CloakScan 1.2.0

CloakScan is a local-first tool that finds and redacts secrets, credentials, and personal data in text before you share it. Everything runs on your device — no cloud, no account, no telemetry.

This release renames the project from CloakGuard to CloakScan (the old name clashed with an existing app) and adds:

• Cloak Lists export/import as .txt — move your reusable exact-match term lists between machines without hand-copying from the editor.
• New Scan button — clear the current text and results in one click and start fresh.
• Better internal-network detection — internal Active Directory hostnames (e.g. DC02.ad.contoso.com), LDAP/LDAPS URLs, and service/admin ports.

Try it or install

• Live browser demo: https://benthompsondev.github.io/cloakscan/
• Windows: CloakScan-Setup-1.2.0-x64.exe — unsigned, so SmartScreen will warn (More info → Run anyway). Verify it against SHA256SUMS-windows.txt.
• Linux: CloakScan_1.2.0_amd64.deb or CloakScan_1.2.0_amd64.AppImage. Verify against SHA256SUMS-linux.txt.

Nothing is uploaded. The desktop scan UI has no network access at all (connect-src 'none'); the only network call is the manual "check for updates."

Because the app identifier changed with the rename, this is a fresh install — it will not auto-update over an existing CloakGuard install.

CloakGuard v1.1.2

CloakGuard v1.1.2 fixes project and download links in the Windows and Linux desktop apps. Those links now open in the system browser through a narrow allowlist limited to the CloakGuard GitHub repository and live demo.

This release also detects AWS temporary access-key IDs, keeps coverage for OpenSSH and other private-key blocks, adds a short demo and press kit, and includes AppStream metadata inside the AppImage.

Windows:

• Download CloakGuard-Setup-1.1.2-x64.exe.
• The installer is not Authenticode-signed. Verify its SHA-256 checksum before running it.

Linux:

• The AppImage supports signed in-app updates.
• The .deb checks for updates but must be updated manually with a newer package.

The scanner remains local-first with no account, backend, telemetry, or content upload. Detection can miss work-specific names and terms, so review the cleaned text before sharing it.

CloakGuard v1.1.1

CloakGuard v1.1.1 improves the Linux install metadata and adds a session-only Dismiss action to the possible-names review panel.

What changed:

• The Debian package now includes a complete description and richer AppStream metadata for software-center clients that read it.
• Linux packaging validates the metainfo and desktop entry from the built .deb before publishing.
• Candidate suggestions can be dismissed for the current session without saving content or changing the cleaned output.
• Common sample and PowerShell labels no longer crowd useful suggestions out of the review panel.

Downloads:

• Windows: use CloakGuard-Setup-1.1.1-x64.exe. The installer is unsigned, so verify it against SHA256SUMS.txt.
• Linux AppImage: supports CloakGuard's in-app automatic updater.
• Linux .deb: updates are manual. Install a newer .deb when a new release is available.

Automated detection can miss sensitive information. Review the cleaned text before sharing.

CloakGuard v1.1.0

CloakGuard v1.1.0 is the first release that ships Windows and Linux packages together.

What changed:

• Possible-name suggestions now filter common PowerShell colors, keywords, log words, date tokens, and known technical acronyms. Likely multi-word names and project terms are shown first.
• Secret detection adds distinctive-prefix coverage for current provider tokens, Discord and Telegram webhooks/tokens, plus Azure SAS and S3 signature query values.
• Linux update checks now explain missing-platform and network failures clearly.
• AppImage builds can install signed updates in the app. Debian .deb installs still check for new versions but open GitHub Releases for a manual package update.
• The Debian package includes AppStream metadata for compatible software managers.

Downloads:

• Windows: CloakGuard-Setup-1.1.0-x64.exe
• Debian/Ubuntu: CloakGuard_1.1.0_amd64.deb
• Portable Linux: CloakGuard_1.1.0_amd64.AppImage

The updater packages are signed and verified by CloakGuard. The Windows installer itself is not code-signed and may trigger SmartScreen. Verify downloads against SHA256SUMS.txt.

CloakGuard is a detection helper, not a guarantee. Review cleaned text before sharing it.

CloakGuard v1.0.1

What changed

• Replaced the separate IT and PII samples with one synthetic incident that makes the difference between Balanced and Strict easier to see.
• Stopped treating four-part software versions as IP addresses when quotes, brackets, XML delimiters, or similar separators sit between the version label and value.
• Added Ctrl+Enter and Cmd+Enter as shortcuts for running a scan from the source editor.
• Refreshed the public scan screenshots to match the new sample.

Install or update

New users can download CloakGuard-Setup-1.0.1-x64.exe, compare its SHA-256 value with SHA256SUMS.txt, then run the installer.

People already on v1.0.0 can open Privacy / About, click Check for updates, and install v1.0.1 through the signed updater.

Scanning still runs locally. There is no backend, content upload, telemetry, launch check, or background polling. The desktop app contacts GitHub only when you ask it to check for an update.

The updater package is signed for Tauri verification, but the Windows installer is not code-signed. Windows SmartScreen may still show a warning. Download it only from this GitHub release and verify the checksum before running it.

CloakGuard 1.0.0

What changed

• Added Maximum and Code & secrets built-in profiles.
• Added fixed-prefix checks for more provider tokens and credentials.
• Added MAC addresses plus checksummed or explicitly labeled ABA, ITIN, EIN, DEA, and passport fields.
• Added separate placeholder labels and formats for session terms and Cloak Lists. The default stays [CUSTOM_TERM_n].
• Stopped treating four-part software versions, loopback, 0.0.0.0, broadcast, and longer dotted runs as sensitive IPv4 addresses.
• Improved contextual person-name detection when a matching email local-part provides supporting evidence.
• Added public issue and pull request templates with synthetic-data reminders.

Install or update

New users can download CloakGuard-Setup-1.0.0-x64.exe, compare its SHA-256 value with SHA256SUMS.txt, then run the installer.

People already on v0.9.0 can open Privacy / About, click Check for updates, and install v1.0.0 through the signed updater.

Scanning still runs locally. There is no backend, content upload, telemetry, launch check, or background polling. The desktop app contacts GitHub only when you ask it to check for an update.

The updater package is signed for Tauri verification, but the Windows installer is not code-signed. Windows SmartScreen may still show a warning. Download it only from this GitHub release and verify the checksum before running it.

CloakGuard v0.9.0

What changed

• Added a manual Check for updates button to the Windows app.
• Added signed update packages so CloakGuard can reject an update with the wrong updater signature.
• Reworked the About page with clearer privacy notes, project links, and update status.
• Added the new CloakGuard shield, app icon, favicon, and two-tone wordmark.

Scanning still runs locally. There is no backend, upload, telemetry, launch check, or background polling. The desktop app contacts GitHub only after you click Check for updates. The browser demo does not show the update control.

Install

Version 0.9.0 is a manual install. Download CloakGuard-Setup-0.9.0-x64.exe, compare its SHA-256 value with SHA256SUMS.txt, then run the installer. Automatic updates apply to releases after 0.9.0.

The updater package is signed for Tauri verification, but the Windows installer is not code-signed. Windows SmartScreen may still show a warning. Download it only from this GitHub release and verify the checksum before running it.

CloakGuard v0.8.0

CloakGuard v0.8.0 adds a live browser demo and a review step that helps you catch names and terms the built-in rules can't safely detect.

What changed:

• Added a live browser demo that runs the same client-side scanner as the desktop app, with nothing sent to a server.
• Added a "Possible names & terms to review" panel that suggests likely names, company terms, and repeated acronyms after a scan. Suggestions never redact anything on their own.
• Added one-click session hiding for a suggestion, plus a direct link to reusable Cloak Lists.
• Added an architecture guide, a short animated walkthrough in the README, and a changelog.

Safety:

• Suggestions are guesses for review, not detections. You choose what to hide.
• There is still no built-in name dictionary. Name and organization checks stay contextual and low-confidence.
• Still fully local: no account, backend, or telemetry. Review the cleaned text before sharing it.

Verification:

• npm audit: 0 vulnerabilities
• 474 unit tests passed
• 59 functional browser tests passed
• 4 Rust tests passed
• Windows installer build passed

Windows installer:

• File: CloakGuard-Setup-0.8.0-x64.exe
• SHA-256: F3558D94EE3537ADEAF12C71E63E50801A200568A4B2822C5566192B44C15698
• Signature: unsigned (Windows SmartScreen may warn; verify the SHA-256 before running)

Live demo: https://benthompsondev.github.io/cloakguard/

CloakGuard is a detection helper, not a guarantee or a compliance product. Always review the cleaned text before sharing it.

CloakGuard v0.7.3

CloakGuard v0.7.3 is a small Scan-screen cleanup.

What changed:

• Shortened the detector-limit reminder so it stays on one line at the supported 1280 px desktop width.
• Added an accessible close button so the reminder can be hidden for the current app session.
• The reminder returns after the app is reopened or reloaded. No new preference is stored.

Verification:

• npm audit: 0 vulnerabilities
• 463 unit tests passed
• 58 functional browser tests passed
• 3/3 supported desktop viewport checks passed
• 4/4 Rust tests passed
• Windows installer build passed

Windows installer:

• File: CloakGuard-Setup-0.7.3-x64.exe
• SHA-256: 99BA5E33412C20C6B462A59817B276CC0CC9171FA4B2968A1621D57780B33833
• Signature: unsigned

CloakGuard v0.7.2

CloakGuard v0.7.2 makes detector limits harder to miss and profile setup easier to finish.

What changed:

• Added a visible Scan-screen reminder that built-in rules can miss context-specific names, organizations, and local terms.
• Linked that reminder directly to Cloak Lists for repeatable exact matching.
• Added Create Cloak List and Create Custom Pack actions inside the Profile Editor.
• Preserved the unfinished profile draft while creating either item, then selected the new item automatically.
• Tightened the README and refreshed the public screenshots.

Verification:

• npm audit: 0 vulnerabilities
• 463 unit tests passed
• 57 functional browser tests passed
• 67/67 passed in the screenshot run
• 4/4 Rust tests passed
• Windows installer build passed

Windows installer:

• File: CloakGuard-Setup-0.7.2-x64.exe
• SHA-256: 6A5B417638C0FD080FAA2A210F2EAE4E3479A6C4E8B38AF0C19D24726707ED25
• Signature: unsigned

CloakGuard is a detection helper, not a guarantee. Review the cleaned text before sharing it.