All notable changes are documented here. The project follows Semantic Versioning while public APIs remain pre-1.0.
- Generic inert reflected-HTML canary checks for discovered query parameters.
- Passive CSRF form analysis without state-changing requests.
- Low-confidence object-reference inventory and optional two-identity IDOR comparison.
- A second host-restricted credential profile for differential authorization checks.
- Renamed the project and all public/runtime identifiers to BoundedScan.
- Routed dashboard API traffic through the same-origin Nginx gateway.
- Same-origin crawling now preserves query strings for bounded parameter analysis.
- Reproducible isolated demo with a guided campaign.
- Versioned FastAPI surface, React dashboard and persistent campaign pipeline.
- Scope enforcement, bounded scanning, findings, intelligence and reports.
- Local authentication, RBAC, CSRF protection, encrypted credential profiles and audit events.
- Runtime metadata and explicit credential revocation.
- Docker Compose, reference Kubernetes manifests, CI, SBOM and threat model.
- Fail-fast checks for example secrets outside demo mode.
- Configurable secure session cookies.
- Restricted non-destructive templates, methods and production profiles.