v1.26.0

Packaging and project hygiene, plus a protocol fix.

Added

A Helm chart — charts/fcaptcha. The ArtifactHub registration had pointed at a chart that did not exist for months; now it does.

helm install fcaptcha ./charts/fcaptcha \
  --namespace fcaptcha --create-namespace \
  --set secret=$(openssl rand -hex 32)

helm test fcaptcha -n fcaptcha

It refuses to install without a signing key — the server otherwise falls back to a key published in its own source, so a deployment that forgets does not fail, it silently accepts tokens anyone can mint. It also warns when replicaCount is raised (state is in-memory and unshared, so single-use enforcement is per-pod) and when trustedProxies is empty (behind an ingress controller, every visitor is attributed to the controller). Security defaults are on and not parameterised down: non-root, read-only root filesystem, all capabilities dropped, no service-account token.

Project documentation — SECURITY.md with a private disclosure channel and an explicit line between evading a detector (expected) and bypassing the mechanism (a vulnerability); CONTRIBUTING.md; CODE_OF_CONDUCT.md; a CHANGELOG covering every release; and issue templates including a dedicated false-positive report.

Fixed

HEAD returned 405 on the Go and Python servers for /health and /fcaptcha.js. chi's r.Get and Starlette's @app.get register only the method named, while Express routes HEAD to its GET handler — so Node alone was correct and nothing compared them. Caching proxies revalidate with HEAD and uptime monitors probe with it, so a 405 reads as an outage on a server that is working fine.

Found by writing a helm test that checks the widget declares UTF-8, which it does with a HEAD request.

No detection changes.