  • Search, front end and content checks, and fresh DNS answers from your domain's own name servers, so a DNS fix shows as fixed right away.
  • The Checked by yof badge (no results shown in public), a live view of each check, and the free check on the home page.
  • A pass for sites behind bot protection, four checks at once, the daily check with one email a day, and GitHub sign-in.
  • Ask yof, support from inside the app, and yof's own sign-in and emails.
  • Sign-up opened to everyone. No waitlist.

  • yof v0.1: real checks of a live app (keys in page code, open databases, exposed files, admin pages, headers, email setup), proof of ownership and a fix prompt for every finding.