Changelog

All notable changes to this project will be documented in this file.

[2.2.0] - 2026-08-11

Triage collection package support - Analysts can upload a triage package via the admin panel
- "Send Triage Package" button in session detail modal
- File picker for selecting the triage package
- Public download link generated: http://host:8443/triage/<token>
- Link can be shared with remote parties for file download
- Package replace option for updating existing triage packages
Auto-open browser - Application automatically opens admin interface on startup
- Opens http://localhost:8443/admin in default browser
- Platform-specific browser open (macOS: open, Linux: xdg-open, Windows: cmd /c start)
- Use -no-browser flag to disable auto-open

IP info upload before evidence - Uploader must send IP information before uploading files
- "Send IP Info" button uploads browser-generated IP detection report as evidence
- Upload form disabled until IP info is sent
- IP info file parsed by Chain of Custody PDF for detailed collector IP section

File list not showing after upload - handleListFiles now uses session FolderName instead of raw token
SHA-256 hash files in file list - Filtered out from uploader's file list

CoC PDF now shows detailed IP information from browser-uploaded file (Local IP, Public IP, Forwarded For, User Agent, etc.)

Chain of Custody PDF generation - Automatic forensic documentation when sessions end
- PDF generated on session revocation with analyst name prompt
- PDF generated for expired sessions (background cleanup every 5 minutes)
- Includes: case info, evidence items with SHA-256 hashes, activity timeline, integrity verification, signature block
- Saved as CHAIN_OF_CUSTODY.pdf in the case folder with .sha256 sidecar
Revoke modal with analyst name - Admin panel prompts for analyst name before revoking
Session expiration cleanup - Background goroutine now properly cleans up expired sessions

RevokeSession() now returns the session object before deletion (enables CoC generation)
CleanupExpired() now returns list of expired sessions (enables CoC generation for expired sessions)

Cloudflare Tunnel support - Full integration with Cloudflare tunnels
- -tunnel cloudflare flag for Cloudflare tunnel mode
- -tunnel-token flag for token-based authentication
- Auto-install cloudflared binary
- Named tunnel support
- Custom domain support (e.g., yourdomain.com)
Multi-analyst mode - -tunnel external for centralized tunnel deployment
- Domain owner runs tunnel, analysts just use the URL
- No cloudflared needed on analyst machines
Config file support - ~/.evidence-upload.conf
- All settings can be stored in config file
- Environment variable override with EVIDENCE_* prefix
- Secure file permissions (chmod 600)
Incident-based folder naming - Upload folders named after case/incident
- Folders use sanitized description (e.g., INC-2024-001/)
- Original token-based folders still supported
Filename sanitization - Spaces and symbols replaced with underscores
- My Evidence (1).exe → My_Evidence_1.exe
SHA-256 hash files - Written after each successful upload
- Compatible with sha256sum -c verification
- Format: hash filename
IP detection - Shows both local and public IP on upload page
- Public IP fetched from api.ipify.org
- Download IP info as text file for documentation
IP detection endpoint - /api/my-ip returns client IP details