Changelog
What changed in ZeusQA, newest first. 30 releases since 20 September 2026; the latest shipped 6 November 2026.
The free CVE feed now comes as a weekly email and an RSS feed. Every Monday, subscribers get what CISA added to its Known Exploited Vulnerabilities catalog that week and the Critical CVEs most likely to be exploited.
Read the release: Newly exploited vulnerabilities, every MondayDrop a lockfile or manifest from npm, PyPI, Go, Cargo, Composer or RubyGems at /tools/vulnerability-check. Every package version is checked against OSV.dev and CISA's KEV catalog in your browser, with the version that fixes each advisory. The file is never uploaded.
Read the release: A free lockfile vulnerability checkerNew comparison pages for QA Wolf and Momentic, and for vulnerability watch against Dependabot, Snyk and Socket. Each lists where ZeusQA is worse, when to pick the other tool, and the vendor pages every fact came from.
Read the release: Five more honest comparisonsEvery CVE now has its own page at /cves/CVE-…, with NVD's record, the CVSS vector in words, CISA's KEV status and required action, the EPSS score and the affected packages with their fixed versions. /cves/vendors ranks every vendor in CISA's KEV catalog, with a page each.
Read the release: A page for every CVE, and for every exploited vendorA repository with vulnerability watch on can show a badge in its README that says its dependencies are watched daily. It is off until a member turns it on, and it never shows advisories or counts.
Read the release: A README badge for watched repositoriesA public page at /cves lists the Critical and High CVEs NVD published in the last 7 days, what CISA added to its Known Exploited Vulnerabilities catalog in the last 30, and the EPSS odds of each being exploited. No account needed.
Read the release: A free CVE feedOn Pro and Team, a connected repository can have its dependencies checked once a day against OSV.dev and CISA's Known Exploited Vulnerabilities catalog. Each advisory gets a briefing on the new Advisories page, a direct dependency with a fixed version gets a pull request that bumps it, and new advisories go to the Slack and Discord webhooks a workspace adds in Settings, Notifications.
Read the release: Vulnerability watchTrends has a Security view. It follows each security issue a run finds until a later run rechecks it and no longer sees it, maps it to the OWASP Top 10:2025, and exports a CSV or PDF report.
Read the release: Security posture, mapped to the OWASP Top 10The security review now checks every added line of each file GitHub returns a diff for, up to the first 300 files of a pull request and lockfiles left out, for keys, tokens, private keys and passwords with fixed patterns, reports each one on its line without ever showing the value, and masks them before the model reads the diff.
Read the release: Secret scanning on every pull requestRead, copy, download or replay any finished run as a Playwright test, from the run page, and run the same file in your own CI.
Read the release: Every run is a Playwright testEach repository picks the severity that blocks a merge, Critical, High, Medium or Low. The ZeusQA Security check now fails on a finding at that severity, and a failing run fails the ZeusQA check unless all it found is below it.
Read the release: A merge gate on severityClaude Code, Cursor and any MCP client can now read your organization's runs, checks and findings, so your coding agent fixes what the browser saw without you pasting the report.
Read the release: Findings in your editor, over MCPEleven ZeusQA features now have their own page, with a clip recorded from the app, how it works in three steps, the plans it is on and what it does not do.
Read the release: Eleven feature pagesThe ZeusQA MCP server can now start tests, wait for the verdict and compare runs, so Claude Code or Cursor checks a fix in a real browser before telling you it is done.
Read the release: Your coding agent tests its own fixesA new Trends tab shows runs per week, the pass rate over time and findings by severity for every project, with a CSV of each table.
Read the release: Trends, week by weekRuns started by the ZeusQA GitHub App now add the pull request's title and description to the test, and the agent is asked to check each change it claims to make.
Read the release: The pull request is the test planTwo new use-case pages show how a startup with no QA engineer and a team with many repositories set ZeusQA up, with each plan's limits on the page.
Read the release: Pages for startups and for teamsOn Pro and Team, a repository can turn on a security review of every new commit's diff, with each finding on the line it is about, a severity and a fix, on a ZeusQA Security check and in the pull request.
Read the release: Security review on every pull requestA new public page lists the security controls ZeusQA has, the services a run goes through, and what it does not have yet.
Read the release: A security page with its controls and its gapsEvery run now reads the responses its browser already loaded for security weaknesses, and the report and the pull request comment get a Security section.
Read the release: Security checks in every runEach project now has a Flows page that lists the user flows its runs have tested, with the last result, when it was last tested and how often it failed, plus the common flows nobody has tested yet.
Read the release: Every flow you have tested, per projectEvery finding on a run now has a Fix with agent menu. Copy a ready prompt, or open it straight in Cursor or Claude Code.
Read the release: Fix a finding with your coding agentWhen a pull request lists acceptance criteria or a test plan, ZeusQA now marks each one met, not met or not checked, on the run page and in the pull request comment.
Read the release: Acceptance criteria, one by oneZeusQA now has a blog for the longer story behind each release, and its first post shows Fix with agent on a real run report, recorded in your world.
Read the release: A blog, and the product on videoZeusQA Free runs now start in Jev solo on the hosted browser, and every hosted run keeps a session replay for 30 days that you can scrub step by step.
Read the release: Jev and session replays on the free hosted browserZeusQA can now rerun any test hourly, daily, on weekdays or weekly in your time zone, and email you when a run fails or send a daily, weekly or monthly summary.
Read the release: Scheduled tests and result emailsJev now comes with every ZeusQA plan with no API key to add, Free is 3 runs, and the hosted browser blocks private networks, sockets and pop-up windows.
Read the release: Jev in every plan, and a safer hosted browserThe ZeusQA dashboard is now grouped into run, monitor and configure, and every run report opens with its verdict, then checks and findings side by side.
Read the release: A dashboard built around your runsZeusQA's site, app and emails were redesigned around one idea. A run feels its way through your site step by step, like lightning, then strikes a verdict.
Read the release: A new look: every run is a stepped leaderThe ZeusQA GitHub App can now skip pull requests that change none of the paths you list, so docs-only or unrelated changes no longer spend a run.
Read the release: Pull request runs only when the right paths changePaste a URL, describe the flow in plain English, and watch a real browser do it. Three runs free, no card.