v0.7.1 — v11b Model + Evasion Suite + Normalization

v11b Neural Threat Detection Model

• Model: Char CNN-BiLSTM v11b (matches Platform and Lens)
• ExpectedModelHash: 8e13c793...
• Threshold: 0.5 (calibrated for 0% FPR)

What's New

• Text normalization (internal/detectors/normalize.go): keyWalkReverse, homoglyph, l33t, zero-width Unicode, ROT13, repeating char collapse
• 2,600-test adversarial evasion suite (internal/detectors/evasion_suite_test.go)
• Version refs synced to 0.7.0 (was stale at 0.6.2)
• OPSEC hardening: pre-commit hooks, CODEOWNERS, PR template, issue template

Bug Fixes

• Fixed hardcoded version in platformforward (now uses version.Version)
• Fixed CI lint failures (errcheck, staticcheck, gofmt)

Full Changelog: v0.7.0...v0.7.1

What's Changed

• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #30
• chore(deps): bump trufflesecurity/trufflehog from 3.97.1 to 3.97.4 by @dependabot[bot] in #32
• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #29

Full Changelog: v0.7.0...v0.7.1

What's Changed

• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #30
• chore(deps): bump trufflesecurity/trufflehog from 3.97.1 to 3.97.4 by @dependabot[bot] in #32
• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #29

Full Changelog: v0.7.0...v0.7.1

What's Changed

• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #30
• chore(deps): bump trufflesecurity/trufflehog from 3.97.1 to 3.97.4 by @dependabot[bot] in #32
• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #29

Full Changelog: v0.7.0...v0.7.1

What's Changed

• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #30
• chore(deps): bump trufflesecurity/trufflehog from 3.97.1 to 3.97.4 by @dependabot[bot] in #32
• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #29

Full Changelog: v0.7.0...v0.7.1

v0.7.0

What's Changed

• chore(deps): bump docker/setup-buildx-action from 3.0.0 to 4.3.0 by @dependabot[bot] in #24
• chore(deps): bump trufflesecurity/trufflehog from 3.90.0 to 3.97.1 by @dependabot[bot] in #25
• chore(deps): bump stefanzweifel/git-auto-commit-action from 7.0.0 to 7.2.0 by @dependabot[bot] in #26
• chore(deps): bump docker/build-push-action from 7.0.0 to 7.3.0 by @dependabot[bot] in #27
• chore(deps): bump softprops/action-gh-release from 2.0.0 to 3.0.2 by @dependabot[bot] in #28

Full Changelog: v0.6.2...v0.7.0

v0.6.2 — Security Audit Remediation

Security Audit Remediation

56 findings resolved (4 CRITICAL, 13 HIGH, 22 MEDIUM, 17 LOW) from a comprehensive 5-phase security audit. 39 fixes applied, 17 accepted with documented justifications.

Critical (4)

• C1: AppleScript injection in notify.go (escape backslashes before quotes)
• C2: Dual CA certificate vulnerability — new LoadCAFromFiles() method
• C3: Open proxy / SSRF — bind to 127.0.0.1, add isBlockedAddress() + isBlockedIP()
• C4: pprof debug server now requires token-based auth

High (13)

• Race condition in isTargetDomain() (RLock)
• Detection bypass — 503 block instead of tunnel fallback
• Cert cache size limit (1000 with eviction)
• AEAD-only TLS cipher suites
• CA path length constraint (MaxPathLen: 0)
• Shared DefaultTransport with explicit TLS config
• Webhook SSRF validation (validateWebhookURL())
• Enterprise gate offline/non-401 handling
• PBKDF2 iterations 100K → 600K
• Key zeroing after AEAD creation

Supply Chain

• golang.org/x/crypto v0.54.0 → v0.55.0
• 65 CI action tags pinned to full semver
• Shell injection in CI workflows fixed

Verification

• go vet: clean | go test -race: 29/29 pass, 0 races
• govulncheck: 0 called | gitleaks: 0 leaks | semgrep: 0 findings
• fuzz: 5K+ executions, 0 crashes

Full details: CHANGELOG.md

v0.6.1 — 18 SOC Detection Patterns + Go 1.26.6

⚠️ ARCHIVED — END OF LIFE. This version is no longer supported. Security fixes are only applied to v0.6.2 (Latest). Do not report vulnerabilities against archived versions.

What's New

Detection Patterns

• 18 new SOC detection patterns for operational technology
• 177 total detection patterns across compliance, XSS, secrets, PII, and OT protocols

Infrastructure

• Bumped Go from 1.25.0 to 1.26.6 (fixes 5 stdlib vulnerabilities)
• Simplified Dockerfile, RPM version_override macro

CI/CD Fixes

• Fixed build-container and sbom-attest permissions
• Fixed RPM version mismatch
• Bumped git-auto-commit-action v5→v7

Stats

• 1,318 tests passing with -race
• 80.5% coverage (CI filtered)
• Apache 2.0 licensed

v0.6.0

⚠️ ARCHIVED — END OF LIFE. This version is no longer supported. Security fixes are only applied to v0.6.2 (Latest). Do not report vulnerabilities against archived versions.

Enterprise features, self-hosted LLM support, batch scanning, audit log, certificate trust, tray integration, platform forwarding.