Changelog

Every notable change, release by release. The same history lives in CHANGELOG.md in the repository, next to the code it describes.

Unreleased

Open the real site. When a page impersonates a known brand, the panel and the warning banner offer one button that opens the brand's genuine site instead.
Just-in-time nudge. On a high-risk page the warning banner now also appears the first time a password or one-time code field gains focus, even without strict mode. Still never blocks.
First-run welcome page. After install, one short page shows the four colors, how to open the panel, and a link to the live demo.
Form-action signal. A password or code form that posts to a foreign domain, a raw IP, or a known exfiltration endpoint now raises the score.
Recall benchmark. The catch rate over ~390k live phishing hosts is measured by script and published on the benchmark page, next to the false-positive rate.
Full public suffix list. ~9,000 rules with wildcards and exceptions replace the hand-picked 145-entry subset.

ML model v2. A hashed character n-gram model over the full hostname: zero false positives on the top 100k sites, any-signal recall up from 33% to 73%.
Signed threat lists. Update bundles are signed with a pinned key and may only add threat data; anything unsigned or tampered is refused.

Popup layout: wider, action buttons wrap instead of overflowing.
Device-code matcher requires a real code on the page and skips lessons and known-good sites.

Initial store submission.

On-device phishing analysis of every page: lookalike domains, brand misspellings, homoglyphs, high-abuse endings, phishing keywords and more, combined into one score and four colors. Warns, never blocks.
Page probe for password and one-time-code forms, AiTM sign-in pages, device-code scams, crypto seed-phrase and tech-support scams, and suspicious links.
QR code checks (right-click, file, or camera), fully local.
Side panel on Chromium; popup and sidebar on Firefox. Strict mode, trusted sites, family mode, download guard.
Opt-in extras, all off by default: signed threat-list updates, domain age via RDAP, Google Safe Browsing with your own key.
English and Georgian. Free, MIT licensed, nothing leaves your browser by default.