v0.1.2-alpha

Changelog

• 66d7c75 Add first-run guide and doctor command
• ff16bc5 Add next steps after import with delete suggestion
• 836e6da Add project-scoped secrets
• e8a5b48 Block inline code execution to prevent obfuscation bypasses
• 771aaeb Default to project scope, use --global for global
• 7364ade Fix dev release to use semver tag v0.0.0-dev
• f8b26d7 Fix dev release: delete local tag before recreating
• 6a7045a Improve getting started with import suggestion
• 5844d02 Mention .env.local in import help
• da81912 Pre-release fixes: validation, error handling, tests
• eeb993d Show imported secret names in output
• cba5d25 Store project secrets in ~/.alex/projects/ with auto-detection
• bea0774 Update README with project-first defaults

v0.0.0-dev

Changelog

• 43f7445 Block awk/gawk/mawk inline code execution (ENVIRON bypass)
• ccef5b4 Block npm/yarn/pnpm/bun script execution (run, start, test, exec, npx)
• 547c294 Fix install.sh to fetch latest release from GitHub API
• 954be96 Fix node -p and other interpreter inline execution detection
• a2a222b Switch to ALLOWLIST approach for maximum security
• 6fb5c56 Universal -e flag detection to catch all languages (swift, etc.)

v0.1.1-alpha

Changelog

• d911589 Improve install script password prompt
• bc80fde Install to ~/.local/bin without sudo

v0.1.0-alpha

Changelog

• 138b720 Initial commit