changelog

What’s new.

October 11, 2026

• Remove your own site. Site owners add two lines to robots.txt and check it here: stored reports are deleted at once and new scans are refused. Every scan now reads robots.txt before it opens a page.
• A real contact form on the contact page, email at hello@stole.si, plus a security policy and a security.txt file.
• Export formats are documented on their own page, and the privacy page and terms now cover everything stole.si keeps and allows.
• Links inside sentences are orange so they stand out.
• The exact page you paste. Query strings and #/ app routes now stay part of the address, so /product?id=1 and /product?id=2 are separate scans. Tracking tags like utm_source are dropped, and addresses that carry a password or token are refused.
• Honest checks. Framing fails for frame-ancestors * or https:, the Content Security Policy check passes only when the policy really limits scripts, and contrast fails when any measured text is below WCAG AA. Text that can’t be measured is reported, not hidden.
• Downloads that import. tokens.json follows the Design Tokens Format Module 2025.10 and builds in Style Dictionary and Terrazzo. The Tailwind config is tested with Tailwind v3 and v4.
• Sturdier scans. Each scan runs in its own memory-limited sandbox, waiting scans start in order, pages that redirect with JavaScript are read from the page they land on, and sites that only answer on http:// or www. load reliably.
• Speed. Time to first byte, first paint, page ready, what the page downloads by type, and checks for compression, caching, blocking scripts, page size and HTTP/2.
• Security. HTTPS, redirects, HSTS, Content Security Policy, framing, sniffing, referrer and permissions policies, cookie flags, version leaks and the TLS certificate.
• Search and sharing. Title, description, canonical address, indexing, robots.txt, sitemap, Open Graph, structured data and a search result preview.
• Accessibility. Quick checks for text contrast, alt text, link and button labels, form labels, zoom and heading order.
• Network and content. Every domain the page talks to, addresses, IPv6, cookies, word count, outline, social profiles and feeds.
• Compare two sites side by side, check by check.
• Scan API with summary, full result, exports, compare and status endpoints, plus an OpenAPI spec.
• MCP server so AI apps like Claude, Cursor and VS Code can scan, audit and pull design tokens.
• Status page with live scanner numbers.
• More accurate tech detection: fixes for Angular, Drupal and Bootstrap, fewer false positives, newer tools like PostHog and Cloudflare Turnstile, and the evidence behind each detection.
• Scans recognize more bot walls, wait for pages that hide themselves while loading, and retry once if the browser crashes.

October 10, 2026

• stole.si launches: tech stack, colors, fonts, type scale, spacing, corners, shadows and components from any public page, with DESIGN.md, tokens.json, tokens.css and Tailwind exports.
• Consent banners are ignored when reading styles, and bot walls are detected instead of being described as a design.
• Accessibility pass on stole.si itself.