# Changelog

All notable changes to this project will be documented in this file.

This changelog is automatically generated by [git-cliff](https://git-cliff.org/)
from [conventional commits](https://www.conventionalcommits.org/).

## [0.1.1] - 2026-03-02

### Documentation

- Add whitepaper v1.0 with pipeline diagram (#3)
- Fix stale stage count in CHANGELOG
- Update CLAUDE.md for 6-stage pipeline and 8 exports
- Document re-NFKC stage in pipeline

### Miscellaneous

- Add CODEOWNERS for scorecard branch-protection check

## [0.1.0] - 2026-03-01

### Bug Fixes

- Resolve concurrency group collision in CI reusable workflow
- Use branch-specific codecov badge URL
- Re-normalize after homoglyph replacement for idempotency
- Use uv pip install in smoke test (uv venv lacks pip)
- Close bypass vectors from adversarial audit and harden pipeline
- Close 18 bypass vectors found in penetration testing

### CI/CD

- Add Codecov coverage reporting with dynamic badge
- Scope down token permissions and add Atheris fuzz harness
- Add PyPI trusted publishing workflow
- Bump the actions group with 2 updates (#1)

### Documentation

- Add framework integration snippets and threat model blurb
- Add Why This Matters and comparison sections to README
- Add coverage badge to README
- Add fuzz workflow badge to README
- Finalize README with benchmarks and API examples

### Features

- Add decode_evasion, detect_scripts, is_mixed_script (#2)
- Add jinja2 and path escapers
- Core pipeline — clean() with 4 universal stages
- Add homoglyph mapping data (42 pairs)
- Add invisible character data module and first test skeleton

### Miscellaneous

- Update security contact email to security@projectnavi.ai
- Add CONTRIBUTING, GOVERNANCE, CODE_OF_CONDUCT, and auto-generated CHANGELOG
- Harden CI with Semgrep, CodeQL, pip-audit, SHA-pinned actions, and contributor tooling
- Add README badges, OpenSSF Scorecard workflow, and security policy
- Add pre-commit hooks and GitHub Actions CI
- Scaffold navi-sanitize package

### Testing

- Add benchmark suite — clean() and walk() perf baselines
- Add Unicode Tag smuggling and bidi override attack tests
- Port adversarial suite from navi-bootstrap (37+ attack vectors)
- Add walk() tests — nested structures, deep copy, edge cases
