v0.6.0

• Security: credentials are masked by their shape wherever they sit, through
  the bundled core (Stripe keys, an AWS access key id and its secret key when
  it follows one, GitHub, GitLab and Slack tokens, JWTs, private key blocks, a
  Quiet Guard project key, the password of a user:password@host in an
  address); a code snippet line that hands a literal to new PDO(...),
  mysqli_connect(...) or another call whose arguments are credentials is
  masked whole; a field the engine could not read is withheld as
  [redacted:unscannable] rather than sent as it came.
• Security: a percent-encoded value (an email written %40, a number written
  with %20) is read decoded by the bundled core, so a URL quoted in an error
  message is masked as it would be in clear.
• Changed: the bundled core is required as ^0.6.0.

Full changelog: readme.txt