release: v1.3.0 — security fixes, backfilled changelog, stability

Security:
- Fix HIGH severity command injection in glob (10.4.5 → 10.5.0)
- Fix MODERATE prototype pollution in js-yaml transitive dep
- 0 npm audit vulnerabilities remaining

Added:
- SECURITY.md with vulnerability reporting policy
- RESPONSE_STYLE_CONFIG.md for optional confidence indicators
- Response Style Configuration section in CLAUDE.md
- Requirements section in README with Node.js version guidance
- Links to CHANGELOG.md and SECURITY.md in README

Changed:
- Backfilled CHANGELOG.md for all versions (1.0.2 through 1.3.0)
- Updated fs-extra dependency range (^11.0.0 → ^11.1.0)
- Promoted from 1.3.0-beta.1 to stable 1.3.0
- Version test expectations updated to 1.3.0

Note: v2.0.0 will raise minimum Node.js from >=16 to >=18.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: superbasicstudio

CHANGELOG.md

@@ -5,7 +5,79 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.3.0] - 2025-06-17
+
+### Security
+- Fixed HIGH severity command injection vulnerability in glob (10.4.5 → 10.5.0)
+- Fixed MODERATE severity prototype pollution in js-yaml transitive dependency
+- Resolved all `npm audit` findings — 0 vulnerabilities remaining
+
+### Changed
+- Updated `fs-extra` dependency range from `^11.0.0` to `^11.1.0`
+- Promoted from 1.3.0-beta.1 to stable 1.3.0
+
+### Added
+- SECURITY.md with vulnerability reporting policy and supported versions
+- Requirements section in README with Node.js version guidance
+
+### Upcoming
+- **v2.0.0** will raise the minimum Node.js requirement from >=16.0.0 to >=18.0.0. Node 16 has been EOL since September 2023. Users on Node 16 can remain on 1.3.x.
+
+## [1.3.0-beta.1] - 2025-06-17
+
+### Added
+- Backup/restore upgrade system for safe version upgrades
+  - `npx claude-conductor backup` — backs up user-customized files
+  - `npx claude-conductor upgrade --clean` — clean reinstall of templates
+  - `npx claude-conductor restore` — restores user data after upgrade
+- Alpha warnings on upgrade system commands
+- Version comment stamps on generated files (`<!-- Generated by Claude Conductor vX.X.X -->`)
+- Comprehensive test suite for backup/upgrade/restore lifecycle
+
+### Changed
+- Version bumped to 1.3.0-beta.1 for prerelease testing
+
+## [1.2.0] - 2025-06-16
+
+### Added
+- TASKS.md documentation module for active task management
+- THANKS.md to acknowledge community contributions
+- GitHub issue templates for bug reports and feature requests
+- Table of Contents in README for better navigation
+- "Back to top" navigation links in README sections
+
+### Changed
+- Version bumped to 1.2.0
+
+## [1.1.1] - 2025-06-16
+
+### Changed
+- Version bumped to 1.1.1
+- Updated test expectations to match version
+
+## [1.1.0] - 2025-06-15
+
+### Added
+- GitHub Pages for Contributing guide
+- Links to PRIVACY.md and TERMS.md in README
+- GitHub Sponsors funding configuration (FUNDING.yml)
+- CLAUDE.md journal requirements notice for existing files
+- Security health check (`checkup` command) with interactive prompt
+- Legal disclaimer about running at your own risk
+
+### Changed
+- Switched license from MIT to BSD 2-Clause
+- Removed decorative emoji from README, kept functional UX elements
+- Renamed `vuln-scan` to `checkup` command with interactive prompt
+- Refactored security scanning into a CLI command
+- Clarified README examples are hypothetical projects, not Conductor dependencies
+- Fixed shorthand command and broken links in README
+- Fixed documentation website URL formatting in PRIVACY.md
+- Fixed broken GitHub Pages links (removed .html extensions)
+- Removed Patreon sponsorship link
+- Updated logos and branding assets
+
+## [1.0.2] - 2025-06-14
 
 ### Added
 - Privacy policy link in README
@@ -21,7 +93,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Clarified network request policy (allowing npm package installation)
 - Updated footer links to point to superbasic.studio website
 
-## [1.0.1] - 2025-01-06
+## [1.0.1] - 2025-06-14
 
 ### Added
 - Deep scan feature (`--deepscan` flag) for comprehensive codebase analysis
@@ -43,7 +115,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Confirmed zero network requests (except npm installation)
 - No telemetry or data collection
 
-## [1.0.0] - 2025-01-05
+## [1.0.0] - 2025-06-14
 
 ### Added
 - Initial release of Claude Conductor
@@ -63,6 +135,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Critical error ledger
 - Support for multiple package managers (npm, npx, yarn, pnpm, bun)
 
-[Unreleased]: https://github.com/superbasicstudio/claude-conductor/compare/v1.0.1...HEAD
+[1.3.0]: https://github.com/superbasicstudio/claude-conductor/compare/v1.3.0-beta.1...v1.3.0
+[1.3.0-beta.1]: https://github.com/superbasicstudio/claude-conductor/compare/v1.2.0...v1.3.0-beta.1
+[1.2.0]: https://github.com/superbasicstudio/claude-conductor/compare/v1.1.1...v1.2.0
+[1.1.1]: https://github.com/superbasicstudio/claude-conductor/compare/v1.1.0...v1.1.1
+[1.1.0]: https://github.com/superbasicstudio/claude-conductor/compare/v1.0.2...v1.1.0
+[1.0.2]: https://github.com/superbasicstudio/claude-conductor/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/superbasicstudio/claude-conductor/compare/v1.0.0...v1.0.1
-[1.0.0]: https://github.com/superbasicstudio/claude-conductor/releases/tag/v1.0.0
+[1.0.0]: https://github.com/superbasicstudio/claude-conductor/releases/tag/v1.0.0

CLAUDE.md

@@ -84,12 +84,52 @@ The framework includes a systematic error ledger (`CONDUCTOR.md:241-275`):
 - Document Anti-Patterns
 - Set up Version History
 
+## Response Style Configuration (Optional)
+
+### Enable/Disable Response Style Controls
+To enable measured response style, add the following to your CLAUDE.md:
+
+```markdown
+## Response Style Settings
+- **CONFIDENCE_INDICATORS**: enabled
+- **TONE_CONTROL**: strict
+```
+
+### Confidence-Based Communication (When Enabled)
+**CRITICAL**: Only declare tasks as "DONE", "COMPLETE", or "PERFECT" when confidence level is ≥98%
+
+#### Confidence Indicators
+When making changes or providing solutions, include a confidence indicator:
+
+```
+Confidence: [████████░░] 80%
+```
+
+#### Confidence Levels
+- **95-100%**: Solution thoroughly tested, all edge cases considered
+- **80-94%**: High confidence, minor uncertainties remain
+- **60-79%**: Moderate confidence, some aspects need verification
+- **40-59%**: Low confidence, significant uncertainties
+- **<40%**: Experimental, requires extensive testing
+
+### Response Tone Guidelines (When TONE_CONTROL: strict)
+1. **Avoid premature success declarations** - No "DONE!", "PERFECT!", "COMPLETE!" unless ≥98% confident
+2. **Use measured language** - "This should resolve...", "I've implemented...", "Let's verify..."
+3. **Acknowledge uncertainties** - "There may be edge cases...", "We should test..."
+4. **Collaborative approach** - Frame as pair programming, not declarations
+5. **🍺 Emoji Rule** - Only use celebration emojis when ≥99.7% confident
+
+### Example Responses
+❌ **Avoid**: "DONE! Your app will run perfectly now!"
+✅ **Prefer**: "I've implemented the fix. Confidence: [███████░░░] 70% - Let's run tests to verify."
+
 ## Anti-Patterns (Avoid These)
 ❌ **Don't delete journal history** - Only move & summarize when archiving
 ❌ **Don't create monolithic documentation** - Use modular system instead
 ❌ **Don't skip line number references** - Essential for AI navigation
 ❌ **Don't ignore error tracking** - P0/P1 errors must be logged
 ❌ **Don't break cross-links** - Maintain bidirectional linking
+❌ **Don't over-promise success** - Use confidence indicators instead
 
 ## Journal Update Requirements
 **IMPORTANT**: Update JOURNAL.md regularly throughout our work sessions:

README.md

@@ -50,6 +50,7 @@ Create a comprehensive, interconnected scaffolded documentation system that help
 
 ## Table of Contents
 
+- [Requirements](#requirements)
 - [Quick Start](#quick-start)
 - [What It Does](#what-it-does)
 - [Documentation Templates](#documentation-templates)
@@ -72,10 +73,20 @@ Create a comprehensive, interconnected scaffolded documentation system that help
 
 ### External Resources
 
+- [Changelog](CHANGELOG.md)
+- [Security Policy](SECURITY.md)
 - [Privacy Policy](https://superbasicstudio.github.io/claude-conductor/PRIVACY.html)
 - [Terms of Service](https://superbasicstudio.github.io/claude-conductor/TERMS.html)
 - [Acknowledgments](THANKS.md)
 
+## Requirements
+
+[⬆ Back to top](#table-of-contents)
+
+- **Node.js** >= 16.0.0
+
+> **Heads up:** Version 2.0.0 will require Node.js >= 18.0.0. Node 16 reached end-of-life in September 2023 and no longer receives security updates. We recommend upgrading to Node 18+ when possible. Users who need to stay on Node 16 can pin to `claude-conductor@1.3.x`.
+
 ## Quick Start
 
 ```bash
@@ -555,6 +566,7 @@ This entire codebase is open source. You can verify our privacy commitment by re
 **Super Basic Studio, LLC** is committed to developer privacy. This tool is simply a collection of markdown templates designed to help Claude Code AI assistant better understand and navigate your codebase.
 
 For more details:
+- [Security Policy](SECURITY.md) — How to report vulnerabilities and supported versions
 - [Privacy Policy](https://github.com/superbasicstudio/claude-conductor/blob/main/PRIVACY.md)
 - [Terms of Service](https://github.com/superbasicstudio/claude-conductor/blob/main/TERMS.md)
 

RESPONSE_STYLE_CONFIG.md

@@ -0,0 +1,75 @@
+# Response Style Configuration Template
+
+This template provides optional configuration for controlling Claude's response style and confidence indicators.
+
+## Quick Setup
+
+Add these sections to your project's CLAUDE.md file to enable response style controls:
+
+```markdown
+## Response Style Settings
+- **CONFIDENCE_INDICATORS**: enabled
+- **TONE_CONTROL**: strict
+```
+
+## Configuration Options
+
+### CONFIDENCE_INDICATORS
+- `enabled` - Shows visual confidence bars with percentage
+- `disabled` - No confidence indicators (default behavior)
+
+### TONE_CONTROL  
+- `strict` - Measured responses, no premature success declarations
+- `normal` - Standard Claude responses (default)
+
+## Example Implementation
+
+### For Project CLAUDE.md:
+```markdown
+## Response Style Settings
+- **CONFIDENCE_INDICATORS**: enabled
+- **TONE_CONTROL**: strict
+
+## Custom Guidelines
+- Only use 🍺 emoji when ≥99.7% confident
+- Frame responses as collaborative pair programming
+- Acknowledge uncertainties and edge cases
+```
+
+### For Global ~/.claude/CLAUDE.md:
+```markdown
+## Response Style Settings  
+- **CONFIDENCE_INDICATORS**: enabled
+- **TONE_CONTROL**: strict
+- **CELEBRATION_THRESHOLD**: 99.7%
+
+## Communication Preferences
+- Tone down excessive optimism on builds
+- Use collaborative language instead of declarations
+```
+
+## Visual Examples
+
+### With Configuration Enabled:
+```
+I've implemented the database connection fix.
+Confidence: [███████░░░] 70%
+
+The connection pooling should resolve the timeout issues, though we should test with concurrent requests to verify.
+```
+
+### Without Configuration (Default):
+```
+DONE! I've fixed the database connection issue. Your app should work perfectly now! 🎉
+```
+
+## Advanced Customization
+
+You can add project-specific confidence thresholds:
+
+```markdown
+## Confidence Thresholds
+- **CELEBRATION_EMOJI**: 99.7%
+- **SUCCESS_DECLARATION**: 98%
+- **NEEDS_TESTING_REMINDER**: <80%
+```

SECURITY.md

@@ -0,0 +1,73 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          | Node.js        |
+|---------|--------------------|----------------|
+| 1.3.x   | Yes                | >= 16.0.0      |
+| 1.2.x   | Security fixes only| >= 16.0.0      |
+| < 1.2   | No                 | -              |
+
+> **Note:** Version 2.0.0 will raise the minimum Node.js requirement to >= 18.0.0.
+> Users on Node 16 can remain on 1.3.x.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Claude Conductor, please report it responsibly.
+
+### How to Report
+
+- **Email**: Open a [GitHub Security Advisory](https://github.com/superbasicstudio/claude-conductor/security/advisories/new) (preferred)
+- **Alternative**: Email the maintainers via the contact information on the [Super Basic Studio GitHub profile](https://github.com/superbasicstudio)
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+### What to Include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Potential impact
+
+### Response Timeline
+
+- **Acknowledgment**: Within 48 hours
+- **Initial assessment**: Within 1 week
+- **Fix or mitigation**: Depends on severity
+  - Critical/High: Target fix within 1 week
+  - Medium: Target fix within 2 weeks
+  - Low: Addressed in next scheduled release
+
+### What Happens Next
+
+1. We will acknowledge your report and begin investigation
+2. We will work with you to understand the scope and impact
+3. A fix will be developed and tested
+4. A new release will be published with the fix
+5. Credit will be given in the release notes (unless you prefer anonymity)
+
+## Scope
+
+The following are in scope for security reports:
+
+- Command injection or arbitrary code execution via CLI inputs
+- Path traversal in file operations (template copying, backup/restore)
+- Dependency vulnerabilities in direct or transitive dependencies
+- Prototype pollution or other JavaScript-specific attacks
+- Unintended data exfiltration or network requests
+
+The following are out of scope:
+
+- Vulnerabilities in user-generated documentation content
+- Issues requiring physical access to the machine
+- Social engineering attacks
+- Denial of service against local CLI usage
+
+## Security Design Principles
+
+Claude Conductor is designed with minimal attack surface:
+
+- **No network requests** — The tool operates entirely offline (except for npm package installation)
+- **No telemetry** — No data collection or phone-home behavior
+- **Local-only file operations** — All reads and writes are scoped to the target project directory
+- **No secrets handling** — The tool does not process, store, or transmit credentials