Highlights
An organization used to be a row that could only ever hold one person. Now it's a page you run: invite a colleague, hand them a role, let them create keys the company pays for. Proxy Finder also stopped answering "out of tries" and started naming the wall it hit, and Browser spent the week making sure it tells a page the same story twice.
What's New
Organizations you can actually run
Adding a colleague used to mean emailing us, so teams bought two unrelated subscriptions.
Your organization has its own page in the Dashboard now, with three roles behind it. The owner carries the subscription its keys bill against, so there's exactly one and ownership moves by transfer. Admins handle usage, billing and members. Members use the thing. Invitations go by email address and work for someone who's never signed up.
Anyone in an organization can create keys it owns and move a personal key into it, so a developer doesn't need a personal key that bills them for company work. Usage on an org key bills the owner's plan, and every confirmation says whose plan pays. Any member can rename a key; regenerating, disabling and deleting stay with owners and admins, since those stop every colleague using it the instant they happen.
One Owner filter runs across Overview, Detailed Metrics, Recent Activity and your key list. Usage & Limits and Billing stay personal, since a member has no business reading the owner's quota.
Proxy Finder stops guessing
"Download maxTry limit reached" read the same whether every exit was blocked, every exit was dead, or we fetched the genuine page and your own rule threw it away. Those three need opposite fixes.
A failed task now carries attemptReport: how many exits never answered, how many a recognised defense refused and which vendors did it, how many your validate.status rejected, and how many returned HTTP 200 with no defense in sight and failed only your validate.data. A plain summary sentence comes with it.
But that last count is the one worth having. A content rule that can't match looks exactly like being blocked from every angle we used to measure, and no retry will ever fix it. (More on how validate rules decide success.)
So the other half is the profile. Proxy Finder rotated exits and never the client signature, so a site refusing one browser profile refused it at every exit in the pool. A refusal moves the profile now, on a retry that was already going to happen, so requests and credits per task don't change. Pin profile yourself and nothing changes. On the hardest targets, mind you, the exit you land on still matters more than the profile you send.
Browser stops contradicting itself
Asking Browser for a User-Agent used to be worse than not asking. Three layers each had their own idea of who the request was, so one request could claim Windows, a Mac and a version the fleet wasn't running, all at once. One value now, decided once, carried everywhere: the launch, the page, the workers the page starts.
Client hints are derived from that string, so sec-ch-ua, the platform and navigator.platform agree with it. The response reports back the string we actually sent, which matters because clearance cookies are bound to the exit and the User-Agent together. The renderer question also answers the same way in the document and in a worker now, one more of the weak signals that add up.
Three more landed with it:
- The clock follows the exit. Browser runs in the timezone of the country your exit sits in, so a page rendering local times shows what a visitor from there would see. When the country isn't known, the clock is left alone.
- WebRTC stays on the same path as everything else. A proxy setting covers what a browser sends over TCP. WebRTC isn't on that path, so a page asking it for ICE candidates gets a separate answer. Browser switches that off whenever a request carries an exit.
- Anchored URLs cost what they should. A URL ending in
#reviewsused to run the clock out every time. It's back at normal speed.
Cheaper routes, and a Dashboard that counts straight
Imperva injects its script into healthy pages, not only its block pages, and Auto couldn't tell the two apart, so healthy pages escalated to a browser for nothing. On a car rental site that was 75 credits and 27.5 seconds across six attempts; it's one attempt now, 10 credits, about six and a half seconds. Some sites hand you a session inside the refusal they answer a session-less request with, and all four engines now send it straight back before escalating.
The Overview credits card showed everything spent and labelled it billed. Under pay-for-success those differ, and the gap is real money, so both are on the card: billed as the number, spent underneath, per product and in total. The Requests card splits the same way. Period and detail are separate controls too, from 30 minutes to a year plus a custom range, retiring the pill that read "1D" and opened thirty days.
In the Playground, the carry button now offers the profile from the last response, so a request that went out under a profile you didn't type replays the version that worked. Every parameter is in the API reference.
Under the Hood
Proxy Finder keeps more history per host: 32 exits instead of a dozen. On a live A/B it was level on easy targets and better on hard ones, where median time to a page went from 5.5s to 3.8s while fleet-wide latency didn't move. One target went the other way and we don't know why yet, so it gets its own measurement.
A task that's going to fail will fail either way. The difference is whether you close the ticket in a minute or spend the afternoon measuring the wrong thing.