Changelog

When a Cloudflare-protected target served a real geo-block page (451) after the challenge passed, the Browser product was reporting it as a 200 because the watcher hardcoded the cleared status. The watcher now reads the actual post-clearance Document, so a 200 stays 200, a 451 surfaces as 451, and Auto rejects the wrong content and keeps searching for an exit that genuinely matches your validate rules.

The Cmd+K (Ctrl+K) shortcut now opens the command palette and search modal regardless of keyboard layout. We were matching the typed character (к on a Cyrillic layout), so anyone on a non-Latin layout got nothing. Now we match the physical key. Fixed across the main site, the blog, and the docs.

A cold Auto solve can take several minutes, and the request now stays open for its whole budget. Errors from any layer come back as JSON your client can parse.

Cookie-reusable sites (bet365 was the canary) were sticking on the expensive browser solve at 15 credits per request instead of dropping to the cheap 2-credit replay after the first solve. Two bugs: the latch fired on any transient transport error, and a successful browser replay never refreshed the session cookies. Fixed both. Repeat requests on a cookie-reusable site now cost 2 credits after the first solve, exactly as the pricing implies.

We've tightened cross-origin access so only foura.ai can call the API with credentials. We also hardened an input filter on the metrics endpoint and dropped a development-only fallback secret. Existing integrations don't change.

If you've set validate.status.accept on a request, the engine treats an accepted non-200 as a clean success. Activity was still labeling those as failures, which threw off your usage stats. Outcomes now follow your validate verdict, so a 403 you accepted shows up as success, not App Fail.

If you were scraping Cyrillic, Chinese, Japanese, or other non-UTF-8 pages through Single, the body used to come back as mojibake. We were force-decoding every response as UTF-8 before you saw the raw bytes. Now we read the charset from the response (Content-Type, then <meta charset>, then UTF-8 fallback) and decode it correctly. Thanks, Alexandar Kanchev (Sensika), for reporting this.

Some proxies in the wild don't actually forward your request. They echo it back as a plaintext server dump and try to harvest what's inside. We now spot that pattern before the response hits your code, so Single, Browser, and Proxy Finder all return an honest failure (or retry) instead of the garbage.

We fixed a slowdown that kept newly discovered proxies waiting before they got validated. Proxy Finder now checks them right away, so the pool stays fresher with more live, working proxies in rotation.

Playground now tracks the Domain attribute properly, so host-only cookies stay on their host. The Parsed view marks them with an HO badge, and Raw matches what the upstream sent.

Every Playground field is now schema-aligned: Browser forces GET, hides the body textarea, and the Raw tab shows the exact JSON that hits the API plus a curl reproducer.

With unblocker: true, Single and Proxy Finder now carry the full unblocker signature all the way to the origin, so anti-bot walls that check it let the request through.

Some Cloudflare sites return 200 OK but inject a background script that issues the real cf_clearance cookie a moment later. Browser used to return the page before that cookie arrived, leaving the jar empty. Now Browser waits for the cookie event, so you get a clean cf_clearance you can replay through Single or Proxy.

The Older button on the blog used to send you back to page 1. Pagination now lives at /blog/page/N/ URLs with numbered navigation, so you can actually browse older posts. Thanks, Vladimir Petrov.

Browser now runs every request through the JavaScript engine, so Cloudflare challenges and JS-heavy pages render as expected.