What we shipped lately
ArgosX moves with the AI coding ecosystem. New detections, deeper scans and integrations land continuously. Here are the highlights.
One dashboard for every client app you look after
If you run apps for other people, the fleet view now shows all of them in one place: which are protected, which need action, findings by severity and by the AI tool that built each app, and a week-over-week new-vs-fixed trend. Each app also has its own history page, so you can show a client exactly how their app got safer over time. Alerts on a new issue go to you, not to your client, so you can fix it quietly first.
Client-ready reports you can send as a link
Every client gets a co-branded report at its own private link, carrying your brand alongside “independently verified by ArgosX”. You can rotate or revoke a link at any time, and a revoked one stops working immediately. There is also a weekly summary email so you have something to forward without logging in and screenshotting a dashboard.
API keys can be locked to a single app
When you put a key in a client's repository, bind it to that one app. If the key ever leaks, it cannot reach anything else you run: it is refused on every other app, at every place a key is accepted. Existing account-wide keys keep working exactly as before.
We will not tell you an issue was fixed when it was not re-tested
Comparing two scans only means something when both looked in the same places. A quick public scan and a full signed-in scan do not, so where they are not comparable we show “n/a” instead of a fixed count. Same rule on the numbers we report for what ran: we count checks that actually executed, never ones that were merely planned.
Continuous attestation: a CI gate that only fails on new defects
Wire ArgosX into your pipeline and it re-attests your app on each merge or release you wire it to (every commit if you like), then fails the build only on security defects that are new since your last attestation, and only on the classes that matter (broken access control, data exposure, exposed secrets). A backlog you have already accepted does not fail the build, so the gate stays on instead of getting switched off. It also guards coverage: if a re-scan covers more than 20% fewer routes than the last one, the build fails, so a scan that quietly tests less cannot pass as clean.
Sharper data-leak detection
We got better at telling a genuine cross-account data leak apart from a page that's public by design, so the findings you see are the ones that actually put your users at risk.
We now prove cross-account data leaks
Paid scans now confirm whether one signed-in user can reach another user's private records. It's the single most valuable check for an AI-built app, and the gap most likely to become a breach.
Scans adapt to your app
Scans now shape themselves around your actual app instead of following a fixed script, so coverage of your real, signed-in flows went up across the board.
ArgosX MCP server
Run a scan without leaving your AI coding tool. The MCP server plugs ArgosX into Cursor, Claude and other MCP-aware editors so you can scan from inside your workflow.
Public quality Leaderboard + shareable VibeScore badge
See how real vibe-coded apps rank on quality, and turn a clean result into an embeddable trust card you can put on your own landing page.
Pro now signs in and drives your real flows
The Pro tier moved from reading the public surface to genuinely operating your app end to end: signing in with your test account, submitting ordinary forms, and testing what each sign-in role you give us can reach. We never delete, pay, check out or send messages.