ajianaz · Jun 7, 2026 · Jun 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,29 @@ All notable changes to cora-cli are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.6] - 2026-06-07
+
+### Changed
+
+- **README redesigned** — 568 → 148 lines, professional layout with star badge, docs index table, links to docs/ for details (#162)
+- **All docs updated for v0.4.5+** — changelog, getting-started, usage, roadmap, examples, installation
+
+### Added
+
+- **Deterministic secrets pre-scan** — 12 built-in patterns (AWS, GitHub, OpenAI, Anthropic, Groq, xAI, Slack, Stripe, Google, JWT, Private Key) run before AI review (#204)
+  - Masked output: `AKIA****CDEF` (first 4 + last 4 chars shown)
+  - Auto-skip test/spec/fixture/mock/example files
+  - Secrets findings injected into LLM context for consistent summary
+  - Fallback path blocks on critical findings even when LLM fails
+- **Diff parser hardening** — hunk line count validation, broader binary detection (GIT binary patch, singular form), graceful truncated diff handling (#195 Phase 1)
+- **`.agent.md` release checklist** — pre-release checklist to prevent docs drift between versions
+
+### Fixed
+
+- `cora config show --global` / `--project` documented in cli-reference.md (was missing)
+- `cora auth login` path corrected from `config.toml` to `auth.toml` in cli-reference.md
+- CI example in docs now includes CORA_BASE_URL and CORA_MODEL secrets
+
 ## [Unreleased]
 
 ## [0.4.5] - 2026-06-07
@@ -330,7 +353,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Cross-platform** — Linux (x86_64, ARM64), macOS (Apple Silicon), Windows (x86_64)
 - **MIT License** — fully open source
 
-[Unreleased]: https://github.com/codecoradev/cora-cli/compare/v0.4.5...develop
+[Unreleased]: https://github.com/codecoradev/cora-cli/compare/v0.4.6...develop
+[0.4.6]: https://github.com/codecoradev/cora-cli/compare/v0.4.5...v0.4.6
 [0.4.5]: https://github.com/codecoradev/cora-cli/compare/v0.4.4...v0.4.5
 [0.4.4]: https://github.com/codecoradev/cora-cli/compare/v0.4.3...v0.4.4
 [0.4.3]: https://github.com/codecoradev/cora-cli/compare/v0.4.2...v0.4.3

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cora-cli"
-version = "0.4.5"
+version = "0.4.6"
 edition = "2024"
 description = "CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks"
 license = "MIT"

diff --git a/README.md b/README.md
@@ -22,7 +22,7 @@
 - ⚡ **Native Rust** — fast binary, no runtime dependencies, cross-platform
 - 🪝 **Pre-commit hooks** — catch issues before they reach CI
 - 📋 **SARIF output** — upload to GitHub Code Scanning
-- 🛡️ **Deterministic rules** — regex-based pre-scan that always catches known patterns
+- 🛡️ **Deterministic rules + secrets scanner** — regex-based pre-scan that always catches known patterns and leaked credentials
 - 💾 **Diff-hash caching** — skip repeat reviews automatically
 - 🔧 **Configurable** — per-project `.cora.yaml`, global `~/.cora/config.yaml`, or env vars
 

diff --git a/docs/changelog.md b/docs/changelog.md
@@ -6,6 +6,27 @@ title: Changelog
 
 For the full changelog, see the [repository](https://github.com/codecoradev/cora-cli/blob/develop/CHANGELOG.md).
 
+## [0.4.6] - 2026-06-07
+
+### Changed
+
+- **README redesigned** — 568 → 148 lines, professional layout with star badge and docs index (#162)
+- **All docs updated** — changelog, getting-started, usage, roadmap, examples, installation
+
+### Added
+
+- **Deterministic secrets pre-scan** — 12 built-in patterns (AWS, GitHub, OpenAI, Anthropic, Groq, xAI, Slack, Stripe, Google, JWT, Private Key) (#204)
+  - Masked output, auto-skip test files, injected into LLM context
+  - Fallback blocks on critical findings when LLM fails
+- **Diff parser hardening** — hunk line count validation, broader binary detection, truncated diff handling (#195 Phase 1)
+- **`.agent.md` release checklist** — prevents docs drift between versions
+
+### Fixed
+
+- `cora config show` flags documented in cli-reference.md
+- `cora auth login` path corrected in cli-reference.md
+- CI example includes all required secrets
+
 ## [0.4.5] - 2026-06-07
 
 ### Changed

diff --git a/docs/cli-reference.md b/docs/cli-reference.md
@@ -35,6 +35,9 @@ Complete command reference for the cora CLI.
 | `cora scan` `<path>` | Scan files for issues |
 | `cora scan .` `[--incremental]` | Scan only changed files |
 | `cora config show` | Show resolved configuration |
+| `cora config show --global` | Show global config (`~/.cora/config.yaml`) |
+| `cora config show --project` | Show project config (`.cora.yaml`) |
+| `cora config set` `<key>` `<value>` | Set a config value |
 | `cora hook install` | Install pre-commit hook |
 | `cora hook uninstall` | Remove pre-commit hook |
 | `cora auth login` | Save API key to `~/.cora/auth.toml` |

diff --git a/docs/configuration.md b/docs/configuration.md
@@ -151,3 +151,19 @@ cora uses two mechanisms to prevent the LLM from fabricating findings:
 
 - **File path injection** — Actual file paths are embedded in the prompt, anchoring the LLM to real files in the diff.
 - **Post-parse filtering** — After parsing, any reported file paths or line numbers that don't exist in the actual diff are discarded.
+
+## Secrets Pre-Scan
+
+cora runs a deterministic secrets scan before the AI review. 12 built-in patterns detect leaked credentials:
+
+| Pattern | Severity |
+|---------|----------|
+| AWS Access Key (`AKIA...`) | Critical |
+| GitHub Token (`ghp_`/`gho_`/`ghu_`) | Critical |
+| OpenAI API Key (`sk-`/`sk-proj-`) | Critical |
+| Anthropic API Key (`sk-ant-`) | Critical |
+| Private Key Block | Critical |
+| JWT Token | Major |
+| And more (Groq, xAI, Slack, Stripe, Google) | Varies |
+
+Secrets are automatically **masked** in output (e.g. `AKIA****CDEF`). Test/spec/fixture files are auto-skipped.
diff --git a/docs/installation.md b/docs/installation.md
@@ -21,7 +21,7 @@ echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
 Pin a specific version:
 
 ```bash
-$ CORA_VERSION=v0.4.5 curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install.sh | sh
+$ CORA_VERSION=v0.4.6 curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install.sh | sh
 ```
 
 ## Install via Cargo

diff --git a/docs/roadmap.md b/docs/roadmap.md
@@ -60,8 +60,8 @@ Demand-gated — we build what people actually need. Track progress on [GitHub I
 ## v0.4.6 — Polish & Docs
 
 - [#162](https://github.com/codecoradev/cora-cli/issues/162) README overhaul — market-facing copy — ✓ Done
-- [#204](https://github.com/codecoradev/cora-cli/issues/204) Deterministic secrets pre-scan — ◎ Planned
-- [#195](https://github.com/codecoradev/cora-cli/issues/195) Diff parser hardening — ◎ Planned
+- [#204](https://github.com/codecoradev/cora-cli/issues/204) Deterministic secrets pre-scan — ✓ Done
+- [#195](https://github.com/codecoradev/cora-cli/issues/195) Diff parser hardening Phase 1 — ✓ Done
 
 ## v0.5 — Agent & Quality