Decloak

You can now sign in to Decloak with Microsoft or GitHub, joining Google, passkeys and email magic link. Microsoft covers personal accounts and Microsoft 365 work accounts. Most security teams and developers already protect these accounts with SSO and MFA, so signing in with them beats creating another password. Decloak never sees or keeps your password or the provider's token. Behind the scenes, we made scans more stable. A years-old Playwright bug was crashing our worker whenever a page added iframes quickly, usually autoplaying YouTube or Vimeo embeds. The error is thrown inside Playwright itself, so our code couldn't catch it, and one bad page took down every scan running at that moment. We reproduced it, now block video player iframes on every scan, and made retries safe so findings are never duplicated. Other reliability fixes: - Database writes retry through brief outages, without creating duplicates - Faster queries on very large scans - The live progress page reconnects if the feed drops - Pentest sandbox errors are retried, and reported as "inconclusive" rather than a clean pass Accuracy fixes, prompted by one customer's feedback on nine WordPress sites: - Patched sites no longer read as "WordPress 2" with hundreds of CVEs - Scripts delayed by caching plugins are now picked up - A HubSpot false positive is fixed - Sites we can't reach now say so, instead of getting an A If a result ever looks wrong, tell us. Most of these fixes started that way. Full write-up: https://decloak.dev/journal/microsoft-and-github-sign-in-are-here-and-scans-are-now-more-stable