Kjell Tore Guttormsen 0ebe8abdbd feat(output): report hidden markup — tiny font, invisible colour, comments outside code ... Session 5 of the 2026 threat plan (attack row 3): A04 and A15 were red. - html-obfuscation:tiny-font (HIGH): font below 4px. ShadowLeak's 1px passed because the commons zero-font row only matches a leading 0. - html-obfuscation:invisible-colour (HIGH): text within 8 per channel of the background in the same style attribute, or transparent. White alone is not a signal (email buttons); measured residual in LIMITATIONS. - output:html-comment-present (MEDIUM): a comment in the artifact outside fenced code and inline code. 253/254 comments in the reference corpus sit in code. Local to output.py; the vendored lexicon stays byte-equal with commons. Guard rule before/after: FP 106/198, 196/2918, 108/389 identical; OKF 6/53 and 47/31 identical. Matrix 139/139, ReDoS 161 patterns 0 flagged, suite 1142 passed + 6 xfailed. Row 3: 12 caught, 1 gap, 6 open.		2026-10-31 17:01:39 +01:00
..
threat-2026	docs(catalogs): wire ASI06 and ATLAS v2026.10 into the README, date every source	2026-10-31 16:29:35 +01:00
2026-09-07-limitations-44-maaling.md	docs(okf): measure the tags/description gap against the pinned SPEC and corpus	2026-09-06 23:58:02 +02:00
ADOPTION-BRIEF.md	chore(release): 1.5.0	2026-10-31 14:28:48 +01:00
BRIEF.md	docs(catalogs): wire ASI06 and ATLAS v2026.10 into the README, date every source	2026-10-31 16:29:35 +01:00
catalog-census.py	fix(owasp): qualify every catalog number with the 2026 edition	2026-10-31 14:20:35 +01:00
fp-sweep.py	measure(fp): the upload door costs a human on 16-53% of benign documents	2026-08-10 21:32:56 +02:00
GATE-G-v1.md	docs(gate): the surface claim covers okf too, and one branch of D4 is already a defect	2026-08-13 22:07:18 +02:00
LIMITATIONS.md	feat(output): report hidden markup — tiny font, invisible colour, comments outside code	2026-10-31 17:01:39 +01:00
OKF-INGESTION-BRIEF.md	docs: version-sync + SECURITY/CONTRIBUTING + honest-limits (Session E)	2026-07-15 10:08:24 +02:00
PLAN-v1.md	docs(plan): Session G landed, D4's rationale lives where the promise does, and the ninth surface was verified not bumped	2026-08-13 22:45:11 +02:00
PLAN.md	feat(output): report hidden markup — tiny font, invisible colour, comments outside code	2026-10-31 17:01:39 +01:00
rawhtml-census.py	feat(active-content): raw HTML graded on carrier, and a tag naming no target is inert	2026-08-12 00:42:44 +02:00
redos-sweep.py	docs(redos): the sweep now measures on the clock its own numbers justify	2026-08-18 16:56:01 +02:00
review-2026-07.md	docs: reframe novelty claim to composite write-time contract (review MAJOR #3)	2026-07-15 09:22:38 +02:00
URL-SHAPE.md	docs(url-shape): make the rule reconstructable, and record what three corpora measured	2026-07-27 08:56:24 +02:00