Simple Kuma V 1.1.5

Here’s a GitHub release writeup you can paste for v1.1.5:

---

Simple Kuma Tracker v1.1.5

Release date: July 1, 2026
Package: simplekuma-v1.1.5.zip (document root = public/)

This release focuses on Google Safe Browsing hardening, cleaner tracking URLs for new installs, and API stats improvements. It is intended for fresh deployments and upgrades from v1.1.4.

---

Google Safe Browsing & admin hardening

Addresses false “Dangerous site” / social-engineering flags seen on fresh domains (e.g. index.php?page=campaigns on the same host as click tracking).

• Campaigns route renamed: Admin UI uses ?page=campaign-list instead of the fingerprinted ?page=campaigns. Legacy GET requests to ?page=campaigns redirect to campaign-list.
• Crawl discouragement: X-Robots-Tag: noindex, nofollow on admin pages; public/robots.txt disallows admin/auth/API surfaces.
• No sensitive data in campaign list HTML: “Get tracking link” buttons only expose data-campaign-id. Tokens, macros, slugs, and URLs load on demand via authenticated api-campaign-tracking-link.php (401 when not logged in).
• cloak.php deprecated: Open ?to= redirect removed; endpoint returns 410 Gone. Referrer privacy uses signed kumahop.php instead.
• UI terminology: “Cloaking” renamed to referrer privacy / bear-hop language (migration 061: cloaking_mode → referrer_mode, backward compatible).
• Installer guardrails: Warns/blocks same-host BASE_URL (admin + tracking on one domain) unless explicitly acknowledged; post-install Safe Browsing checklist on complete step.
• Docs: docs/SAFE_BROWSING_CAMPAIGNS.md (operator root-cause guide; not shipped in production zip).

---

New default click URLs (go.php?k=)

Reduces the cross-install /km/{key} fingerprint for new installs while keeping legacy links working.

	New installs	Legacy / upgrades
Generated links	https://track.example.com/go.php?k={campaign_key}	/km/{key} if config constants unset
Legacy ads	N/A	/km/… still works via .htaccess

• public/go.php — neutral entry point (shared handler with km.php)
• ClickPath — central URL builder with CLICK_URL_STYLE (query | path), CLICK_ENTRY_SCRIPT, CLICK_PATH_PREFIX
• Pretty mode (optional): CLICK_URL_STYLE=path → /go/{key}
• Installer writes query-style defaults into new config.php
• .htaccess — /go/ pretty rewrites; /km/ and /c/ kept for backward compatibility

---

API & stats

• Grouped campaign stats: GET /api/v1/stats/campaigns/{id}?group_by=... — paginated breakdowns by date, country, browser, OS, ISP, landing page, offer, and traffic-source tokens (e.g. zoneid/subid). meta.totals matches the campaign summary for the same range.
• lp_clicks metric: Summary and grouped stats include landing-page click counts alongside visits.
• API docs: Kuma API reference updated for grouped stats parameters and response shapes.

---

Version display

• Sidebar, login/forgot/reset footers, and Settings → About read version from version.php (no more hardcoded 1.1.4 strings).

---

Production packaging

• Built with php scripts/create-deployment-package.php (allowlist-based; no dev/debug/repair scripts).
• Ships: go.php, api-campaign-tracking-link.php, robots.txt, kumahop.php, REST API v1, etc.
• Excludes: config/config.php, .env, demo landing pages under public/landing-pages/, docs, debug/test utilities.

---

Upgrade notes (v1.1.4 → v1.1.5)

1. Back up DB and config/config.php.
2. Deploy zip; point document root to public/.
3. Run migrations (includes 061 if not already applied).
4. Optional — adopt new click URL shape (add to config/config.php):

define('CLICK_URL_STYLE', 'query');
define('CLICK_ENTRY_SCRIPT', 'go.php');
define('CLICK_PATH_PREFIX', 'go');

5. Recommended: Use a dedicated tracking subdomain for BASE_URL; do not run click traffic on the admin host.
6. Existing /km/ ad links keep working — no need to change live campaigns unless you want new links to use go.php?k=.
7. If previously flagged by Safe Browsing: migrate tracking to a clean subdomain, then request a review after deploy.