v0.1.2 — docs/brand patch

v0.1.2 — docs/brand patch

No scanner changes. 13 patterns, 18/18 tests, fail-open behavior — all identical to v0.1.1. This release ships the docs site, a dedicated /roadmap page, and brings the design into full NEWELL brand compliance.

What's new

NEWELL brand compliance (full pre-flight pass)

• Hero typography: Space Grotesk SemiBold on .hero h1. Per the NEWELL brand spec, Newell v0.1 is restricted to the literal "NEWELL" wordmark + N mark only — S reads as Z, C/D/O are rectilinear, so any other word exposes the alpha. The earlier docs build incorrectly applied Newell to "PAT SCANNER" and "ROADMAP"; this release fixes that.
• Color tokens canonicalized: bg #000000→#0A0A0A, primary #00FF00→#00FF41, accent #1AFF72 added, text #e8e8e8→#FFFFFF, muted #5a5a5a→#A0A0A0, border #1a1a1a→#1F1F1F, surface #0d0d0d→#0F0F0F. Terminal bar #111→var(--bg-elevated), terminal dots #2a2a2a→var(--rule).
• Anti-patterns removed: glassmorphism (.topbar backdrop-filter blur), glow effects (pulse box-shadow, hero h1 text-shadow), gradients (.pro-cta::before radial).
• Decorative emoji removed: ⚡ separators → · mid-dots. Social icons 🐙🤍☕ → text labels (GitHub/Sponsor/Coffee). Demo-block indicators ❌🔴 → CSS-class-only (the .err red styling carries the weight on its own).
• meta theme-color aligned to #0A0A0A.

/roadmap page live

• Dedicated page at /roadmap (was a section on the landing page).
• Pricing vetted against live vendor rates 2026-07-27: Team tier $19/seat floor of GitGuardian ~$18 / Snyk $25, ~10% under Doppler $21, clearly below GitHub Secret Protection $30. Enterprise tier $24/seat with SAML/SCIM + on-prem collector.

GitHub Pages stood up

• Live at https://jordannewell.github.io/pat-scanner/
• configure-pages auto-enablement wired into CI so future fork/clone setups don't hit the manual-enable step.

Also in this release

• SECURITY.md: Americanized spelling + ack SLA 48h→72h (solo maintainer with day job + 15-agent fleet — 48h breaks credibility when missed).
• FUNDING.yml: dropped custom URL https://jordannewell.com/feedback (returns 404; sponsor flow already covered by GitHub Sponsors + Buy Me a Coffee).

Upgrade

claude plugin update pat-scanner

If update reports "Plugin not found" (stale marketplace cache):

claude plugin marketplace update pat-scanner
claude plugin uninstall pat-scanner
claude plugin install pat-scanner

Verification

• ✅ 18/18 tests pass (bash tests/test-scan-secrets.sh)
• ✅ All cross-page links resolve (landing ↔ roadmap ↔ GitHub)
• ✅ Pricing consistent across pages ($19 Team / $24 Enterprise)
• ✅ Zero gradients/glows/glassmorphism in CSS (grep-verified)
• ✅ Zero decorative emoji (only ✓/✕ in checklist pseudo-content remain — functional UI, not decorative)
• ✅ Zero non-canonical hex values — every color resolves to a tokens.json token
• ✅ JSON manifests valid (plugin.json, marketplace.json)
• ✅ HTML structure balanced (41/41 divs on landing, 73/73 on roadmap)
• ✅ Asset URLs return 200 (favicon, OG image, Pages root)
• ✅ Zero scanner code changes since v0.1.1 — same detection logic, same bypass keyword, same audit log path

Commits bundled (9)

7ff6c81 fix(brand): replace remaining non-canonical hex with tokens
3e47845 fix(brand): swap hero to Space Grotesk, strip decorative emoji
6d029d9 chore(release): bump version 0.1.2 + changelog/roadmap entries
f938758 fix(brand+docs): bring pat-scanner into NEWELL brand compliance
543a00e docs(roadmap): vet pricing against comps, add window/strategy section
53b7533 docs(roadmap): remove stray duplicate favicon copy
69e6914 docs: add dedicated /roadmap page, wire main page links to it
01cd485 ci(pages): auto-enable Pages via configure-pages enablement flag
74551ae docs: add GitHub Pages site

What's NOT in this release

• No new credential patterns (still 13 classes). GitLab/Bitbucket/Linear/Datadog/Sentry roadmap for v0.3.
• No multi-line paste detection (still line-oriented). Roadmap for v0.4.
• No hosted Team tier. That's v0.2 — separate product, OSS plugin stays free.

v0.1.1 — fix(exec): mark scripts executable for Linux

Bug-fix release for v0.1.0 Linux installs.

What broke

v0.1.0 shipped hooks/scan-secrets.sh and tests/test-scan-secrets.sh with git mode 100644 (regular file) instead of 100755 (executable). On Linux, this caused:

• bash /plugin/path/hooks/scan-secrets.sh worked fine (explicit bash invocation)
• Direct script invocation (what CC's hook does, and what tests do) failed with Permission denied / exit code 126
• All 18 tests reported as failed on Linux (worked on Windows/Git Bash because NTFS doesn't enforce +x locally)

What's fixed

git update-index --chmod=+x applied to both scripts. Mode is now 100755 in the git tree, which propagates through clone, fetch, and plugin install.

File	v0.1.0 mode	v0.1.1 mode
hooks/scan-secrets.sh	100644	100755
tests/test-scan-secrets.sh	100644	100755

Also in this release

• .claude-plugin/marketplace.json added (was missing in v0.1.0, caused /plugin marketplace add to fail with "Marketplace file not found")

Upgrade

claude plugin update pat-scanner

If update reports "Plugin not found" (a known issue when the marketplace cache is stale):

claude plugin marketplace update pat-scanner
claude plugin uninstall pat-scanner
claude plugin install pat-scanner

Verification

Tested end-to-end on Linux (Ubuntu host):

• ✅ Marketplace add succeeds
• ✅ Plugin install succeeds
• ✅ Files at ~/.claude/plugins/cache/pat-scanner/pat-scanner/0.1.1/ with correct mode
• ✅ All 18 tests pass
• ✅ Scanner blocks fake figd_DEADBEEFFAKE... fixture with exit code 2
• ✅ Audit log writes to ~/.pat-scanner/audit.log

Lesson

For Claude Code plugins shipping shell scripts that CC invokes by path (hooks, MCP server wrappers, slash command scripts):

git update-index --chmod=+x <script>
git commit -m "..."

Windows dev environments don't surface this (NTFS doesn't enforce +x). Verify on a Linux host before shipping.

v0.1.0 — Initial public release

PAT Scanner — Claude Code UserPromptSubmit hook that blocks credential leaks at chat-time.

What it does

Catches 13 credential classes (Figma, Anthropic, OpenAI, GitHub, Slack, Stripe, PyPI, Z.ai, JWT, Natural, AWS) BEFORE they enter the chat transcript. Companion defense to gitleaks/trufflehog — those catch leaks at git time. PAT Scanner catches them at chat time, the actual point of leak.

Install

/plugin marketplace add JordanNewell/pat-scanner
/plugin install pat-scanner

Restart Claude Code. Verify with /help → look for UserPromptSubmit hook.

At-a-glance

Version	0.1.0
License	MIT
Tests	18/18 passing
Patterns	13 credential classes out of the box
Bypass keyword	BYPASS_SECRET_SCAN (for legitimate debug)
Audit log	~/.pat-scanner/audit.log (blocks only)
User override	~/.config/secret-patterns.local survives plugin updates

Highlights

• POSIX ERE only — grep -E, no PCRE dependency. Two silent-failure traps documented in CONTRIBUTING.md (no (?:...) non-capturing groups; [[:space:]] cannot appear inside bracket expressions).
• Fail-open — if patterns file is missing or unreadable, scanner exits 0 with stderr warning. Doesn't block all of Claude Code.
• Programmatic test fixtures — constructed from clearly-fake parts (repeat 'FAKE' 13) so the static file contains no real-shaped tokens. Allows the repo to push through GitHub secret scanning without .gitleaksignore brittleness.

Install path resolution (first hit wins)

1. $PAT_SCANNER_PATTERNS (explicit env override)
2. ~/.config/secret-patterns.local (user customization, survives plugin updates)
3. ${CLAUDE_PLUGIN_ROOT}/patterns/secret-patterns.local (bundled defaults)

Customize

mkdir -p ~/.config
cp ~/pat-scanner/patterns/secret-patterns.local ~/.config/
$EDITOR ~/.config/secret-patterns.local

Verify install

Paste this in a Claude Code session:

figd_DEADBEEFFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE

Expected: blocked with stderr BLOCKED: prompt contains secret-shaped string matching: Figma PAT.

Roadmap

• v0.2 — Hosted Team Center (centralized audit dashboard, Slack/Teams alerting, SOC2 export). Separate product, OSS plugin stays free.
• v0.3 — Additional patterns (GitLab PAT, Bitbucket app password, Linear API key, Datadog, Sentry auth token). Contributions welcome.
• v0.4 — Multi-line paste detection (current scanner is line-oriented).

Sources

Built on detection patterns from gitleaks and TruffleHog. Field name contract verified against Claude Code hooks docs.

Author

Jordan Newell — https://jordannewell.com