What's Changed

• Security release v0.4.1: harden trust boundaries by @peg in #67

Full Changelog: v0.4.0...v0.4.1

What's Changed

• chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #47
• chore(deps-dev): bump vitest from 4.1.5 to 4.1.7 in /worker by @dependabot[bot] in #48
• chore(deps): update modernc sqlite to v1.50.1 by @peg in #50
• feat: add shareable prove reports by @peg in #51
• docs: add enterprise evaluation guide by @peg in #53
• feat: add MCP proof pack by @peg in #52
• chore: prepare v0.4.0 release by @peg in #54

Full Changelog: v0.3.0...v0.4.0

What's Changed

• feat: add first-run confidence loop by @peg in #41
• fix: harden self-hosted callback metadata handling by @peg in #44
• feat: add proof report output by @peg in #45
• chore: prepare v0.3.0 release notes by @peg in #49

Full Changelog: v0.2.1...v0.3.0

What's Changed

• Harden release archives and self-hosted deployment by @peg in #43

Full Changelog: v0.2.0...v0.2.1

What's Changed

• test(serve): add coverage for unregistered token webhook fix (#23) by @peg in #34
• test(bait): add per-canary template correctness tests by @peg in #35
• test(worker): add Vitest unit test suite for worker logic by @peg in #36
• fix(worker): remove duplicate stripe key in CANARY_TYPES by @peg in #38
• refactor(cli): split 2582-line cli.go into per-command files by @peg in #37
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #39
• fix: polish v0.2.0 release foundation by @peg in #40

Full Changelog: v0.1.4...v0.2.0

What's Changed

• docs(readme): awsproc-first how-it-works, redact token, self-hosting proxy warning by @peg in #30
• docs(cli): clarify --label as canary naming strategy by @peg in #31
• fix(worker): do not fire webhook for unregistered tokens by @peg in #33
• fix: replace example AWS account ID with canonical 123456789012 by @peg in #32

Full Changelog: v0.1.3...v0.1.4

What's Changed

• ci: add go vet + staticcheck, branch protection, dependabot by @peg in #3
• docs: readme cleanup by @peg in #6
• fix: omit SessionToken from awsproc credential_process JSON output by @peg in #7
• fix: revoke tokens on disarm/teardown regardless of webhook config by @peg in #8
• chore(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #5
• chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #4
• feat: add huggingface, docker, and azure canary types by @peg in #11
• feat: implement snare scan command by @peg in #10
• docs: add Homebrew install instructions by @peg in #9
• feat: make precision mode the default for snare arm by @peg in #12
• chore: bump CHANGELOG for v0.2.0 by @peg in #13
• feat: v0.1.2 — three-tier canaries, --select mode, git/terraform types, events --summary by @peg in #16
• fix: darwin build — split terminal raw mode into platform files by @peg in #17
• fix: do not fire webhook for unregistered tokens (#23) by @peg in #24
• fix: add 15s timeout to all outbound HTTP clients (#19) by @peg in #25
• fix: write .bak files before modifying existing config files (#18) by @peg in #26
• fix: replace dashboard ?token= query param with HttpOnly session cookie (#22) by @peg in #27
• ci: sign release checksums with Sigstore/cosign (#21) by @peg in #28
• chore: v0.1.3 changelog by @peg in #29

New Contributors

• @dependabot[bot] made their first contribution in #5

Full Changelog: v0.1.1...v0.1.3

What's Changed

• ci: add go vet + staticcheck, branch protection, dependabot by @peg in #3
• docs: readme cleanup by @peg in #6
• fix: omit SessionToken from awsproc credential_process JSON output by @peg in #7
• fix: revoke tokens on disarm/teardown regardless of webhook config by @peg in #8
• chore(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #5
• chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #4
• feat: add huggingface, docker, and azure canary types by @peg in #11
• feat: implement snare scan command by @peg in #10
• docs: add Homebrew install instructions by @peg in #9
• feat: make precision mode the default for snare arm by @peg in #12
• chore: bump CHANGELOG for v0.2.0 by @peg in #13
• feat: v0.1.2 — three-tier canaries, --select mode, git/terraform types, events --summary by @peg in #16

New Contributors

• @dependabot[bot] made their first contribution in #5

Full Changelog: v0.1.1...v0.1.2

Full Changelog: v0.1.0...v0.1.1

What's Changed

• Pre-launch cleanup: fix 5 issues from production readiness review by @peg in #1
• feat: snare serve — self-hosted callback server by @peg in #2

New Contributors

• @peg made their first contribution in #1

Full Changelog: https://github.com/peg/snare/commits/v0.1.0