Changelog

Language pack edition gate — Hebrew and English stay free.

• Language pack edition gate — all non-English packs except Hebrew (he) now require LocalMask Pro. A clear upgrade notice is printed when a gated pack is requested without a license, and detection falls back to free packs (he, en) automatically.
• Hebrew and English detection remain free in all editions.

• Benchmark / recall test suite removed from the source tree. Detection accuracy: ~97% recall on an 11-repo corpus.

Expanded PII detection and 9th language pack (India).

• DOB / date-of-birth — labeled patterns (dob:, birth_date:, birthday:, birth_day:)
• CVV / card security code — cvv:, cvc:, security_code:, atm_pin:, card_pin:, pin_number: (3–6 digits)
• Card expiry — expiry:, exp_date:, card_expiry:, valid_thru: (MM/YY and MM/YYYY)
• Passport number — passport:, passport_no:, passport_number:
• National ID — national_id:, civil_id:, voter_id:, tax_id:, resident_id:, and more
• UK National Insurance number — case-sensitive format guard, requires label
• GPS coordinates — labeled latitude: / longitude: or bare lat: / lon:
• URL query secrets — ?api_key=, ?token=, ?session_token=, ?refresh_token=, ?oauth_token=, and more
• VIN — labeled vin:, chassis:, frame_no: (17-char, case-sensitive format guard)
• License plate — labeled plate:, license_plate:, car_plate:, car_reg:
• India language pack — PAN (checksum-validated), Aadhaar (Luhn-validated), GSTIN — 9 language packs total
• Order / invoice / booking IDs — all 9 lang packs now include native keywords for order, invoice, booking, contract, and reference numbers

• LOCALMASK_LANGS default changed from all to none — opt in per language to avoid unexpected FPs. Set LOCALMASK_LANGS=he,ru or all.
• labeled_customer_id extended with order, invoice, booking, reservation, contract, reference, ticket, transaction, case keywords
• prefixed_customer_id extended with ORD-, INV-, TXN-, TKT-, BKG-, CASE-, REF-

Detection precision release: −48% false positives on the 11-repo test suite, detection rate held at 99%.

• Stripe publishable keys no longer flagged — pk_live_ / pk_test_ are public by design; only sk_live_ / sk_test_ are sensitive
• System / robot email addresses excluded — no-reply@, notifications@, GCP service-account domains, and similar
• Database URLs without credentials no longer flagged — postgresql://host/db (no @) excluded from all patterns
• Twilio Account SIDs excluded — AC + 32 hex are public identifiers, not secrets
• JDBC URLs require embedded credentials — bare jdbc:postgresql://host/db no longer flagged
• unquoted_env_secret — minimum length raised 8 → 10; $, (, ) excluded; now detects env vars inside Python/YAML strings
• Known false-positive values added — smtp.gmail.com, AKIAIOSFODNN7EXAMPLE, test-jwt-secret-not-for-production, and others
• bitcoin_address — length range tightened to avoid 40-char git SHA collisions

• LLM context now includes file path — classifier prefixes each detection with [rel/path/to/file] to distinguish test fixtures from production configs
• Classifier prompt v4 — five targeted not-sensitive examples added (Stripe pk_live_, Twilio Account SID, test-conftest password, doc placeholder, bare JDBC URL)
• Cache version bumped to v4 — invalidates verdicts built without file-path context

• Free-edition install error — netpolicy.py was missing from the free wheel; importing cli or licensing raised ImportError

• Release QA harness — one command runs the full release matrix: unit suite, detection regression gate, build all four editions, fresh-install in a clean venv, capability matrix
• /license?session_id webhook — caches the issued key against the Stripe checkout-session ID so the post-purchase page can display it immediately

• Ask-AI gated to Pro+ — localmask ask and ask_about_scan MCP tool require an active Pro license and return a clear upgrade message on Free

Licensing, distribution, and CI/editor integrations. Detection engine unchanged from 0.9.2.

• localmask scan --fail-on-detection — exit non-zero when a secret or PII is found; gates commits and CI runs
• pre-commit hook — add LocalMask to .pre-commit-config.yaml in four lines; blocks commits that contain secrets
• GitHub Action (sgury/[email protected]) — fails a pull request that introduces a secret; runs 100% locally on the runner
• localmask proxy setup — one command points Claude Code, Cursor, Codex, or any AI tool at the local masking proxy Pro
• localmask check-updates — opt-in update check; scanning stays fully offline

• New license system (LM2) — Ed25519-signed, validated 100% offline. Pro is now a one-time purchase: versions within your 12-month update window are yours to run forever
• Paid editions now ship readable source — no compiled .pyc; fixes Python-version fragility and lets you review every line that runs on your code

• Finance Mode — mask monetary amounts (token / bucket / relative). Off by default. Enable with LOCALMASK_MONEY_MODE=relative
• Romanian language pack — CNP checksum-validated; 8 language packs total
• Web dashboard settings — choose Finance Mode and detection languages in the UI; Team/Enterprise can lock these org-wide Pro

• A sentence-ending period no longer splits an amount or blocks a mask

• localmask feedback and a contact address ([email protected])
• PyPI install tracking