# Changelog

All notable changes to the Android Kiosk Browser project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.0.0-MVP] - 2026-02-03

### Added
- **Fullscreen WebView browser** with immersive mode (hides status & navigation bars)
- **URL whitelist system** with proper domain boundary matching
- **Configurable homepage** URL via admin settings
- **Lock Task Mode** support for full kiosk lockdown
- **Admin PIN protection** (default: 1234) with 3-tap corner unlock
- **Auto-launch on boot** via RECEIVE_BOOT_COMPLETED receiver
- **Idle timeout** with automatic return to homepage and session clearing
- **Admin settings panel** for runtime configuration
- **29 unit tests** covering whitelist, idle timer, and config validation

### Security
- Fixed whitelist bypass vulnerability (`hobbs.farm.evil.com` attack vector)
- Proper domain boundary checking: `host == domain || host.endsWith(".$domain")`

### Documentation
- README.md with setup instructions
- TESTING.md with comprehensive QA checklist
- IMPROVEMENTS.md with code review findings

### Technical Details
- **Language:** Kotlin
- **Min SDK:** 21 (Android 5.0+)
- **Target SDK:** 34
- **Dependencies:** AndroidX Core, AppCompat, WebKit, Preference

---

## Future Releases (Planned)

### [1.1.0] - Remote Management
- Remote configuration updates
- Usage analytics
- Centralized device management

### [1.2.0] - Multi-Profile
- Multiple whitelist profiles
- Scheduled profile switching
- Digital signage mode

---

*Maintained by the hobbs.farm team: Pluto 🪐, Spirit 👻, Margaret 🌸*