mirror of
https://github.com/momenbasel/keyFinder.git
synced 2026-07-23 13:10:52 +02:00
momenbasel
882e298d85
- Popup + findings dashboard rebuilt as a dark ops console: radar-sweep brand mark, ARMED/PASSIVE status LEDs, scanline texture, mono chrome, amber (action) / teal (secret) semantic colors - Popup: count-up stats, numbered watchlist, command-prompt input, typed terminal status line with live counts - Dashboard: clickable severity stat filters, LATEST ticker, severity row edges, LED badges, click-to-copy match chips, relative times, skeleton rows, staggered first paint, radar empty state, / and Esc shortcuts, prefers-reduced-motion support - Fix severity sort (critical sorted last) and ticker hidden override - Add preview/ harness (stubbed chrome API) for headless UI screenshots
72 lines
4.5 KiB
Markdown
72 lines
4.5 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to KeyFinder are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning follows [SemVer](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [2.2.0] - 2026-07-18
|
|
|
|
### Added
|
|
- Ops-console UI redesign of the popup and findings dashboard: radar-sweep brand mark, ARMED/PASSIVE status LEDs, scanline texture, monospace UI chrome, and a semantic color system (amber = actions, teal = recovered secrets, red/orange/yellow/teal severity scale)
|
|
- Popup: count-up stat numerals, numbered watchlist entries, command-prompt keyword input with glowing focus ring, and a terminal status line typed with the live keyword/finding counts
|
|
- Dashboard: clickable severity stat tiles that filter the table, LATEST ticker for the most recent finding, `findings.log` table shell with severity-coded row edges, LED severity badges, click-to-copy match chips, relative timestamps (absolute on hover), skeleton loading rows, staggered first-paint rows, and an animated radar empty state that distinguishes "no findings yet" from "filters hide everything"
|
|
- Keyboard shortcuts on the dashboard: `/` focuses search, `Esc` clears and blurs it
|
|
- `prefers-reduced-motion` support across all animations
|
|
|
|
### Fixed
|
|
- Severity sort treated `critical` as lowest priority (`severityOrder[s] || 5` maps `critical: 0` to the fallback), so critical findings rendered last; they now lead the table
|
|
- Latest-finding ticker no longer stays visible when storage is empty (`display: flex` was overriding the `hidden` attribute)
|
|
|
|
## [2.1.1] - 2026-05-14
|
|
|
|
### Added
|
|
- `SECURITY.md` with threat model, disclosure policy, and known limitations of the MAIN <-> ISOLATED nonce bridge
|
|
- `.github/dependabot.yml` for weekly GitHub Actions version bumps
|
|
- `CHANGELOG.md`
|
|
|
|
### Changed
|
|
- CSV export sanitiser now also prefixes cells starting with LF (`\n`), not just `=`, `+`, `-`, `@`, tab, CR
|
|
- Popup and results page version label is now read from the manifest at runtime instead of being hardcoded
|
|
|
|
### Fixed
|
|
- Window-global scan in `js/interceptor.js` now runs at `document_start`, `DOMContentLoaded`, and `load`, with per-name dedupe. The previous implementation only scanned at `document_start` when page globals had not yet been assigned, making the entire pass dead code on most real pages
|
|
|
|
## [2.1.0] - 2026-04-14
|
|
|
|
### Added
|
|
- Per-session nonce validation between MAIN-world interceptor and ISOLATED content script to prevent forged finding injection
|
|
- CSV formula-injection sanitiser on findings export
|
|
- Serialised storage writes to eliminate cross-tab race conditions
|
|
- 5000-finding cap with FIFO eviction
|
|
- Per-tab alert badge with red-dot icon overlay when secrets are detected
|
|
- MutationObserver scans dynamically-injected DOM nodes for SPA coverage
|
|
- Explicit Content Security Policy in Chrome and Firefox manifests
|
|
- `js/interceptor-loader.js` for both browsers, replacing direct MAIN-world content script on Firefox so the nonce handoff actually works
|
|
- GitHub Actions release pipeline (`.github/workflows/release.yml`): on `v*` tag, build Chrome + Firefox zips, compute SHA256, attach to GitHub Release
|
|
- GitHub Actions CI pipeline (`.github/workflows/ci.yml`): manifest JSON validation, Chrome <-> Firefox version parity check, build verification, `web-ext lint` on the Firefox bundle
|
|
|
|
### Changed
|
|
- Keyword input validation: 50 character maximum, 50 keyword maximum
|
|
- Findings are now deleted by unique ID instead of URL substring match
|
|
- URL parameter scanner uses exact match instead of substring (was matching `author` as `auth`)
|
|
- Keyword scanner enforces word boundaries (was matching `key` inside `hotkey`, `monkey`)
|
|
- camelCase JS identifiers are now skipped in keyword value matches
|
|
- Sentry DSN downgraded from `high` to `low` severity (public by design)
|
|
|
|
### Fixed
|
|
- Stored finding race conditions across concurrent tabs
|
|
- False positives from GitHub localStorage caches (`ref-selector:*`, `jump_to:*`, `soft-nav:*`, `COPILOT_*`)
|
|
- False positives from common CSRF tokens (`authenticity_token`, `csrf_token`, `__RequestVerificationToken`)
|
|
- False positives from keyboard shortcut data attributes (`data-hotkey`, `data-hotkey-scope`)
|
|
|
|
## [2.0.0] - 2026-04-07
|
|
|
|
### Added
|
|
- Complete rewrite to Manifest V3
|
|
- Enterprise-grade secret detection with 80+ regex patterns covering AWS, GCP, Azure, GitHub, GitLab, Stripe, PayPal, Square, Slack, Discord, and more
|
|
- Firefox support (MV3, Firefox 128+)
|
|
- Privacy policy
|
|
- Replaced demo gifs with professional logo
|
|
|
|
### Removed
|
|
- Manifest V2 background page
|
|
- Legacy jQuery dependency
|