Release notes

Interceptor changelog.

Complete release history reconstructed from Git commits, version bumps, and the project roadmap, from the initial 0.1.0 proxy to the current documented 1.134.0 application line.

Version 1.134.0

Browser extension: documentation and packaging

  • Documented the Interceptor Bridge Firefox extension on the site: a new "Browser Extension (Firefox)" features category and a dedicated Support section (pairing, per-container colouring, send-to-Repeater, header stripping, and the safety model).
  • Added packaging setup for the extension (web-ext-ready, with build artifacts ignored) and a companion-extension pointer in the project README.
Version 1.133.0

Browser extension: send-to-Repeater and header stripping

  • The Firefox extension can now send a page straight to the Repeater: a right-click marks the reloaded main-frame request with X-Interceptor-Action: send-to-repeater, which Interceptor validates (against the pairing token) and opens in the Repeater.
  • Added an option to strip security response headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options) in the browser for framing/injection testing.
  • Interceptor honours the send-to-Repeater action on the redacted, scrubbed exchange via a UI-thread hand-off; covered by unit tests.
Version 1.132.0

Firefox companion extension

  • Added the "Interceptor Bridge" Firefox extension (Manifest V3, in extensions/firefox/): a one-click toolbar toggle routes the browser through Interceptor and marks each request with its Firefox container so History rows are coloured by container.
  • Pairing is a token pasted from Settings → Browser bridge; the markers (and token) are only added while routing is on and are stripped by Interceptor before relaying upstream, so they never reach the target server.
  • Ships with a popup (toggle + container legend), an options page (host/port/token), and passes web-ext lint cleanly. Load it via about:debugging or package it with web-ext.
Version 1.131.0

Browser extension bridge (backend)

  • Added opt-in support for a companion Firefox extension: when enabled with a pairing token, Interceptor colours History rows by browser container from an X-Interceptor-Color request marker (mapped to a highlight swatch) and records the container name.
  • All X-Interceptor-* headers are stripped before the request is relayed upstream and are never persisted to history, so the marker and pairing token never reach the target server.
  • Added a "Browser bridge" Settings page (enable toggle + generated pairing token) and a unit-tested, UI-free bridge module. The Firefox extension itself ships next.
Version 1.130.0

HTTPQL: removed the redundant quick-filter chips

  • Removed the History quick-filter chip buttons (Findings, Cookies, JSON, HTML, JS, Images, Errors, In scope); the same filters are now built from the click-to-build popover on the HTTPQL field and evaluated as has: terms in the query.
  • Cleaned up the now-dead chip plumbing across the panel, model, and MainFrame, keeping the scope dropdown and advanced filters unchanged.
Version 1.129.0

HTTPQL: click-to-build filters

  • Added a click-to-build filter popover on the History HTTPQL field: clickable chips for Method, Status, Type, and Flags that build the query, OR-ing selections within a category and AND-ing across, while preserving typed text.
  • Documented and covered the existing boolean operators (AND, OR, NOT, parentheses), e.g. method:get OR method:post, with a new query-builder unit test.
Version 1.128.0

Reporting: proof-of-concept attachments and target pickers

  • The captured request and response of a finding's exchange are now attached to the pushed finding as a size-bounded proof-of-concept.
  • Added Choose... buttons in Settings to pick the SysReptor project or PwnDoc audit from a list fetched from the server, instead of typing its id.
Version 1.127.0

Reporting integration: PwnDoc-ng connector

  • Added a PwnDoc-ng connector behind the shared reporting interface: JWT-cookie login, audit listing, and create/update of findings.
  • PwnDoc create responses do not return the finding id reliably, so it is resolved by matching the finding title in the audit.
  • The Findings panel action is now Send to report... with a backend picker (SysReptor / PwnDoc), and Settings gained a PwnDoc section with its own Test connection button.
Version 1.126.0

Reporting integration: push findings to SysReptor

  • Added a pluggable reporting connector layer and a SysReptor connector that pushes findings into a pentest project over its REST API.
  • Added a Settings → Reporting page (base URL, API token, project id, TLS verification, Test connection) and a Send to SysReptor action in the Findings panel.
  • Findings are created or updated (no duplicates) via a stored id link per connector and target, mapped onto the report fields with a severity-derived CVSS vector.
  • The push runs off the UI thread and reuses Interceptor's own HTTP/TLS stack, with no external runtime dependency.
Version 1.125.0

MCP history_get_exchange tool

  • Added the history_get_exchange MCP tool so Claude can fetch the full request and response (headers and body) of a captured exchange by id.
  • Added a SqliteStorage::LoadExchange(id) loader that materializes spooled bodies, sharing the exchange SELECT with the recent-load path.
Version 1.124.0

MCP history_search tool

  • Added the history_search MCP tool so Claude can search the captured proxy History and get back matching exchanges (id, method, status, URL, MIME, timing).
  • Backed by the internally-synchronized SQLite storage, so the search runs directly on the server's worker thread without touching the UI.
Version 1.123.0

MCP transport hardening

  • Reject cross-origin browser requests to the MCP endpoint by validating the Origin header, in addition to the existing loopback Host check.
  • Added Mcp-Session-Id session handling: the server assigns a session on initialize and rejects stale session ids with 404 so clients re-initialize after a restart.
  • Support session termination via HTTP DELETE, and return clean JSON-RPC errors for malformed requests.
Version 1.122.0

MCP repeater tools: send and list tabs

  • Added the repeater_send MCP tool so Claude can open a new Repeater tab loaded with a raw request for interactive review and replay.
  • Added the repeater_list_tabs MCP tool so Claude can read the titles of open Repeater tabs.
  • Kept the worker thread off the UI: sends are marshaled to the UI thread without blocking, and tab listing reads a cached snapshot refreshed on tab changes.
Version 1.121.0

Claude MCP integration

  • Added an opt-in local MCP server (Model Context Protocol over Streamable HTTP) so Claude can drive Interceptor during authorized testing.
  • Bound the endpoint to loopback only, gated it with a generated bearer token, and added loopback Host checks against DNS-rebinding.
  • Shipped the repeater_replay tool, backed by the scope-aware replay engine, returning response status, headers, and body.
  • Added a Settings → MCP page with live enable/disable, port, token regeneration, and a copy-ready claude mcp add command.
Version 1.112.0

Public support documentation and website alignment

  • Moved application help to the public Support documentation section for deployment at /support/.
  • Documented setup, workspace navigation, proxy capture, opt-in TLS MITM, Repeater, Attacker, active/passive scanners, intrusive-check gates, OAST callbacks, API Surface, GraphQL, WebSockets, network diagnostics, imports, exports, settings, keyboard shortcuts, and troubleshooting.
  • Updated the application Help menu to open https://1nt3rc3pt0r.com/support with a local fallback message if the browser cannot be launched.
  • Aligned site navigation, feature calls to action, pricing copy, download guidance, contact support guidance, and product principles with the expanded documentation.
Version 1.105.0

Unified themed list control and interface polish

  • Introduced a single themed DataListCtrl and migrated every list across the app (History, Connections, Packet Capture, Match/Replace, Intercept queue, Attacker, Repeater, WebSocket panels, Settings, and more) onto it.
  • Added clearly visible zebra striping whose alternate-row colour is derived from the active theme, with centred column headers throughout.
  • Preserved the scroll position when live-updating lists rebuild, so History and other panels no longer jump the focused row back to the top while new requests arrive.
  • Fixed the request/response line-number gutter to align exactly with the text control's line positions instead of drifting toward the bottom.
  • Stripped chunked Transfer-Encoding framing from the Raw message view (the Hex view still shows the exact on-the-wire bytes).
  • Added a Clear button beside the History HTTPQL search field, themed row highlights driven from the History id column, and row hover feedback.
Version 1.100.0

Active security scanner: 45-check detection suite, intrusive gate, and OAST correlation

  • Added a scope-gated active-scan engine with a probe generator, request pacing (global and per-host rate and concurrency limits), and a "Run active scan on in-scope history" action.
  • Shipped 45 opt-in, non-destructive-by-default checks: SQL error / out-of-band / time-based / boolean injection, OS command, SSTI, XXE, CRLF, LDAP, XPath, NoSQL, insecure deserialization, expression-language/OGNL, server-side includes, verbose-error disclosure, host-header injection, active CORS and over-permissive CORS preflight, open redirect (query and body), JWT tampering, IDOR, mass assignment, user enumeration, HTTP TRACE/XST, risky HTTP methods, sensitive path and directory-listing discovery, GraphQL introspection, HTTP parameter pollution, secret exposure, server-side prototype pollution, and web cache deception.
  • Added an explicit intrusive/destructive checks gate (opt-in checkbox, warning, and run-time confirmation) covering ReDoS, unauthenticated HTTP PUT writes, malformed/oversized fault injection, XML entity-expansion (billion laughs) DoS, path-traversal secret-file reads, and XXE out-of-band file exfiltration.
  • Added out-of-band testing with an HTTP collaborator and a DNS collaborator, correlating callbacks into confirmed findings.
  • Enforced Attacker rate limits and concurrency controls in a bounded dispatcher with dedicated throughput knobs.
  • Ran inbound HTTP/3 through the intercept/modify pipeline, and added Swagger 2.0, YAML, and $ref-resolving API spec import.
Version 1.85.0

Reliability, performance, and hardening at scale

  • Hardened storage durability: fsync spooled body files and their directory, sweep orphaned spool files on open, batch retention eviction instead of per-exchange VACUUM, and bound the async write queue with backpressure.
  • Hardened the proxy under load: replaced select() with poll() and capped concurrent connections, recycled finished connection threads, and capped and evicted QUIC connections to bound UDP-flood memory.
  • Kept the UI responsive under bursts by coalescing captured-exchange and network events and moving History filtering, Target Sitemap, Findings, and API Surface rebuilds off the UI thread.
  • Fixed denial-of-service and crash vectors: bounded JSON parser recursion, grep regex subjects, and replay response size (with an O(n^2) chunked-read fix), and resolved several worker/UI data races.
  • Added IPv6 UDP socket support and a shared non-blocking TCP host dialer for upstream connects and replay.
  • Expanded RFC edge-case hardening (HTTP protocol, QPACK static table) and broadened automated test coverage across importers, exporters, scope, authorization, storage normalization, and models.
Version 1.70.0

HTTP/2, HTTP/3, QPACK, MASQUE, WebTransport, and workspace hardening

  • Added HTTP/2 Repeater support for h2c alongside HTTPS ALPN h2 replay.
  • Expanded direct HTTP/2 proxy handling for interleaved request bodies, trailers, safe GOAWAY/error serialization, and stricter frame validation.
  • Hardened HTTP/3 frame and SETTINGS parsing and serialization with QUIC varint bounds, reserved SETTINGS rejection, and strict boolean SETTINGS validation.
  • Expanded QPACK support with Huffman string literals, dynamic table references, dynamic indexed field lines, dynamic literal name references, safe field-section serialization, pseudo-header ordering, duplicate detection, and integer/string bounds checks.
  • Hardened HTTP Datagram Capsule, CONNECT-UDP/MASQUE, IPv6 zone identifier, WebTransport stream/datagram/capsule, and WebSocket Extended CONNECT validation.
  • Added History query numbering, wider timestamp and method columns, smaller History list typography, movable History panel placement, and project-persisted request/response layouts and splitter positions.
  • Added high-contrast and colorblind-friendly themes plus broader theme-defined colors across UI states.
  • Updated version formatting to 1.70.0.Build and refreshed the website feature map, RFC coverage, comparison matrix, and release pages.
Version 1.61.0

Workspace navigation ergonomics

  • Added configurable main tab bar placement from the View menu: left, top, right, or compact switcher-only mode.
  • Added a current-tab switcher that shows the active workspace and opens a dropdown of the other visible tabs.
  • Added compact tab navigation in the top toolbar before the proxy controls for users who want to hide the full tab bar.
  • Kept tab labels left-aligned and fully visible across side and top navigation modes.
  • Updated the website feature map, comparison matrix, and public feature count for the new navigation options.
Version 1.60.0

Auto API Model, API Surface, and safer endpoint workflows

  • Added an explicit Bypass SSL Pinning switch beside TLS and proxy controls, with warning text and visible test-boundary intent.
  • Moved the command palette entry into the Tools menu to keep the primary interface focused.
  • Added Auto API Model normalized route inference from captured history, including path placeholder detection such as numeric IDs.
  • Added an API Surface view for modeled endpoints, observed methods, statuses, authentication evidence, role/profile hints, and linked source exchanges.
  • Added observed request and response shape summaries so inferred schemas are presented as evidence-backed hints rather than authoritative contracts.
  • Added per-endpoint manual test checklist generation for authorization comparison, input validation, cache behavior, sensitive data exposure, replay/regression coverage, and missing negative cases.
  • Added safe endpoint workflow actions to send representative requests to Repeater, create regression coverage, queue auth matrix comparison, add report evidence, or open linked history evidence.
  • Added API model baseline diffing for new endpoints, removed endpoints, changed status behavior, new response fields, newly unauthenticated behavior, and sensitive-looking fields.
  • Added model confidence and evidence counts across the API Surface so reviewers can judge how much captured traffic supports each inference.
  • Updated the website from 115+ to 130+ documented features with a dedicated Auto API Model category and refreshed comparison matrix.
Version 1.50.0

Review ergonomics, layout control, and website refresh

  • Added integrated request and response search bars with regex mode, case-sensitive mode, previous/next navigation, auto-scroll, and match counters.
  • Added theme-aware syntax highlighting for HTTP fields, values, punctuation, cookies, and nested key/value structures.
  • Added line-number gutters with dynamic width for request and response viewers.
  • Added visible invisible-character rendering for spaces, tabs, newlines, carriage returns, and control bytes.
  • Added a safe HTML Render tab for response review.
  • Added switchable request/response layouts: stacked, side-by-side, and tabbed.
  • Added layout icon buttons with active-state indicators.
  • Updated Send To workflows so destination tabs receive a green notification badge without stealing focus.
  • Improved History filters with themeable filter chips, immediate theme refresh, and a wider advanced-filter panel.
  • Added request/response context menu cut, copy, paste, and invisible-character controls.
  • Added a separate self-hosted Python OAST server option for controlled remote callback labs.
  • Updated the website feature map, comparison matrix, and product positioning for the expanded feature set.
Version 1.35.0

Modern protocol diagnostics and RFC coverage

  • Added HTTP/3 protocol primitives with h3 ALPN awareness and QUIC-oriented modeling.
  • Added QPACK codec support for HTTP/3 field representation.
  • Added HTTP Datagrams and Capsule Protocol primitives.
  • Added CONNECT-UDP / MASQUE request recognition and diagnostics.
  • Added WebTransport over HTTP/3 primitives for sessions, streams, datagrams, and close/drain capsules.
  • Added WebSocket bootstrapping awareness for HTTP/2 and HTTP/3 Extended CONNECT.
  • Added RFC 9218 modern Priority header and reprioritization diagnostics.
  • Added ECH / Encrypted ClientHello outer ClientHello detection without bypassing encryption.
  • Added DNS HTTPS/SVCB and Alt-Svc awareness for domains advertising h3.
  • Added an in-app RFC reference page reachable from Help > RFC.
  • Updated the website feature map and public RFC coverage page.
Version 1.31.0

Logging, release control, and download workflow

  • Added configurable daily file logging for persistent diagnostics.
  • Expanded verbose logging coverage for troubleshooting proxy, UI, and runtime behavior.
  • Improved logging output and release readiness cleanup.
  • Updated the public download workflow.
  • Updated website calls to action to point to product downloads and contact options.
Version 1.30.2

Release refresh and UI fixes

  • Prepared a new release build after the 1.30 packet capture cycle.
  • Fixed UI layout issues found during release validation.
  • Polished tooltips and interaction text across the main interface.
  • Removed the database integrity action from the File menu to reduce clutter.
Version 1.30.1

Send To workflow and settings editor cleanup

  • Expanded Send To destinations for captured requests and responses.
  • Added GraphQL as a Send To destination from request context menus.
  • Added site authentication token injection for Repeater.
  • Added response-token save action for later authentication injection.
  • Replaced TSV-based settings editors with list-based forms.
  • Added request context menus with word wrapping for long request and response data.
  • Replaced the main AUI tab strip with toolbar-style navigation.
Version 1.30.0

Packet capture and desktop package distribution

  • Added a Wireshark-like packet capture panel.
  • Added live interface selection and packet detail inspection.
  • Added PCAP capture and evidence export workflows.
  • Cleaned up PacketCaptureSession internals and network interface selector UI.
  • Moved packet details to a right-side pane for faster inspection.
  • Added View > Tabs controls to show or hide main tabs.
  • Added packaged desktop distribution and checksum generation.
  • Updated website release artifacts.
  • Updated screenshots, contact form, website feature count, and release pages.
Version 1.20.0

OAST, advanced workflows, licensing, packaging, and product polish

  • Added local-only OAST callback support with interaction token evidence storage.
  • Added runtime controls for the local OAST callback server.
  • Documented local OAST architecture and authorized-use boundaries.
  • Added engagement profile metadata and project health checks.
  • Added load and benchmark-style tests for storage, WebSocket, queue, and active scan scenarios.
  • Added initial gettext i18n infrastructure with English, French, German, and Spanish catalogs.
  • Defaulted the UI language to English and avoided unnecessary locale popups.
  • Added GraphQL analysis panel and JSON GraphQL operation summaries.
  • Added HTTP/2 MITM ALPN support, HPACK/Huffman work, and HTTP/2 upstream relay foundations.
  • Added OpenAPI and Postman request import.
  • Added Authorization Matrix workflow for comparing endpoints across authentication profiles.
  • Expanded Attacker execution to dispatch attack plans through ReplayEngine with throttle, pause, resume, stop, and emergency stop controls.
  • Added WebSocket frame intercept queue, frame filtering, forward/drop decisions, edit dialog, timeout handling, and cancellation.
  • Added optional blind crawl seed generation with explicit warnings and scope enforcement.
  • Added session macro workflows and project settings saved as cfg files.
  • Added upstream proxy chaining and later completed corporate upstream proxy support.
  • Added per-host mTLS client certificate support.
  • Added offline signed shareware licensing and moved registration to the Help menu.
  • Removed the temporary hardcoded binary expiration after licensing was introduced.
  • Added Debian, Windows MSI, and macOS DMG packaging targets.
  • Added integrated help documentation, project testing workspace checklist, request diff timeline, evidence board, and low-level connection inspector.
  • Persisted main window placement across restarts.
  • Added website rebuilds, screenshot gallery updates, and about-box updates.
Version 1.15.0

Extensibility, plugins, settings organization, and diagnostics

  • Defined internal extension points for passive rules, active checks, history actions, export formats, and request transformations.
  • Added stable extension data model for requests, responses, findings, and scope.
  • Added plugin manifest format, plugin loading from user directories, and plugin enable/disable UI.
  • Added plugin sandboxing strategy and a native C++ plugin ABI contract.
  • Added declarative scriptable passive scanner rules.
  • Added declarative scriptable request transformations.
  • Added plugin API documentation, examples, and integration tests.
  • Moved sample plugins to documentation and bundled finalized passive observation plugins.
  • Added XSS parameter candidate plugin example.
  • Introduced wxAUI main frame layout.
  • Replaced settings tabs with wxTreebook navigation.
  • Split settings into focused scanner, plugin, diagnostics, active scan, and rewrite-rule pages.
  • Moved settings warnings into dockable status panels.
  • Grouped findings by host then severity.
  • Stored project-generated files in per-project directories.
  • Moved project storage directly near the .itp project file.
  • Added diagnostics and health panels.
  • Updated product and technical documentation.
Version 1.14.0

Active scanner and reporting

  • Added active scanner configuration and UI integration.
  • Required explicit target scope before active checks can run.
  • Enforced non-destructive active checks by default.
  • Added crawl planning from observed sitemap data.
  • Added active request queue limits, concurrency controls, per-host controls, and safe cancellation.
  • Added active reflected input checks.
  • Added paired authorization indicator checks.
  • Added harmless XSS reflection probes.
  • Added conservative SQL error observation checks.
  • Added explicit-parameter path traversal checks.
  • Added URL-like open redirect checks.
  • Added safe command injection observation checks.
  • Added controlled SSRF callback checks backed by local-only OAST evidence.
  • Added CSRF token presence checks.
  • Added active scan result deduplication and confidence scoring.
  • Added active scan report export.
  • Added Markdown report tool panel, formatting toolbar, report review mode, and loading of existing Markdown reports.
  • Added known-vulnerable test app fixtures for regression coverage.
Version 1.13.0

Certificate pinning assessment boundaries

  • Added TLS interception failure classification.
  • Added history markers for pinning-related TLS failures.
  • Added pinning diagnostics panel explaining observed symptoms without bypassing platform protections.
  • Added project-level authorization notes for mobile and application testing engagements.
  • Added per-target pinning assessment scope configuration.
  • Added controlled lab integration options for authorized pinning diagnostics.
  • Added instrumentation helper configuration as an explicit, auditable boundary.
  • Added QA-safe paths configuration for app-owner testing workflows.
  • Added instrumentation payload catalog mode and tests while preserving the no-stealth-bypass product boundary.
Version 0.13.0

WebSocket completion and UI polish

  • Completed WebSocket frame display inside the message viewer.
  • Added WebSocket frame search and filters.
  • Added per-message compression awareness.
  • Added WebSocket session export.
  • Added Send To Decoder for WebSocket payloads.
  • Added WebSocket replay UI and execution support.
  • Added WebSocket frame interception and fixture-server tests.
  • Added global clear-history action.
  • Added UI theme configuration and main-interface theme application.
  • Added macOS app icon generation.
  • Improved history filters, status badges, summary updates, and global search.
  • Moved Repeater to wxAuiNotebook and added Close All Tabs behavior.
Version 0.12.0

WebSocket capture foundation

  • Detected HTTP Upgrade: websocket handshakes.
  • Stored WebSocket handshake request and response data.
  • Implemented WebSocket frame relay.
  • Captured text and binary WebSocket frames.
  • Stored frame metadata for later UI display and export.
  • Kept binary frame display safe for the UI.
Version 0.11.0

Attacker

  • Added Attacker module and Send To Attacker workflows.
  • Added payload position selection and request mutation engine.
  • Added attack types including single, broadcast, lockstep, and combinator.
  • Added payload sets for simple lists, numbers, dates, case mutations, and file input.
  • Added rate limits, concurrency controls, pause, resume, graceful stop, and emergency stop.
  • Added scope guard for Attacker execution.
  • Added response table with status, length, words, lines, duration, MIME, title, errors, grep matches, and extracts.
  • Added grep match and grep extract helpers.
  • Added baseline request comparison.
  • Added redirect handling and cookie handling options.
  • Added result filtering, sorting, and CSV export.
  • Added Attacker fixture server tests.
Version 0.10.0

Decoder, encoder, and comparer tools

  • Added Decoder tool panel.
  • Added URL, Base64, Base64URL, hex, HTML entity, JSON string, and Unicode escape encode/decode workflows.
  • Added JWT decoding with header and payload display.
  • Added hash helpers for MD5, SHA-1, SHA-256, and SHA-512.
  • Added HMAC helper with explicit key entry.
  • Added gzip and deflate compression/decompression helpers.
  • Added pretty printers for JSON, XML, HTML, CSS, and JavaScript.
  • Added Comparer tool with request, response, text, and hex diffs.
  • Integrated Send To Decoder and Send To Comparer from history and Repeater.
Version 0.9.0

Passive scanner

  • Persisted passive findings in SQLite.
  • Added Findings panel with severity, host, URL, title, evidence, and status.
  • Added deduplication by issue type, host, path, parameter, and evidence.
  • Added finding lifecycle states: open, confirmed, false positive, and ignored.
  • Added configurable passive scanner rules.
  • Improved cookie, security header, CORS, cache, mixed content, and insecure form checks.
  • Added server/version disclosure checks.
  • Added sensitive data detection for keys, tokens, private keys, cloud credentials, stack traces, and debug errors.
  • Added JWT detection and weak metadata warnings.
  • Added TLS observations, MIME sniffing mismatch checks, parameter inventory, and suspicious parameter checks.
  • Added JavaScript passive analysis for secrets, source maps, and endpoint extraction.
  • Added confidence levels, remediation text, and fixture-backed scanner tests.
Version 0.8.0

Target scope, sitemap, export, import, and reporting

  • Added target scope model with protocol, host, port, path regex, include, and exclude rules.
  • Added target scope editor UI and import/export of scope configuration.
  • Added in-scope/out-of-scope markers and show-only-in-scope filters.
  • Added target sitemap tree with host, path, endpoint, methods, statuses, MIME types, parameters, and forms.
  • Added endpoint detail panel with observed requests and responses.
  • Added scope enforcement for Repeater, Attacker, and active scanner.
  • Added HAR 1.2 export with headers, cookies, query strings, post data, timings, sizes, and MIME types.
  • Added raw request and raw response export.
  • Added selected exchanges export.
  • Added full session JSON export and import.
  • Added findings export as JSON, Markdown, and HTML.
  • Added report templates for passive findings.
  • Added redaction before export.
  • Added export progress and cancellation for large sessions.
  • Added HAR fixture validation tests.
Version 0.7.x

Target scope and sitemap milestone

  • Implemented the scope model and matching engine.
  • Added visual scope markers in history.
  • Added sitemap endpoint discovery and observed request metadata.
  • Added parameter tracking from query strings, forms, JSON, XML, cookies, and headers.
  • Added tests for scope matching and sitemap behavior.
Version 0.6.x

Repeater milestone

  • Implemented ReplayEngine for standalone HTTP and HTTPS requests.
  • Added Repeater tabs and raw request editor.
  • Added parsed editor for method, scheme, host, port, path, query, headers, and body.
  • Added send, cancel, timeout, and response viewer controls.
  • Stored replay traffic in history with a source marker.
  • Added Send History Item To Repeater.
  • Added duplicate, rename, close, and restore tab behavior.
  • Added redirect handling and cookie jar behavior.
  • Added request comparison between replay attempts.
  • Added replay tests for HTTP, HTTPS, timeout, DNS error, and edited bodies.
Version 0.5.0

Intercept mode

  • Implemented the InterceptQueue between parsed traffic and forwarding.
  • Added global intercept toggle.
  • Added request and response interception rules.
  • Added Forward, Drop, Edit, and Forward All actions.
  • Added timeout behavior for queued messages.
  • Added UI warnings when queued traffic blocks browser behavior.
  • Added raw request editor and raw response editor with validation.
  • Added body editor modes for raw text, form, JSON, XML, and hex.
  • Added automatic Content-Length recalculation after edits.
  • Added advanced option to preserve malformed requests.
  • Added match-and-replace rules for headers and bodies.
  • Added rule enable/disable, ordering, and preview.
  • Added audit log for modified messages.
  • Added regression coverage for edit, drop, modified response, and timeout flows.
Version 0.4.0

Proxy UI core and history workflow

  • Added persistent configuration for proxy, TLS MITM, timeouts, limits, storage, and UI settings.
  • Added centralized Settings dialog with category navigation.
  • Added runtime-safe settings application, validation, defaults reset, and risk warnings.
  • Added advanced history filters and quick filter chips.
  • Added full-text search over URL, headers, request body, and response body.
  • Added sortable history columns.
  • Added request/response viewers with raw, headers, pretty, hex, and rendered text modes.
  • Added syntax highlighting for JSON, XML, HTML, JavaScript, CSS, and HTTP.
  • Added decompression display for gzip, deflate, and Brotli.
  • Added copy commands for URL, request, response, and cURL.
  • Added annotations, highlight colors, issue markers, and false-positive markers.
  • Added Send To Repeater, Attacker, Decoder, and export selected actions.
  • Added keyboard navigation shortcuts and safe binary body display.
  • Added RequestHistoryModel tests for large histories.
Version 0.3.0

Storage, capture model, and data integrity

  • Introduced SQLite schema versioning and migration tests.
  • Split exchange data into structured metadata, headers, small bodies, body spools, TLS info, findings, annotations, and replay-related tables.
  • Added indexes for timestamp, host, method, status, MIME type, URL, and scope.
  • Added transaction boundaries for complete exchange saves.
  • Added AsyncWriteQueue so proxy workers are not blocked by storage writes.
  • Added retention settings for database size, body capture size, and age.
  • Added sensitive data redaction for cookies, authorization headers, API keys, and custom patterns.
  • Stored raw and normalized bodies where needed.
  • Added capture truncation metadata.
  • Added complete project session export and import.
  • Added database integrity check and repair guidance.
  • Added crash-safe handling for partial captures.
Version 0.2.0

TLS MITM robustness

  • Supported multiple HTTP requests inside a single intercepted TLS tunnel.
  • Added per-host certificate cache with concurrent access safety.
  • Added certificate regeneration policy for CA or parameter changes.
  • Improved generated certificate SAN support for DNS names and IP addresses.
  • Added TLS handshake diagnostics in UI history.
  • Added upstream certificate details including subject, issuer, validity, SANs, protocol, cipher, and verification result.
  • Added upstream TLS verification control with clear warnings.
  • Added per-host MITM bypass rules.
  • Added global and per-scope TLS interception rules.
  • Added ALPN handling and explicit HTTP/2 behavior.
  • Added clear rejection behavior when HTTP/2 support was not available yet.
  • Added TLS minimum and maximum version settings.
  • Added SNI behavior tests and upstream certificate failure tests.
  • Added local CA rotation and deletion UI.
  • Documented how to remove CA trust from browser and OS stores.
Version 0.1.0

Initial proxy and HTTP/1.1 correctness

  • Created the initial CMake, wxWidgets, proxy, storage, and desktop application structure.
  • Added local HTTP proxy capture on 127.0.0.1:8080.
  • Added basic HTTP request and response handling.
  • Added CONNECT method tunnel pass-through before MITM support.
  • Added menu bar, About dialog, and Quit action.
  • Added early TLS MITM support with CA management and dynamic certificate generation.
  • Added roadmap, project hygiene baseline, contributor workflow, coding rules, and test strategy.
  • Added persistent client and upstream connection handling.
  • Preserved keep-alive behavior and handled hop-by-hop headers.
  • Added request lifecycle state machine.
  • Handled Content-Length bodies, chunked transfer encoding, trailers, Expect: 100-continue, informational responses, no-body responses, body limits, large-body streaming, and body spooling.
  • Tracked bytes sent, received, and captured separately.
  • Added timeouts, cancellation, graceful half-close, DNS retry diagnostics, IPv6 literal support, and request target form coverage.
  • Added parser hardening for malformed headers, duplicate headers, folded lines, invalid CRLF, and oversized fields.