Commit graph

Select branches

Hide pull requests

main

v0.1.0

v0.2.0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.4.0

v0.5.0

v0.6.0

v0.6.1

v0.7.0

v1.0.0

v1.1.0

v1.10.0

v1.11.0

v1.2.0

v1.3.0

v1.4.0

v1.4.1

v1.4.2

v1.5.0

v1.6.0

v1.7.0

v1.8.0

v1.9.0

Mono Color

• 5d1a59df4b
  
  docs(status): mark the guard beta, not stable main Kjell Tore Guttormsen 2026-11-02 12:54:19 +01:00
• c2fbbf037d
  
  docs(plan): record the repo-standard run on the public surface (V.5) Kjell Tore Guttormsen 2026-11-02 11:54:20 +01:00
• 176f7198d8
  
  docs(plan): record the weekly watch set-up for row 1 (V.11) Kjell Tore Guttormsen 2026-11-02 10:05:54 +01:00
• 9385b2ba24
  
  chore(release): 1.11.0 v1.11.0 Kjell Tore Guttormsen 2026-11-01 20:26:11 +01:00
• 6c448f775f
  
  chore(watch): re-run the edition watch before 1.11.0 Kjell Tore Guttormsen 2026-11-01 20:23:23 +01:00
• 7430d7855a
  
  feat(active): grade a short URL token that base64-decodes to text as carrying Kjell Tore Guttormsen 2026-11-01 20:23:23 +01:00
• 6cf0eb1263
  
  chore(release): 1.10.0 v1.10.0 Kjell Tore Guttormsen 2026-11-01 18:55:08 +01:00
• 2044ea3b72
  
  chore(watch): re-run the edition watch before 1.10.0 Kjell Tore Guttormsen 2026-11-01 17:07:50 +01:00
• 0eab4345bf
  
  feat(output): decode hex-wrapped credentials at the persist gate Kjell Tore Guttormsen 2026-11-01 17:06:44 +01:00
• 61d7d521e4
  
  chore(release): 1.9.0 v1.9.0 Kjell Tore Guttormsen 2026-11-01 14:57:53 +01:00
• 6eae238261
  
  chore(watch): re-run the edition watch before 1.9.0 Kjell Tore Guttormsen 2026-11-01 14:57:11 +01:00
• 736bf7882f
  
  feat(lexicon): count every match of a pattern, and give four gaps a measured reason Kjell Tore Guttormsen 2026-11-01 14:57:11 +01:00
• c4ecf0dba6
  
  feat(watch): source list for the 16 catalogs and the 30-day release rule Kjell Tore Guttormsen 2026-11-01 12:50:51 +01:00
• 56fcc844d6
  
  docs(plan): record the operator's decision that gap 7 stands with a measured reason Kjell Tore Guttormsen 2026-11-01 12:39:08 +01:00
• 0ed305e979
  
  docs(plan): measure which watch probe answers each catalog and freeze the seven gaps Kjell Tore Guttormsen 2026-11-01 11:33:52 +01:00
• 136d9311e5
  
  docs(plan): new direction - keep catalogs current over time and close the documented gaps Kjell Tore Guttormsen 2026-11-01 08:36:54 +01:00
• 067e7aee89
  
  docs(plan): record the anonymous verification after the move to open/ Kjell Tore Guttormsen 2026-11-01 08:08:47 +01:00
• f34a424447
  
  docs(plan): record the final measurement on 1.8.0; the repo is public again Kjell Tore Guttormsen 2026-10-31 21:57:43 +01:00
• cde4431031
  
  fix(llms): pin the install line to 1.8.0 and hold every pin to the version Kjell Tore Guttormsen 2026-10-31 21:57:43 +01:00
• d43403b8aa
  
  chore(release): 1.8.0 v1.8.0 Kjell Tore Guttormsen 2026-10-31 21:28:17 +01:00
• 61ee8d3445
  
  feat(output): report an instruction in plain prose Kjell Tore Guttormsen 2026-10-31 21:20:32 +01:00
• e7742dceba
  
  chore(release): 1.7.0 v1.7.0 Kjell Tore Guttormsen 2026-10-31 19:49:27 +01:00
• eeb7bf07f6
  
  feat(active): report a run of images whose order carries a value Kjell Tore Guttormsen 2026-10-31 19:33:51 +01:00
• d00d1b0658
  
  chore(release): 1.6.0 v1.6.0 Kjell Tore Guttormsen 2026-10-31 17:04:02 +01:00
• 0ebe8abdbd
  
  feat(output): report hidden markup — tiny font, invisible colour, comments outside code Kjell Tore Guttormsen 2026-10-31 17:01:39 +01:00
• 8f08b1906e
  
  docs(catalogs): wire ASI06 and ATLAS v2026.10 into the README, date every source Kjell Tore Guttormsen 2026-10-31 16:29:35 +01:00
• 3eb8e9e9a9
  
  chore(release): 1.5.0 v1.5.0 Kjell Tore Guttormsen 2026-10-31 14:28:48 +01:00
• 1c6816cdfe
  
  fix(owasp): qualify every catalog number with the 2026 edition Kjell Tore Guttormsen 2026-10-31 14:20:35 +01:00
• 1241075ef8
  
  chore(release): 1.4.2 v1.4.2 Kjell Tore Guttormsen 2026-10-29 08:31:59 +01:00
• c72e648a94
  
  fix(sanitize): catch every invisible codepoint, exempt only on context Kjell Tore Guttormsen 2026-10-29 08:31:43 +01:00
• 08ca8f61bc
  
  docs(plan): fix the attack batches at three sessions, 5-7 Kjell Tore Guttormsen 2026-10-28 21:30:06 +01:00
• 69e80f26a1
  
  docs(plan): record session 1 measurements and the scope decisions Kjell Tore Guttormsen 2026-10-28 21:27:33 +01:00
• e4e18b38d7
  
  test(threat-2026): one case per known 2025-2026 attack, red where not caught Kjell Tore Guttormsen 2026-10-28 21:27:33 +01:00
• e702505312
  
  docs(threat-2026): register the threat catalogs at their newest editions Kjell Tore Guttormsen 2026-10-28 21:27:32 +01:00
• 2e3d33efb4
  
  test(threat-2026): freeze the catalog-number census at v1.4.1 Kjell Tore Guttormsen 2026-10-28 21:27:31 +01:00
• 61475686bf
  
  docs(plan): keep the repository private until the upgrade, then move it to open/ Kjell Tore Guttormsen 2026-10-28 21:06:14 +01:00
• f19f434b54
  
  docs(plan): plan the move to the 2026 threat catalogs Kjell Tore Guttormsen 2026-10-28 20:55:41 +01:00
• 6702d7a569
  
  docs(readme): the package index is the range-pinning channel from 1.4.1 Kjell Tore Guttormsen 2026-09-23 17:06:10 +02:00
• 57c91aeb11
  
  chore(release): 1.4.1 v1.4.1 Kjell Tore Guttormsen 2026-09-23 12:46:32 +02:00
• 639da03f8c
  
  fix(okf): a flow sequence admits '#' and ':' where YAML reads them as text Kjell Tore Guttormsen 2026-09-23 12:44:09 +02:00
• 79285e1265
  
  docs: finish the 1.4.0 release on the doc surfaces Kjell Tore Guttormsen 2026-09-23 12:25:33 +02:00
• d19de8cb38 chore(release): 1.4.0 v1.4.0 Kjell Tore Guttormsen 2026-09-08 06:10:53 +02:00
• 3e324a1f86 feat(okf): a flow sequence of plain scalars parses, and the corpus number is 6/53 Kjell Tore Guttormsen 2026-09-08 05:34:55 +02:00
• 6e7c8d2b98 docs(okf): measure the tags/description gap against the pinned SPEC and corpus Kjell Tore Guttormsen 2026-09-06 23:58:02 +02:00
• 44e2b31afd test(okf): pin the two boundary classes the new carriers introduced v1.3.0 Kjell Tore Guttormsen 2026-09-02 17:26:08 +02:00
• a965e8ac5b feat(okf): sources becomes expressible, and the parent key is what admits resource Kjell Tore Guttormsen 2026-09-02 17:21:26 +02:00
• 0184df9ed9 docs(limits): tags and description block the whole OKF corpus before sources is even read Kjell Tore Guttormsen 2026-08-25 08:27:22 +02:00
• 9aeceb02c0 release: 1.2.0 -- the OKF mapping-form fix becomes pinnable v1.2.0 Kjell Tore Guttormsen 2026-08-23 20:13:50 +02:00
• 58704834b6 feat(okf): the mapping class gets one expressible form, typed and allowlisted Kjell Tore Guttormsen 2026-08-21 21:04:51 +02:00
• 7cb4553301 docs(llms): add llms.txt per org D2b decision (21.08) Kjell Tore Guttormsen 2026-08-21 11:24:00 +02:00
• 01f6f382c4 test(docs): pin docs/redos-sweep.py under test.py's contract Kjell Tore Guttormsen 2026-08-20 23:10:25 +02:00
• 74656123f9 docs(redos): the sweep now measures on the clock its own numbers justify Kjell Tore Guttormsen 2026-08-18 16:56:01 +02:00
• 4472f209a4 docs(limits): seven shipped behaviours were only in the code, and one of them was written down wrong Kjell Tore Guttormsen 2026-08-17 12:15:00 +02:00
• 2b03b8d643 docs(security): add contact email, https scheme on Forgejo URL Kjell Tore Guttormsen 2026-08-16 21:15:10 +02:00
• 246e1fc1d3 docs(readme): add table of contents Kjell Tore Guttormsen 2026-08-16 16:16:57 +02:00
• 45c2b06315 docs: "warn, clean" is graded, never cleaned bytes -- measured at okf's door Kjell Tore Guttormsen 2026-08-13 23:24:38 +02:00
• 869f9058f7 docs: the fix closed a type confusion, not pointer-smuggling as a class Kjell Tore Guttormsen 2026-08-13 23:05:52 +02:00
• ca4f97c8c9 release: 1.1.0 -- the first behaviour change shipped under the freeze v1.1.0 Kjell Tore Guttormsen 2026-08-13 22:58:36 +02:00
• da30211bc7 fix(okf): a mapping construct no longer degrades into a string, and there were two routes Kjell Tore Guttormsen 2026-08-13 22:58:27 +02:00
• 6cd4694613 docs(plan): Session G landed, D4's rationale lives where the promise does, and the ninth surface was verified not bumped Kjell Tore Guttormsen 2026-08-13 22:45:11 +02:00
• 98ebc07b56 release: 1.0.0 -- the exported Python surface is frozen under semver v1.0.0 Kjell Tore Guttormsen 2026-08-13 22:20:48 +02:00
• e9d8fb2b9d docs(limits): two limits are conceded for 1.x, and the last 'pending' is retired Kjell Tore Guttormsen 2026-08-13 22:15:02 +02:00
• ab6000b1af docs(gate): the surface claim covers okf too, and one branch of D4 is already a defect Kjell Tore Guttormsen 2026-08-13 22:07:18 +02:00
• aff35118bf docs(gate): the v1.0 freeze is countable, and two of thirty-five limits are the gate Kjell Tore Guttormsen 2026-08-13 22:02:28 +02:00
• 2466d260d3 test(redos): the dead row had the wrong payload, and the last wall clock is retired Kjell Tore Guttormsen 2026-08-13 21:47:43 +02:00
• c48a2923ac test(redos): one CPU clock for every bound, and a second row measured dead Kjell Tore Guttormsen 2026-08-13 21:25:36 +02:00
• 566706360a test(output): the ReDoS bounds move to CPU time, and the long-attribute row was dead Kjell Tore Guttormsen 2026-08-13 21:02:31 +02:00
• be9759b4b3 docs(census): the two wiki corpora are measured, and the tightening is thinner than zero looked v0.7.0 Kjell Tore Guttormsen 2026-08-13 20:22:18 +02:00
• 72de0e0c15 docs(claude-md): the linking example published one machine's home directory Kjell Tore Guttormsen 2026-08-13 20:08:12 +02:00
• fcfaee4589 feat(active-content): raw HTML graded on carrier, and a tag naming no target is inert Kjell Tore Guttormsen 2026-08-12 00:42:44 +02:00
• 0df7e87c2f test(docs-scripts): the census re-derived the URL reader it measures, and nothing would have caught the drift Kjell Tore Guttormsen 2026-08-11 23:01:58 +02:00
• 0903785187 release(0.6.1): the ZWJ fix gets a tag a consumer can pin v0.6.1 Kjell Tore Guttormsen 2026-08-11 22:30:32 +02:00
• a59184bb7f fix(zwj): the zero-width check tested identity, so every emoji-composed document was hard-blocked Kjell Tore Guttormsen 2026-08-11 22:14:47 +02:00
• 1d49f83a61 test(redos): the lexicon-iframe-src row already discriminates at the shared N Kjell Tore Guttormsen 2026-08-11 21:52:04 +02:00
• ee73062864 test(redos): the lexicon-script-tag row denied the literal but not the bound Kjell Tore Guttormsen 2026-08-11 21:40:43 +02:00
• 6bcb898632 release(0.6.0): the raw-html narrowing ships, and the version claims it already made become true v0.6.0 Kjell Tore Guttormsen 2026-08-11 18:01:36 +02:00
• 736f370cfb fix(active-content): raw-html graded two inert shapes HIGH, and the fix moved a second surface Kjell Tore Guttormsen 2026-08-11 16:56:31 +02:00
• e671edb96f measure(rawhtml): the over-reach classes co-occur, so one-at-a-time understates both Kjell Tore Guttormsen 2026-08-11 13:50:29 +02:00
• 6e87a0ff16 docs(limitations): the raw-html FP rate was blamed on the wrong bullet Kjell Tore Guttormsen 2026-08-11 13:15:14 +02:00
• 0dce50fb05 docs(plan): the v1.0 gate rested on okf's old pin, and its file list on four surfaces Kjell Tore Guttormsen 2026-08-11 06:46:29 +02:00
• f669479777 release(0.5.0): the assessment axis ships, and every version surface moves with it v0.5.0 Kjell Tore Guttormsen 2026-08-11 06:42:56 +02:00
• d3d0928c17 docs(changelog,limitations): 0.3.3 named two behaviour-change classes, there were three Kjell Tore Guttormsen 2026-08-10 21:39:10 +02:00
• d1bff6047d measure(fp): the upload door costs a human on 16-53% of benign documents Kjell Tore Guttormsen 2026-08-10 21:32:56 +02:00
• 398eb7407b docs(plan): kill the pointer that sent this session to the wrong section Kjell Tore Guttormsen 2026-08-10 21:01:19 +02:00
• de097110d2 feat(disposition): separate the assessment axis from the action Kjell Tore Guttormsen 2026-08-10 20:55:46 +02:00
• 3c56d50e05 docs(readme,adoption-brief): advertise v0.4.0, now that it installs Kjell Tore Guttormsen 2026-08-10 14:51:11 +02:00
• 73ad5e1ed8 release(0.4.0): the raise is breaking, so the number says so v0.4.0 Kjell Tore Guttormsen 2026-08-10 14:49:47 +02:00
• b90233481a feat(active-content,okf): bound the last two detection surfaces Kjell Tore Guttormsen 2026-08-10 14:48:54 +02:00
• 0bf07295c2 docs(readme,security,contributing): meet the repo standard — 0 ERROR Kjell Tore Guttormsen 2026-08-03 21:59:07 +02:00
• 0add3e7e96 docs(readme,limitations): stop advertising a version that was not chosen Kjell Tore Guttormsen 2026-08-02 21:21:21 +02:00
• 7ee1ed13af docs(changelog): the two consumers are not pinned the same way Kjell Tore Guttormsen 2026-08-02 21:15:07 +02:00
• 2d98d6809d feat(sanitize,fence,neutralize): reject oversize input instead of half-transforming it Kjell Tore Guttormsen 2026-08-02 21:13:08 +02:00
• adf93e47fb release(0.3.4): three quadratic patterns outside the lexicon, two on the input path v0.3.4 Kjell Tore Guttormsen 2026-08-01 20:08:51 +02:00
• 73fa1b99ae fix(sanitize,okf,active_content): three quadratic patterns, two on the input path Kjell Tore Guttormsen 2026-08-01 20:06:36 +02:00
• abbfe5f0fd docs(redos): sweep every regex surface, not just the lexicon Kjell Tore Guttormsen 2026-08-01 19:57:59 +02:00
• 23475f9ec6 docs(redos): preserve the arm-by-arm sweep that found the 0.3.3 patterns Kjell Tore Guttormsen 2026-07-31 21:55:51 +02:00
• 701a4a47c7 release(0.3.3): the lexicon ReDoS fix, and a correction to 0.3.2's claim v0.3.3 Kjell Tore Guttormsen 2026-07-31 21:51:00 +02:00
• b8028ba870 fix(lexicon): two quadratic patterns, reachable through the output gate too Kjell Tore Guttormsen 2026-07-31 21:50:51 +02:00
• 75ae48277b release(0.3.2): the ReDoS fix, with both residuals measured against the v0.3.1 tag v0.3.2 Kjell Tore Guttormsen 2026-07-31 21:16:45 +02:00
• cff043787d fix(output): 19 quadratic regex runs on the output path, worst ~5.7h at the cap Kjell Tore Guttormsen 2026-07-31 18:31:58 +02:00