Highlights
- Renames masking
whitelistconfig toallowlist. - Replaces language detection config with optional
phone_regions; phone detection is international-only by default. - Limits default PII/secrets scanning to input-controlled roles:
user,tool,function, andmcp. - Enables all supported secret detectors by default.
- Tunes GLiNER confidence floors to reduce person/location false positives.
- Fixes OpenAI streaming unmasking when SSE JSON lines split across chunks.
- Improves Codex role inference and masking for tool, shell, and MCP outputs.
- Tracks browser-extension requests separately in dashboard stats.
- Redirects
/to the dashboard when enabled, otherwise/health.
Upgrade Notes
- Rename
masking.whitelisttomasking.allowlistin config files. - Replace language detection config with
phone_regionswhere region-specific phone handling is needed.
Images
ghcr.io/sgasser/pasteguard:0.7.0ghcr.io/sgasser/pasteguard:latest