What changed, and when

A result you can show somebody, and one decision about what leaves your machine instead of four buttons that looked alike.

• One Export report button. The results screen had a button per format, which put the most consequential choice in the product, whether a file is safe to publish, into the difference between two adjacent names. There is one button now, and a chooser that says what each file is for and marks whether it carries your own code.
• A scorecard image. A fourth export: a 1200 by 630 PNG for a readme or a post, carrying the score, how much of the application could be read, and what was found. Coverage sits beside the score at the same size, because 99 out of 100 against a tenth of an application is not the claim that number makes on its own.
• The card will not offer a hash it cannot stand behind. Scanning a folder produces no hash of your code, only a digest of file names and sizes that two entirely different folders can share. A card from a folder scan carries no hash at all and says why, in the place the hash would have been. Scan the built file if you want a card somebody else can check.

This tool was called VibeCheck until this release. The name collided with several products doing a different job, and it filed this one alongside scanners that read a deployed website rather than a compiled application.

• It is called Halation now. Halation is light bleeding past the edge of where it should be, which is what the highest-severity checks look for: keys and tokens outside the boundary they were meant to stay inside. Nothing about what the tool does has changed.
• Your settings come with you. The audience choice, window position, update preference and, if you set one, your encrypted API key and endpoint are carried over the first time this release runs. They are copied rather than moved, so the old folder is left untouched and the previous build still works.
• The executable is Halation.exe. Existing shortcuts pointing at the old filename will not find it.
• Fixed: the version reported to OSV when checking dependencies was hardcoded and had said 0.1 since the first release regardless of the build.

The release that made the score mean the same thing in everybody's report, and stopped the interface asking questions after it was too late to answer them.

• The score is deterministic only. One unchanged application scored 99, 41 and 75 through three different AI backends. A number that moves with the reader's model is a sample rather than a measurement, so assisted findings are now reported in full and take no part in the arithmetic. They keep one power: a result cannot be labelled clean while its suggestions sit underneath it.
• A setup step before the scan. Dropping a file used to start the scan on the spot, which meant the deep pass settings under the drop zone only ever applied to the next one. Browsing became two buttons, because Windows has no dialog that accepts either a file or a folder.
• Advice for the reader who accounts for a capability. A cleaner's author confirming a reason to read browser cookies used to be answered with "Do not run this application" directly under the sentence recording their confirmation.
• Signature checks now cover .NET and Electron builds, and a catalogue-signed file is no longer reported as unsigned.
• Quoted author comments are verified against the file before being printed as the author's words. The feature fabricated all three of its answers on its first live run against a local model.
• Silent prompt truncation is detected on the endpoint route, where an input ceiling can be half the advertised context.
• A Go or PHP project used to be told "The code here is languages these checks do not name individually", a broken sentence shown to exactly the reader it was written for.

The release that cleared the last three things standing between this and being usable by other people.

• Purpose-aware severity. Reading a browser cookie database is what a password stealer does and what a cleaner does, so the tool used to tell the author of a cleaner not to install their own work. It now asks about the specific behaviour it observed, and prints the answer back in the report.
• The deep pass reaches beyond Anthropic. Any OpenAI-compatible endpoint, hosted or local, with Ollama and LM Studio detection and hardware-aware advice about which models a machine can carry.
• Windows Store packaging proved out, with no size penalty and no settings migration needed for anyone moving from a downloaded build.
• The application now knows whether it is running from a package, because two file-layout heuristics both lie inside one.

The first packaged build. Most of what the tool is now was decided in the fortnight around it.

• Two readers, each getting the severity, wording and remedy that answers their own question, with one shared number that is the harsher of the two readings.
• Scores gained a floor as well as a cap. Before this, three criticals and forty of them scored identically at zero, and five highs scored 0 while being reported as "critical issues".
• Capabilities stopped being defects. Updating itself and starting with Windows are how a great many correct programs work; charging them a band of score was the scanner calling a feature a fault.
• A scanner stopped scanning itself. Pointed at its own build it scored 16/100 and advised against installing itself, on nine findings that were all its own rule table read as the behaviour the rules describe.
• Windows installers are unpacked, because almost nothing is downloaded as a bare executable and reading only the stub writes off everything worth checking. One 102 MB installer went from "could not analyse" to 285 application files.
• Dependencies resolve from vendored manifests, not only lock files. One shipped application read as 100/100 with no known issues while carrying four separately vulnerable packages.
• Language coverage widened so a Go, Rust, PHP or Ruby project is read at all. Those used to report "no readable text files were found" and no score, which is invisible rather than clean.
• The shipped theme, and with it the ability for a theme to own shape and motion rather than only colour.