"My checks" — one list of services you configure once, on the Settings
tab, and open with a single click from the extension window. Indicator
types are not selected: they follow from the contents, so parsing opens
the services on the list that work with what was found — network
services for an address, sandboxes for a hash, certificate transparency
for a domain. One click, no confirmation step: the number of tabs is
printed on the button before you press it.

The list starts empty. One button fills it from the six check
sequences that ship with the registry, and the extra ones are dropped
by hand — the union of all six is eighteen services for an address, and
an extension that opens eighteen tabs on a fresh install is not a
convenience.

The extension window applied the data-mode gate but not the own and
customer ranges distributed by browser policy. In public mode an
address from your own subnets could be sent to a public service from
that window, while the console refused and named the policy entry that
fired. The same policy now applies on every surface.

The case warns when it has changes that were never exported, and the
browser asks before a tab holding one is closed. The case lives in the
browser profile; "export before you close" used to rest on the
analyst's memory at the end of a shift.

First stable release. The jump from 0.63.0 carries no code change of its
own: the number says the extension is done, not that it gained a feature.

Since 0.61.0:

Counters and trackers no longer reach the indicator list. 121 domains of
web analytics, trackers, ad networks, captchas, consent banners and chat
widgets are moved into the "filtered as page furniture" group — with the
reason shown, counted, and one click away from coming back. Nothing is
deleted: a counter can be an indicator, and the Google Analytics
Measurement Protocol is used for exfiltration.

The tool registry grew from 89 to 103 services: FIRST EPSS, OSV.dev, CVE
Details, Joe Sandbox Cloud, Filescan.io, CIRCL hashlookup, OpenPhish,
PhishStats, CheckPhish, Google Safe Browsing site status,
Ransomware.live and Ransomwhere. The RIPEstat entry pointed at an
address that site no longer serves; it now opens the resource page, and
it works for prefixes as well as addresses.

Source search holds 254 sites across six profiles, up from 185, and the
order now follows the interface language: with an English interface the
Russian-language sites move out of the eight slots that a direct search
query can hold. Nothing is removed — with SearXNG every site is queried.

Counters and trackers are no longer listed as indicators.

Parsing a web page used to put analytics URLs next to the real findings — a 700-character Roistat counter address, Google Analytics, Yandex.Metrica. The only thing that made them indicators was that they are syntactically valid URLs.

This version knows 121 domains of counters, trackers, ad networks, captchas, cookie-consent banners and chat widgets, and moves them out of the main list.

Nothing is deleted. A filtered value goes to the "filtered as page furniture" group with the reason "counter, tracker or page widget", is counted there, and comes back with one click — the same as a running header or a link to a social network. A counter can be an indicator too: the Google Analytics Measurement Protocol is used for exfiltration.

Matching is by domain and its subdomains, never by substring, so roistat.com.attacker.tld and fake-roistat.com stay in the main list. Hosts that also carry payloads — github.io, pages.dev, workers.dev, s3.amazonaws.com, link shorteners — are not on the list at all.