v0.2.0

Changelog

• 73c689b Add --never-block allowlist to guard mode
• 505d5e7 Add --never-block-file flag to load allowlist from file
• a19b9e1 Add CI quality gates: SHA pinning, permissions, coverage, lint
• 2fee316 Add CODEOWNERS for CI, installer, and security-sensitive files
• c68f031 Add DetectAll() for polyglot multi-category detection
• 53fa62e Add SBOM generation via Syft and cosign signing to release pipeline
• c8554aa Add audit log for block and unban actions
• adbd04a Add checksum verification, pipefail, and trap cleanup to install.sh
• 7801332 Add confidence scoring to all detection patterns
• 0b31638 Add config and unban tests, fix parseBlockedIPs field index bug
• 8a0fdfd Add detection patterns for SSTI, deserialization, CRLF ghost bits, open redirect backslash
• a96f528 Add gitleaks secret scanning and gosec SAST to CI
• 9a53888 Add pattern uniqueness test as duplicate regression guard
• a8dd1e2 Add state persistence for blocked IPs across guard restarts
• b00f6fc Align Go version to 1.24 across Dockerfile, CI, and release
• 2b8fa49 Condense Unreleased changelog to match prior release style
• e515f70 Document config --global flag and complete top dimensions list
• 91fd988 Document gosec fixes and config permission tightening in changelog
• 7eda383 Document guard features, audit log, state persistence, allowlist, confidence scoring, and new patterns
• 201ffe7 Extract Guard type to pkg/guard, slim runGuard to orchestration
• 1d2d0d8 Fix golangci-lint errcheck, ineffassign, and unused code issues
• cdaf540 Fix goroutine leak in unblockAfter with context cancellation
• d1abd8c Fix guard flag defaults in docs and document --version, block/unban flags
• 7007119 Fix swallowed ParseDuration error in guard and root commands
• 51c1880 Fix top dimensions in help text and remove unused detection constants
• 193ac3f Force bash shell for build step to fix Windows CI
• f0b4670 Handle file rotation via inode check, reap cmd.Wait on context cancel
• 10e6a2e Inject version via ldflags instead of hardcoding in root.go
• da1ea4e Merge P0-1: regex anchoring and duplicate pattern removal
• 1c20ad1 Merge P0-2: guard race condition fix
• 100d69b Merge P0-3: IP validation before iptables
• 07e521c Merge pull request #4 from L9Lenny/bugfix
• bf39b40 Pin alpine:3.20 with digest hash in Dockerfile
• 0be4b9d Protect blocked map with mutex, fix unblockAfter bypass
• 76c69f2 Reformat changelog unreleased section
• 7a9a7b7 Release v0.2.0
• 7c2b436 Remove duplicate patterns, bound noisy regex, add false-positive tests
• b293825 Remove duplicate scanner UA entries from detect.go
• 75c6ca1 Replace custom stringReplace with html.EscapeString in html.go
• 6296060 Replace per-IP unblockAfter goroutines with single expiry loop using min-heap
• a31201b Skip ParseDuration on empty --interval (regression from P1-7)
• 4cb73bc Skip perm tests on Windows, tighten config perms, exclude gosec CLI-inherent rules
• 41846a9 Switch listBlockedIPs from iptables -L to stable iptables -S format
• 0d97705 Update warranty and liability section in LICENSE
• f9f1aec Upgrade golangci-lint-action to v9.3.0 (Node 24 support)
• 5e6b18d Validate IP before iptables to prevent flag injection