FeedbackPilot

1.1.6

• Prevents stacked dialogs and duplicate screenshot captures after rapid clicks.
• Announces screenshot preparation and falls back after 7.5 seconds.
• Cleans dialog listeners, timers and spam checks on every close path.
• Keeps the console catcher synchronous without an invalid WordPress script strategy.

1.1.5

• Keeps the cloned viewport at the click-time scroll position when clone-only layout repairs would otherwise trigger browser scroll anchoring.
• Strengthens the cross-browser screenshot gate with a visible downstream anchor and exact vertical landmark comparison.
• Prevents text in tightly padded, fixed-height input fields from being vertically clipped in screenshots.
• Builds the release ZIP from a verified allowlist and checks the bundled browser-asset provenance and checksums before publication.

1.1.4

• Keeps scrolled screenshots aligned on pages that combine smooth scrolling with dynamic float/clearfix layouts.
• Preserves fixed elements, the live scroll position, and the page's original inline scroll styles while cloning.
• Runs the real FeedbackPilot screenshot path in Chromium, Firefox, and WebKit before merge and release.
• Updates vulnerable development-only lint dependencies and aligns optimized Composer autoloading with the plugin's WordPress-style filenames; development tools are not included in the plugin ZIP.

1.1.3

• Captures the viewport the visitor is actually viewing after scrolling, including themes whose document uses visible overflow.
• Lets site owners hide the guidance beside the public button while keeping it visible inside the report form.
• Ships complete German translations for both de_DE and de_DE_formal.
• Verifies new Turnstile credentials before saving and distinguishes visitor challenge failures from configuration or temporary provider failures.

1.1.2

• Lets site owners customize the public widget button and a directly visible guidance notice from Settings -> FeedbackPilot.
• Uses translated privacy-safe defaults when either field is missing, empty, or whitespace-only, with no migration required for existing installations.
• Sanitizes both settings as plain text, repeats the notice inside the form, and adds automated regression coverage.

1.1.1

• Bundles html2canvas-pro and the native Altcha fallback in the plugin ZIP so FeedbackPilot no longer requires visitor-browser requests to jsDelivr.
• Keeps optional Cloudflare Turnstile as an explicit admin-enabled spam-protection integration.
• Updates privacy/GDPR documentation to reflect the local asset delivery model.

1.1.0

• Adds FeedbackPilot support for WordPress login, lost-password, retrieve-password, and reset-password screens.
• Adds sanitized auth-screen context to generated issues so reports from login/reset pages are easy to triage.
• Redacts reset keys, login identifiers, nonces, tokens, and password-like values from auth-screen URLs, console logs, and issue bodies.
• Clears sensitive login/reset form fields from the cloned screenshot document before rendering, without changing the live page.

1.0.5

• Adds a trusted triage gate to generated GitHub issues so maintainers and LLM agents validate visitor reports before turning them into code changes.
• Requires non-implementation outcomes such as already shipped, duplicate, needs more information, not planned, irrelevant, or spam to remain explicit options during triage.
• Updates LLM-agent guidance and smoke checks for this prompt-injection defence-in-depth layer.

1.0.4

• Makes the visitor-facing widget and modal copy easier to understand for non-technical users; GitHub and issue-tracker wording is kept out of the frontend.
• Localizes the native Altcha fallback challenge UI when the standalone Altcha WordPress plugin is not installed.
• Prevents browser/password-manager autofill from interfering with Turnstile credential fields in the settings page.

1.0.3

• Shows friendly, localized submit error messages instead of internal REST error codes such as rate_limited.

1.0.2

• Fixes captcha-protected submissions incorrectly hitting the unauthenticated 60-second burst limiter after a solved Altcha or Turnstile challenge.
• Failed or missing captcha submissions no longer consume a report rate-limit slot; the hourly per-IP cap still applies to successful reports.

1.0.1

• Fixes screenshot capture on pages where CSS text-transform changes text length, avoiding an upstream html2canvas-pro Range.setEnd IndexSizeError.
• Documents Cloudflare Turnstile CSP requirements for sites with strict Content Security Policy headers.
• Adds a reduced browser fixture for the html2canvas text-transform regression.

1.0.0

• First stable release for production use.
• Adds GDPR-readiness improvements: visitor-facing privacy notice, admin controls to disable screenshot capture and console-log inclusion, and server-side enforcement of those minimisation settings.
• Hardens Cloudflare Turnstile validation by binding tokens to the expected action and hostname.
• Keeps the v0.1.16 security hardening: native Altcha replay protection, prompt-injection boundaries, proxy-aware rate limiting, AES-256-GCM token storage, and validated screenshot storage.
• Updates README, German README, readme.txt, wiki privacy guidance, translations, and smoke checks for the v1.0 release.

0.1.16

• Security hardening release: native Altcha fallback now uses delimited salts, strict validation, expiry checks, and replay protection.
• Prompt-injection follow-up: visitor-supplied metadata and console logs are fenced/normalized as untrusted content, with a PII-minimized suspected-injection hook for integrations.
• Rate limits now trust only REMOTE_ADDR by default, with explicit Cloudflare and generic reverse-proxy modes.
• Token storage now uses a versioned AES-256-GCM envelope where available, with legacy AES-256-CBC read/migration support.
• Screenshot storage now enforces PNG dimension/pixel ceilings and re-encodes PNGs via GD when available.
• Turnstile secret placeholders no longer risk overwriting stored secrets; update-cache flushing now targets only FeedbackPilot's EDD-SL cache key.

0.1.0

• Initial release. Console catcher, annotated screenshot, GitHub-Issue submission via OAuth-connected user token (or manual fine-grained PAT).