# Changelog

## 0.2.0 - 2026-09-28

First public release under MIT.

- `scan()` finds compose services that publish host ports and so bypass the
  reverse proxy. Sensitive ports are critical, other ports high, loopback
  bindings informational.
- The proxy publishing 80 and 443 is not flagged. A proxy label does not
  excuse a published port.
- `toReport()` and `formatScan()` produce and render a report in the
  `@extant2000/evidence-record` format, citing file, line and binding.
- An empty scan is reported as not assessed, never as clean.