PhishGuard AI v0.5.1

What's Changed

• fix: address CodeRabbit round-3 security findings by @omobolajiadeyan in #30
• chore: simplify action name for Marketplace compatibility by @omobolajiadeyan in #31
• fix(action): repair Marketplace metadata and prepare v0.5.1 by @omobolajiadeyan in #32

Full Changelog: v0.5.0...v0.5.1

PhishGuard AI v0.5.0

What's new in v0.5.0

URL Redirect Chain Tracing

--follow-redirects N follows shortened and redirect URLs N hops deep using only the Python standard library — no external services. Every hop in the chain is recorded and the final destination is scanned.

Typosquatting Detection

Pure-Python Levenshtein distance against 50 brand domains catches paypa1.com, g00gle.com, githab.com and similar look-alike domains with no external dependency.

.eml Email File Analysis

phishguard eml <file> parses RFC 5322 email files and scans every URL embedded in the message — extracted from both plain-text body and HTML href attributes.

Reusable GitHub Action

Any CI pipeline can now scan URLs and upload SARIF findings to GitHub Code Scanning with a single line:

- uses: omobolajiadeyan/phishguard-ai@v0.5.0
  with:
    urls-file: urls.txt
    sarif-output: phishguard.sarif

Security Hardening

• All action inputs routed through environment variables — eliminates shell injection vectors
• SARIF parse failures now exit with code 2, distinct from phishing-found (1) and clean (0)
• Fork PR SARIF upload guard prevents untrusted forks from writing to Code Scanning
• persist-credentials: false on all checkout steps

Zero new dependencies

Pure Python standard library throughout. 72 tests pass across Python 3.10 – 3.13.

PhishGuard AI v0.4.0 - Explainable IDN Detection and Reproducible Evaluation

PhishGuard AI v0.4.0 strengthens explainable phishing detection, reproducible evaluation, contributor safety, and command-line portability.

Highlights

• Conservative punycode and Unicode hostname indicators that remain contextual rather than treating all internationalized domains as malicious.
• A documented 14-sample public-safe URL regression benchmark reporting TP=7, TN=7, FP=0, and FN=0. These are fixture metrics, not population-level accuracy claims.
• Plain ASCII CLI output contributed by @BeauDevCode for legacy terminals and CI logs.
• Repository policy checks that reject unexpected binaries, executable content, symlinks, risky workflow patterns, and unreviewed runtime dependencies.
• Standards-based Python packaging with tests across Python 3.10-3.13, CodeQL, checksums, and signed build-provenance attestation.

Verification

• 28 unit tests
• Python 3.10, 3.11, 3.12, and 3.13
• Package build and isolated wheel installation
• CodeQL and repository security policy

Contributors

Thank you to @BeauDevCode for the ASCII output contribution and to everyone reviewing and testing the project.

Full changelog: v0.3.0...v0.4.0

PhishGuard AI v0.3.0 - Security Pipeline Integration

PhishGuard AI now integrates directly with SARIF-compatible security workflows.

Highlights:

• Dependency-free SARIF 2.1.0 output for URL, email, and batch scans
• GitHub Code Scanning workflow template using the official upload action
• Stable finding fingerprints for deduplication
• Warning/error severity mapping for suspicious and phishing verdicts
• Probability and explainable feature data retained in every finding
• Existing native JSON output remains backward compatible

Verification:

• 10 local unit and CLI tests passed
• SARIF output validated against the official 2.1.0 JSON schema
• GitHub Actions passed on Python 3.10, 3.11, 3.12, and 3.13

See CHANGELOG.md and docs/GITHUB_CODE_SCANNING.md for details.

PhishGuard AI v0.2.0 - Community Foundation

This release establishes PhishGuard AI as a tested, contributor-ready open-source security project maintained by Omobolaji Adeyan.

Highlights:

• Calibrated scoring to reduce false positives
• Regression coverage for URL, email, and Windows console behavior
• CI across Python 3.10-3.13
• Governance, roadmap, security policy, and contributor workflows
• MIT license and citation metadata

See CHANGELOG.md for details.