Changelog

Updates itself, with your click: Settings → Updates checks pqdoctor.com/updates/flarebox.json, shows the new version and its notes, and installs only after you confirm. Every installer is signature-checked against Flarebox’s own key before it runs. See Updating. Coming from 0.2.0, install 0.2.1 by hand once.
Linux: a .deb for Debian and Ubuntu (x86_64, WebKitGTK 4.1), which updates through the app like Windows. See Install.

pqdoctor 0.2.1

No change in behaviour. New ways to install: Homebrew, Scoop, winget and cargo binstall. See Package managers.

0.2.0 2026-10-16

The first downloadable Flarebox, and pqdoctor 0.2.0 on Windows, macOS, Linux and crates.io. Its files stay at /downloads/v0.2.0/.

Flarebox 0.2.0

Readiness report: a one-page PDF per zone with a transparent score, origins fixed and not fixed, the public deadlines and the CBOM.
Mail servers (MX): every server that receives a zone’s mail, checked over SMTP STARTTLS, with history and fixes, and an honest answer when your network blocks port 25.
Services a Worker calls: the outside services a deployed Worker really calls, from Cloudflare’s own records, checked one at a time.
Authenticated Origin Pulls with ML-DSA: the origin checks Cloudflare with a post-quantum client certificate, set up in a safe order and verified in three steps.
Crypto in your code reads Go, Python and Rust as well as JavaScript and TypeScript.
A polish pass over every screen, and Flarebox’s own redrawn icon set.
Bundles pqdoctor 0.2.0 with the library’s 0.1.0-compatible defaults, so the app’s checks are the same as before.

pqdoctor 0.2.0

The library’s defaults are unchanged, so Flarebox and pqdoctor on Workers run the same checks as in 0.1.0.

Group survey: every post-quantum group the server accepts (SecP256r1MLKEM768, SecP384r1MLKEM1024, MLKEM512/768/1024), a CNSA 2.0 note, and the new cause pq-other-group.
Certificate trust against Mozilla’s roots: trusted, expired, name-mismatch, untrusted-root, self-signed.
QUIC and DTLS: pqdoctor quic, pqdoctor dtls, --quic, --dtls.
STARTTLS for FTP, XMPP, LDAP, PostgreSQL, MySQL and RDP.
--audit (versions, TLS 1.2 suites, weak features by configuration only) and --middlebox.
Proxies: HTTP CONNECT, SOCKS5, socks5h.
SLH-DSA probe and OIDs, composite / MTC status, SSH post-quantum host keys flagged as drafts.
--format csv, html, sarif, junit; --history, pqdoctor diff, --cbom; scans --all-addresses.
pqdoctor fix for nginx, Apache, HAProxy, Postfix, Dovecot and sshd; a config file; shell completions and a man page.
Fixed: a server that only negotiates NIST curves is no longer reported as “breaks on ML-DSA signature algorithms” (the certificate probe uses X25519); it’s “ML-DSA readiness unknown”.

0.1.0 2026-10-15

The first release of pqdoctor. Flarebox 0.1.0 was built but not offered for download; 0.2.0 is its first public release. The 0.1.0 files stay at /downloads/v0.1.0/.

pqdoctor

Downloads for Windows x64, macOS 11+ (universal) and Linux x86_64 / arm64 (static), plus cargo install pqdoctor.
Seven handshake-only ClientHello probes and 12 cause codes, with stack-specific fixes for nginx, Apache, HAProxy, Caddy, Node, Go, IIS, Java and mail servers, plus a Cloudflare Tunnel fallback.
ML-DSA readiness: the certificate chain and whether the server serves ML-DSA.
STARTTLS for SMTP, IMAP and POP3; every address of a host; IPv6; any port.
SSH key exchange: ML-KEM and sntrup761, CNSA 2.0, KexAlgorithms fixes.
scan for lists, with pacing, resume, exclusions and CDN skipping.
JSON and JSON Lines output.

Flarebox

Local Workers: project discovery, dev servers in Job Objects, bindings diagram, traffic, logs, D1 / KV / R2 explorer and editing with snapshots, Durable Objects and Workflows, .dev.vars, replay, cron and queue triggers.
Deploy: account picker, bundle check, review of changes, deploy, rollback, gradual rollouts, write-only secrets, live tail with filters, analytics, remote D1 migrations.
Cloudflare account: read and write tokens in Credential Manager; Safety, DNS (batch, import, export), SSL/TLS (HSTS, DNSSEC, Origin CA), Rules and the WAF, Security, Cache and purge, Tunnels with Access, Load balancing, Email, Snippets, Logpush, Pages, Registrar, Zero Trust, Audit log, Usage, live KV / D1 / R2, a 28-product catalog, alerts, timeline, Workers observability, export to BIND / JSON / Terraform.
Post-quantum: per-origin history, daily re-check, regression alerts, fix reports, CycloneDX 1.6 CBOM, risk ranking, 12 public deadlines, an ML-DSA CA and trust store, and a crypto scan of your code.

Known limits

Flarebox is Windows only; the pqdoctor CLI runs on Windows, macOS and Linux. Nothing is code-signed yet.
No auto-updater yet.
Some Cloudflare views have only run against a fake API so far. See What’s proven.

The full engineering changelog, with every fix and how it was verified, is kept in the project repository, which is private for now. Ask for it at hi@kalyangopalam.com.